What would your business do if employees could not enter the building, a critical supplier stopped delivering, or essential technology became unavailable? Business continuity planning addresses these questions before an interruption forces management to make decisions under pressure. For businesses in Nassau County, Suffolk County, and throughout New York, the starting point is understanding which activities must continue and what resources those activities require.
This article explains preparedness concepts using federal government resources, including Ready.gov, the U.S. Small Business Administration, NIST, and CISA. Planning examples are illustrative rather than accounts of actual incidents. Risk Management International LTD (RMI) provides risk management consulting, including strategic and operational risk management, and does not sell insurance.
What Does Business Continuity Planning Cover?
Ready.gov identifies business continuity, emergency response, crisis communications, and information technology disaster recovery as connected parts of business preparedness. Its guidance recommends establishing a continuity team and developing technology recovery arrangements alongside the broader continuity plan.
These activities address different questions. Emergency response concerns immediate protective actions. Continuity planning examines how essential work can proceed during disruption. Technology recovery addresses restoring systems and information needed to support that work. An organization should coordinate these activities while recognizing their different purposes.
Source: Ready.gov — Emergency Plans.
Begin With the Business, Not a Generic Template
The U.S. Small Business Administration recommends assessing business-specific vulnerabilities, creating a response plan tailored to operations, and practicing that plan with staff. It also advises keeping the plan accessible and addressing immediate priorities.
For a Long Island organization, this means describing how the company actually operates before selecting recovery arrangements. A professional office, food distributor, manufacturer, and construction contractor may depend on very different resources. A template can organize information, but it cannot establish which activities matter most to a particular company.
Source: U.S. Small Business Administration — Prepare for Emergencies.
Identify Hazards Without Treating Scenarios as Predictions
Ready.gov’s business risk assessment worksheet considers both the probability of a scenario and its possible effects. The worksheet addresses impacts on people, property, operations, the environment, and the organization, including financial, contractual, regulatory, and reputational considerations.
This provides a structured way to discuss potential disruptions without claiming that a particular event will occur. Management should record the information supporting its assessment and identify uncertainty rather than present assumptions as verified facts.
For example, an organization evaluating a facility access interruption should document what would become unavailable and which activities would be affected. It should not assign a precise loss estimate without supporting information.
Source: Ready.gov — Business Risk Assessment Table.
Use a Business Impact Analysis to Examine Essential Activities
NIST defines a business impact analysis as examining operational functions and the effects that disruption might have on them. The focus is on understanding consequences for the business.
Suggested questions for an internal assessment include: Which activities support customer commitments? Which processes depend on a particular employee or system? What happens if a process stops for several hours or several days? Which information is needed to restart it?
A hypothetical Nassau County service company might examine appointment scheduling, customer communications, and access to work records separately. These activities may require different recovery arrangements. The example illustrates the assessment process and does not establish priorities for every service company.
Source: NIST — Business Impact Analysis.
Document Important Contacts and Outside Dependencies
The SBA’s continuity planning guidance recommends creating a contact list for important contractors and vendors that a business expects to use during an emergency. The same guidance encourages organizations to begin planning before disruption occurs.
A practical application is to record a primary contact, an alternative contact, and the service each provider supports. Keep the information available through an authorized method that does not depend entirely on the system being considered in the disruption scenario.
For a hypothetical Suffolk County distributor, the exercise could include contacting transportation providers and asking about alternative delivery arrangements. Record confirmed capabilities separately from options that still require discussion or agreement.
Source: SBA — Seven Ways to Start Your Business Continuity Plan.
Plan Communications Before They Are Needed
Ready.gov explains that emergencies create immediate communication needs involving employees, customers, and other relevant parties. Preparing communications arrangements in advance supports a timely response.
As a practical planning step, identify who approves messages, who distributes them, and which channels remain available if normal communications fail. Prepare short message templates that distinguish confirmed information from unresolved questions.
A customer update might state which services are affected and when the next update will be provided. Avoid promising a restoration time before the responsible team has established a reasonable basis for it. Include a process for correcting earlier information when circumstances change.
Notification duties depend on the circumstances; a general communications checklist does not determine every legal or contractual obligation.
Include Technology and Data Recovery
CISA’s ransomware guidance recommends maintaining offline, encrypted backups of critical data and regularly testing backups. Its guidance treats recoverability as something organizations must verify rather than assume.
For continuity planning, ask the technology team or service provider to identify which information is backed up, how backups are protected, and what restoration testing has demonstrated. Record unanswered questions and the person responsible for resolving them.
A suggested exercise is to restore an authorized sample of business information in a controlled environment and check whether it can be used. Technical staff should design the test to protect live operations and sensitive information. A successful sample restoration does not establish that every system can be restored within the same period.
Source: CISA and Partners — StopRansomware Guide.
Evaluate Alternative Ways to Perform Essential Work
Suggested continuity options may include temporary workspace, approved remote access, alternative suppliers, or limited manual procedures. Each option should be checked against actual operational needs before it is described as available.
For example, a hypothetical Port Washington office might propose remote work during a building closure. Management would still need to verify equipment availability, authorized access to records, employee responsibilities, and customer communication arrangements.
Likewise, naming a replacement supplier in a document does not confirm that the supplier has capacity. Record the discussions or agreements supporting each proposed option. Identify the limitations that remain and decide whether further preparation is justified.
Practice the Plan Through Training and Exercises
Ready.gov identifies training, testing, and exercises as essential preparedness activities. Its business resources include planning materials and hazard-specific toolkits for situations such as hurricanes, inland flooding, and power outages.
Use the resources relevant to the business instead of assuming that every toolkit applies equally. Training should help participants understand their roles, while exercises provide an opportunity to examine how arrangements work together.
A suggested discussion exercise could ask managers to respond to a hypothetical morning power outage. Participants would explain who checks employee safety, how customers receive updates, and which activities can continue. The exercise should reveal questions requiring follow-up rather than manufacture a claim that the business is fully prepared.
Source: Ready.gov — Ready Business.
Turn Exercise Findings Into Assigned Improvements
NIST’s guidance on test, training, and exercise programs describes their role in preparing organizations to handle adverse events affecting information technology and business operations.
A practical follow-up is to document what was tested, what participants observed, and which issues remain unresolved. Assign each improvement to a responsible person and specify the evidence needed to close it.
For example, if an exercise reveals that the alternative contact cannot access an essential document, the action should address that specific problem. Repeating the entire exercise may be unnecessary until the access issue is corrected and checked. Preserve the results so future reviews can distinguish completed improvements from outstanding work.
Source: NIST — Maintaining Effective IT Security Through Test, Training, and Exercise Programs.
Keep Nassau and Suffolk County Plans Specific to Each Operation
For businesses operating across Long Island, a suggested approach is to document important differences among locations. Identify which functions are performed at each site and whether another location can actually support them during disruption.
Do not assume that a second office can absorb all work simply because it exists. Check staffing, equipment, access permissions, capacity, and any relevant contractual restrictions. A location summary can identify confirmed alternatives and the limitations that require management decisions.
Review these arrangements when the business changes its premises, systems, staffing, or major suppliers. Set an internal review schedule appropriate to the organization and separately verify any applicable legal or contractual requirements.
Discuss Operational Risk With Risk Management International LTD
RMI’s published Strategic and Operational Risk Management services describe aligning risk practices with business objectives and financial performance. Its services also include risk identification and assessment.
Long Island businesses considering consulting support can discuss the operational questions they want examined and define the engagement’s scope. Clarify which activities require additional technical, legal, safety, or other specialist input. Do not assume that a consulting engagement includes every component of emergency management or technology recovery.
Visit RMI’s Strategic and Operational Risk Management page to learn about its published services, or use the RMI contact page to discuss your organization’s needs.
Official Business Continuity Planning Resources
- Ready.gov — Ready Business
- Ready.gov — Emergency Plans
- SBA — Prepare for Emergencies
- NIST — Business Impact Analysis
- CISA and Partners — StopRansomware Guide
This article provides general educational information. Suggested planning steps should be adapted to actual operations and verified against applicable requirements. A continuity plan does not guarantee uninterrupted service or a particular recovery outcome.