Business continuity plan vs disaster recovery plan: what North East organisations need

Last updated: 25 September 2026 by Damien Harrison, Director of Client Success. Change log: first published; regulatory and statistical references checked against primary sources on 25 September 2026.

A disaster recovery plan gets your systems and data back. A business continuity plan keeps the organisation serving clients while that happens, covering people, decisions, suppliers and communications. Many organisations have the first and assume it covers the second.

Tuesday, 7.40am. A legal practice in Stockton-on-Tees opens up to find its files encrypted. By Thursday afternoon the IT provider has restored everything from backup. The restore is clean and nothing is lost.

The practice still loses most of a week.

Fee earners spend two days working from personal phones because nobody set up an alternative way in. No one has clear authority to tell clients what has happened, so three different people give three different versions. The practice manager rings the insurer’s incident line and cannot answer basic questions about what data was affected. A completion slips, and one client hears about the incident from someone else before the firm tells them.

This is a composite of a pattern we see, rather than one client’s story. If you are a finance or operations director, the uncomfortable part will be familiar. The technology had an owner. Everything else defaulted to whoever happened to be nearest, and on a bad week that tends to be you.

It is also common. The government’s Cyber Security Breaches Survey 2025/2026 found that only 44% of small businesses had a business continuity plan covering cyber security, down from 53% the year before.

This article separates the two plans, sets out what a continuity plan needs to contain, and ends with three things you can put in place this week before a full plan exists.

A reactive support model is accountable for getting the server, the mailboxes and the applications running again. That is a fair scope for a support contract, and nobody at the provider is doing anything wrong by staying inside it. The flaw is structural. The parts of an incident that decide whether clients stay, whether the insurer pays out and whether the regulator is satisfied sit outside that scope, and the contract never says whose they are.

Backup products add to the confusion because they are often sold using continuity language. So organisations buy good backup, test it, and reasonably believe the question is closed. In our experience three failure patterns follow.

The important word is “agreed”. These targets belong to the business, and they should be signed off by the people who carry the consequences. A finance director and an IT lead will often have different instincts about how long payroll can wait, and it is far better to find that out in a meeting room than during an incident.

A quick way to put a number on a lost day

Published figures are not much help here. The government survey puts the median perceived cost of a business’s most disruptive breach at £0, because most reported incidents are low-impact phishing attempts that never stop the business. They tell you very little about what a week without your systems would cost.

So work it out for yourself. As an illustration, take 40 staff at an average employment cost of £30 an hour over a 7.5 hour day. If an outage halves their productivity, that is £4,500 a day in paid time that produces little, before you count unbilled work, delayed invoices, emergency IT costs or the client who quietly moves elsewhere. For a fee-earning firm the unbilled time is usually the larger figure.

Recycle bins, retention policies and version history help with the odd deleted file. They help much less when ransomware syncs encrypted files into SharePoint and OneDrive across the whole organisation, or when a compromised administrator account deletes data deliberately.

Microsoft now sells its own Microsoft 365 Backup product, which is a real improvement on native retention. The trade-off is that the backup copies sit inside Microsoft’s cloud alongside the live data. For most organisations in regulated sectors we recommend an independent copy held outside the tenant as well, so a problem inside your Microsoft 365 account cannot reach it.

A disaster recovery plan for Microsoft 365 should cover three things. First, backup of mail, SharePoint, OneDrive and Teams at a frequency that matches the RPO you agreed. A four hour RPO means very little if backups only run overnight. Second, protection and monitoring of Entra ID, because whoever controls your identities controls everything else. Third, a backup of your tenant configuration, including Conditional Access policies, so you can rebuild your security settings as well as your data.

Across the wider estate, the 3-2-1 principle still holds: three copies of your data, on two different types of storage, with one copy offsite. The NCSC has seen ransomware encrypt connected USB drives, network storage and cloud backups as well as live data, so its guidance on ransomware-resistant backups is worth reading. It asks for backups that resist deletion or alteration, the ability to restore an earlier version when later ones are corrupted, and alerts when someone makes significant or privileged changes.

If you want help with this part, see our managed backup and disaster recovery service.

Bondgate IT is certified to ISO 27001, ISO 9001 and Cyber Essentials, so our own continuity arrangements are part of what external auditors examine every year. We have seen what a major incident does to an organisation in this region at close quarters: we featured in the BBC documentary Cyber Siege: From Russia to Redcar, which followed the 2020 ransomware attack on Redcar and Cleveland Council. When we build a plan with you, we act as part of your team through the process rather than handing over a template. We have supported organisations from our base in Darlington since 1998, with engineers on site across the Tees Valley every week, including IT support in Stockton-on-Tees and IT support in Middlesbrough.