Preparing Your Business
Every year businesses like yours suffer major disruption from a range of unplanned events and many never recover – but past experience from such incidents in the UK shows that organisations which have ‘business continuity’ arrangements in place are more likely to stay in business and recover more quickly than those that don’t.
On this page:
Business Continuity
Business continuity is about identifying risks which may interrupt the operation of your business and developing plans and arrangements to reduce those risks and ensure prompt recovery.
Cyber Security
The threat to your business faces in cyber space is incresing and changing. Cyber attacks can have a devistating impact on your business operations which must be taken serioulsy.
Counter Terrorism
New legislation, known as Martyn’s Law, will place new requirements on most businesses to take proactive steps to put protective processes or measures in place to protect the public.
Business Continuity
Business continuity is about identifying risks which may interrupt the operation of your business and developing plans and arrangements to reduce those risks and ensure prompt recovery.
Business continuity management
Every year businesses like yours suffer major disruption from a range of unplanned events and many never recover – but past experience from such incidents in the UK shows that organisations which have ‘business continuity’ arrangements in place are more likely to stay in business and recover more quickly than those that don’t.
Business continuity is about identifying risks which may interrupt the operation of your business and developing plans and arrangements to reduce those risks and ensure prompt recovery. There are many formal definitions of business continuity but they all centre around:
- assessing what might go wrong, and
- planning to minimise disruption should the worst happen.
The need for business continuity management
Successful businesses have the flexibility to prosper in changing conditions and are strong enough to survive should disaster strike. The ability to withstand serious incidents like flooding or fire, and to quickly reopen for business-as-usual, is critical. There is also a commercial benefit to consider: proven resilience and business continuity arrangements will distinguish your business from its competitors – companies with business continuity plans are more attractive to do business with.
For small businesses, the impact of disruptive events may be more significant since many such businesses operate in specialised markets where even a short interruption to business-as-usual can have a disproportionate effect – halting output and letting customers down. In addition, it is more difficult to absorb the financial impact of business interruption, making it harder for small businesses to recover even after returning to normal operations.
If you believe that ‘forewarned is forearmed’ then a small amount of time preparing for such incidents must be time well spent. In fact, can you afford not to prepare for disruption?
Follow the simple steps below to make a start on improving the resilience of your business.
Business continuity management – where do I start?
There is no ‘dark art’ to business continuity management! A simple, common sense approach will set you on your way. Get some colleagues together and try these two steps:-
Step 1 – Analyse your business
Think about the parts of your business that are crucial in keeping it going.
- Identify your ‘core business requirements’. What do your customers expect? What must your business be able to provide as a minimum and how quickly?
- Identify the interactions that take place within your business, between you and your customers and you and your suppliers. Who do you deal with and how? Which aspects and relationships are key and which are less important?
Step 2 – Assess the risks
Identify the areas in which each part of your business is vulnerable. Think about any incidents that have happened or any near-misses you have experienced.
- What are the greatest risks to your business?
- How likely are they to happen?
- What effect will they have on the business?
Some key risks to think about include:-
- Denial of access to your building or site – fire, flood, crime scene / emergency services’ cordon
- Loss of technology, equipment or data – theft, cyber attack, IT or other equipment failure
- Staff unavailability – disease pandemic, sickness outbreak, transport disruption
- Loss of a key supplier or key resources – materials shortage, utilities failure
Work through these two steps to produce a list of your business’ most important activities and what might threaten them. It may be possible to eliminate some of the risks entirely – others may be too costly or too difficult to deal with or may be outside of your control. The biggest remaining risks which you are unable to eliminate are the ones that you should consider planning for – that is, putting a strategy in place for how you would respond should the risk occur.
Developing a business continuity plan
Having put in the hard work to develop your business continuity plan it makes sense to keep it up-to-date and to periodically test or exercise it to ensure that nothing has been omitted. Make sure that you involve the key staff who would be tasked with implementing your plan so you can be reassured that each is fully aware of their responsibilities.
Exercising and rehearsal can take a variety of forms – these are just some examples:-
- Read through your plan as a group, perhaps using a scenario to reflect a realistic source of disruption. Ask at each point whether the correct actions appear in the right order.
- Check the ‘telephone cascade’ (arrangements for contacting everyone out of hours) works. Are the right people on the right numbers? Does everybody know who they should contact? What would happen if the phones weren’t working?
- Carry out a full, practical rehearsal. Make sure all elements of the plan work together
Top tip: don’t jump in at the deep end – plan to start with simple tests and build up to something more involved over time!
For each test, don’t forget to capture any lessons learned and update your business continuity plan accordingly.
Where can I get more information?
There is a wide range of free, practical online resources you can use and we’ve listed some of these below. Please note that Gloucestershire Prepared does not actively endorse or recommend any of the products, resources or websites mentioned – they are signposted for information only.
- Gov.uk – Resilience in society: infrastructure, communities and businesses – Business continuity
- HM Government Business Continuity Management Toolkit
- The Business Continuity Institute – What is Business Continuity?
- Business in the Community – Resilience Starter Kit
- Continuity Central – Knowledge Base
- Gov.uk – Expecting the unexpected
- Western Power – Helping your business prepare for a power cut
- Checklist from the National Cyber Security Centre
Also, speak to your insurer about business continuity – some providers offer their own business continuity plan templates and guidance to their business customers.
Cyber Security
The threat to your business faces in cyber space is incresing and changing. Cyber attacks can have a devistating impact on your business operations which must be taken serioulsy.
Cyber Security
We live in a digital‑focused world where individuals, businesses, charities and governments rely on technology and online systems to deliver essential services. As a result, any organisation or sector that uses IT networks is exposed to cyber threats.
Cyber criminals exploit weaknesses in digital systems, usually for financial gain. They use technology to steal data, carry out fraud, and increase the scale and reach of crime. Recent high‑profile attacks have shown how cyber crime can disrupt services, compromise sensitive information and damage business operations.
As dependence on technology grows, cyber threats are becoming more advanced and widespread. The impacts can include disruption to digital services, financial loss, theft of sensitive or personal information, reputational damage, and interruption to computer networks and business activity.
What you can do to protect your business
The Government’s Cyber Action Toolkit is desinged to help businesses protect themselves from cyber criminals and attacks. It provides bite-sized actions to help protect their money and reputation from cyber criminals.
The National Cyber Security Centre also provides advice and guidance for businesses of all sizes to help with cyber security.
Please note that Gloucestershire Prepared does not actively endorse or recommend any of the products, resources or websites mentioned – they are signposted for information only.
Counter Terrorism
New legislation, known as Martyn’s Law, will place new requirements on most businesses to take proactive steps to put protective processes or measures in place to protect the public.
Protect Duty (Martyn's Law)
The Terrorism (Protection of Premises) Act 2025, also known as Martyn’s Law, will ensure the public are better protected from terrorism, by requiring certain public premises and businesses to be prepared and ready to keep people safe in the event of an attack.
The Terrorism (Protection of Premises) Act 2025 received Royal Assent on Thursday 3 April 2025.
The Government intends for there to be an implementation period of at least 24 months from the date of Royal Assent before the Act comes into force. This period will enable those responsible for premises and events to have sufficient time to understand their new obligations, and to plan and prepare accordingly.
Whilst those that fall within scope of the Act may wish to consider the requirements, there is no requirement to comply with them until the legislation comes into force. The Home Office has publish statutory guidance to assist those responsible to understand the requirements set out in the legislation.
ACT in a BOX Exercises
ACT in a BOX is an interactive exercising experience which enables businesses to rehearse and explore their response to fictional terrorist incidents at or near their premises.
The immersive digital tool enables businesses to rehearse and explore their response to a fictional terrorist incident at or near their premises.
The fully interactive experience puts you, your staff and colleagues at the heart of a scenario by allowing you to influence the content and decide what to do next. Throughout each exercise, participants will also collectively reflect on their own workplace arrangements and physically complete activities, recording key considerations within the experience. You will have the opportunity to download a bespoke summary document at the end.
All scenarios are designed to be completed in a group format with a nominated facilitator to run the experience on a digital device and guide discussions. Further information can be found in the comprehensive Facilitation Guide, downloadable at the start of each scenario.
Martyn's Law Factsheet
Please refer to the wider factsheets and legislation documentation which can be found on gov.uk.
Where can I get more information?
There is a wide range of free, practical online resources you can use and we’ve listed some of these below. Please note that Gloucestershire Prepared does not actively endorse or recommend any of the products, resources or websites mentioned – they are signposted for information only.