How can businesses recover when their primary site is unavailable?

Business continuity during a primary-site outage depends on maintaining access to the people, information, applications and decisions needed to deliver critical services from a controlled alternative arrangement. Recovery is not simply a matter of restoring servers; it requires a coordinated operating model that addresses technology, facilities, staff, suppliers and communication.

Start with a business impact assessment

Identify the consequences of losing the site rather than beginning with a list of IT equipment. For each business function, record:

• the activities that must continue for the organisation to operate;
• the applications, files, devices and communications those activities depend on;
• the internal teams, suppliers and customers involved;
• any legal, contractual or safety obligations; and
• the effect of disruption over time.

This assessment helps distinguish genuinely critical processes from tasks that can be deferred. It should also identify dependencies that are easy to overlook, such as access-control systems, telephony, printing, specialist machinery, shared drives, authentication services and information held by third-party providers.

Define the conditions for invoking the plan

A recovery plan needs clear decision criteria. The responsible person should know who can declare a site unavailable, what evidence is required, and which circumstances justify moving to the recovery arrangement. Examples may include building damage, loss of power, flooding, a serious security incident or the unavailability of core network equipment.

Authority should not depend on one individual being present. Assign deputies, maintain current contact details and record how the decision will be communicated. If the incident may involve compromised accounts or malware, the plan must also state who can isolate systems and approve their reconnection.

Design the operating arrangement around dependencies

An alternate working arrangement is only useful if staff can securely reach the services they need. Check the complete access chain, including internet connectivity, identity management, multi-factor authentication, virtual private network access, domain services, endpoint configuration and permissions. A replacement location may require suitable power, networking, desks, telephony and secure access to business information.

Remote access creates its own requirements. Organisation-owned or appropriately managed devices should be configured with security controls, supported operating systems, encryption and protection against unauthorised access. Staff should understand how to report suspicious activity and how to handle confidential information away from the main premises. Personal devices and informal file-sharing methods can introduce risks that are not present in the normal office environment.

Preserve communication and accountability

Customers, suppliers and employees need consistent information during a disruption. Establish approved communication channels and prepare messages for internal updates, service changes, supplier coordination and customer enquiries. Avoid publishing technical details that could increase security risk.

A simple incident log should record decisions, actions, owners, outstanding issues and changes to system status. This prevents duplicated work and provides an accurate record for later review. Where several teams or sites are involved, a designated incident coordinator can maintain the overall view while technical and operational leads manage their own tasks.

Test the process, not just the technology

Technical recovery checks do not prove that the organisation can operate from another location. Exercises should involve the people who would make decisions and perform the work. Useful tests include:

1. working through a loss-of-site scenario as a discussion exercise;
2. checking that nominated staff can access required systems and contact lists;
3. confirming that authentication, communications and business applications function from the alternative arrangement;
4. verifying that staff know how to handle work that cannot be completed electronically; and
5. recording gaps, assigning owners and setting review dates.

Testing should be proportionate to the organisation’s risks and should include changes such as new software, altered suppliers, office moves, staff turnover or changes to network architecture. A plan that has not been exercised may contain inaccurate contacts, expired credentials or assumptions about systems that no longer exist.

Plan the return to the primary site

Returning is a separate phase of recovery. Confirm that the building, connectivity, power, equipment and security controls are suitable before moving work back. Decide whether systems should be returned in stages and establish how new or changed information created during the disruption will be reconciled. A controlled transition reduces the risk of duplicated records, lost transactions and premature reliance on damaged infrastructure.

S2 Technology Group can help organisations assess infrastructure dependencies, strengthen backup and recovery arrangements, and align technology controls with a wider business continuity plan. The appropriate design depends on the organisation’s systems, operating model and tolerance for disruption, so the plan should be reviewed whenever those factors change.