Define what must continue first
List the products, services, deadlines, payments, customer commitments, safety responsibilities, and regulatory functions that cannot wait. For each, identify the people, facilities, systems, data, equipment, utilities, vendors, and approvals required at a minimum operating level.
Write the first-72-hour decision path
- Life safety, emergency contacts, incident leadership, delegated authority, and succession.
- Employee, customer, vendor, insurer, regulator, landlord, and public communications with approved owners.
- Remote or alternate work, manual procedures, payment controls, critical records, and priority vendors.
- Technology containment, backup access, recovery order, restoration targets, and independent validation.
- Event log, decisions, expenses, evidence, open risks, and the criteria for normal operations or escalation.
Exercise a realistic scenario
Run a tabletop exercise using a likely disruption such as loss of email, key staff, internet, facility access, a vendor, or critical data. Time the decisions, verify contact information and access, test at least one manual workaround or recovery step, and assign corrective actions with owners and deadlines.
Coordinate emergency, technology, legal, insurance, privacy, employment, and regulatory responsibilities with the qualified professionals relevant to the business.