Good Enough is Good Enough

Guess what I'm not going to tell you. That you need to spend all of your money on business continuity. Why? You can throw thousands upon thousands of dollars a year on your business continuity plan and still not be 100% secure. You never will.

Even if you didn't use the internet (a closed loop system would prevent a cyber attack), relied on no suppliers, and had contingencies for every weather event, it's still possible for you to have a disruption (insider attack, for one). That's why an 80% solution is good enough. Even 60% will make you so much more resilient than you are now and compared to your competitors.

Naturally, that 80% won't be sufficient if your business is one of the small businesses that are part of the privatized area of critical infrastructure contractors (like local water treatment facilities). But I'm not usually talking to those businesses. Generally, most small businesses will be more than fine with a 80% solution - but not if what you put in to get to 80% is poor quality, check-the-box b.s. Or maybe 80% is the best you can do because you are in Vancounver, BC, and the cascadia subduction zone (CSZ) event is forthcoming. No matter what you do or how much money you spent, none of your employees will be able to work for at least a month...unless you have paid to rent and supply a shadow office on the other side of the continent waiting for the event to occur...which will be very expensive.

Don't know what the CSZ event is? Basic idea: a massive earthquake will happen in the Pacific Ocean that will destroy buildings from the coast to the Cascade mountain range and cause a tsunami that will wipe out towns immediately on the coast, from Vancounver to Sacramento, and take out I-5. It usually happens every 300 yrs. We've been overdue for some time. Everyone in the PNW knows about it. I was part of response planning meetings for the CSZ in 2016. It hasn't happened yet. But it will.

Does it sound like something a business continuity plan can solve for if you are a small business located in the area? No, but yes when you think of the things I just said (prepare what you can and plan for not being able to do anything).

It's sometimes best to plan for what you can control and accept that the thing you won't be able to control will hurt you for an extended period of time. You can still make a plan for when that happens, though. Know what you will do for that month and how you'll be getting back to business before it happens. It does help when the event has a timeline based on history and a name.

Don't get overwhelmed about not knowing where to start or it's too much to even know where to begin. Go for the low hanging fruit. Take care of little things and gain some momentum. Perfect doesn't exist and isn't worth the money since there are no guarantees. Good enough is often plenty good enough, especially when it's 80% (and you're actually trying to do it well instead of phoning it in).