Business continuity planning has an intimidating reputation, largely because most of the published material is written for organisations with dedicated risk teams. For a business of ten or thirty people, the useful version is much simpler: walk around and find the things that only exist once.
A single point of failure is any component whose loss stops work. Finding them takes an afternoon. Fixing the important ones is usually cheaper than people expect.
The internet connection
Start with the obvious one. Most small offices have a single connection from a single provider over a single physical path. When it fails — and NBN faults are measured in days, not hours — everyone stops.
The standard mitigation is a second connection on a different technology, typically a 4G or 5G failover that activates automatically. This costs less monthly than one hour of a stalled office and requires a router that supports it. The important detail is testing it: unplug the primary connection deliberately, on a quiet morning, and confirm the failover actually engages. Untested failover fails at the worst moment surprisingly often.
The one server under the desk
Many offices still have a physical machine doing something essential — file storage, a line-of-business application, a licence server. It often sits somewhere with poor ventilation and no UPS, and its backup arrangement dates from whenever it was installed.
The question is not whether it will fail but what happens on the day it does. If the answer involves sourcing identical hardware, that is a multi-day outage. Cloud migration is the usual long-term answer; where that is not practical, having a documented rebuild path and a backup you have actually restored from is the minimum.
The person who knows how it works
This is the single point of failure that businesses consistently underrate. Somewhere in your organisation is one person who knows the password to the domain registrar, or how the quoting spreadsheet actually calculates, or which supplier to ring when the machine does the thing.
That knowledge is undocumented, and it takes annual leave. Write it down. A shared document listing critical systems, who the vendor is, where credentials live and what the recovery process looks like is unglamorous and enormously valuable. Businesses that use an outsourced managed IT provider often get this documentation as a by-product of onboarding, which is one of the underrated reasons to have one.
Credentials and access
Related, and worse: accounts registered to an individual’s personal email, domains renewing on a former employee’s credit card, a two-factor code going to a phone number nobody controls any more.
Everything critical should be registered to a business-controlled address, with recovery options that survive staff turnover, and access held by at least two people. A domain you cannot prove you own is a domain you can lose, and losing it takes your website and email with it.
Power
A brief outage is an inconvenience; an unexpected shutdown mid-write can corrupt data. A UPS on anything with a disk buys you a clean shutdown for a few hundred dollars. Check the batteries annually — they degrade, and an untested UPS is decoration.
The physical premises
Fire, flood and extended building access loss are low-probability but total. The test is simple: if nobody could enter the office for a fortnight, could the business operate? If the answer depends on a filing cabinet or a machine in that building, you have found something worth addressing.
Turning the list into a plan
Rank what you find by two factors: how likely it is, and how long recovery would take. Fix the ones that are both plausible and slow first. Failover internet and offsite backups usually top that list; premises risk usually sits lower.
Then close the loop with monitoring, so you find out about failures rather than discovering them. Continuity planning without detection just means you have a well-documented response to something you learn about four hours late. Most of the businesses that handle outages well do not have better luck — they have shorter detection times, and they wrote things down before they needed them.