Keeping the Business Running While IT Recovers: A Practical Continuity Guide
On July 19, 2024, a faulty security software update crashed Windows systems at organizations worldwide. Insurer Parametrix estimated the direct losses to Fortune 500 companies alone at $5.4 billion and projected that cyber insurance would cover only 10% to 20% of that total [1].
The lesson reaches beyond one vendor’s mistake: no policy or contract keeps a business running while its core systems are down. The window between failure and safe restoration is where most of the damage, or most of the resilience, takes shape.
Why the Recovery Window Decides the Outcome
The outage disrupted every Fortune 500 airline, but their recoveries looked very different. Five days later, Delta Air Lines was still canceling hundreds of flights, far more than any other U.S. carrier, and the Department of Transportation had opened an investigation. Delta said the failure had knocked out a critical crew-scheduling system.
The trigger was identical; what differed was how each operation functioned during recovery. Disaster recovery brings systems back, while business continuity determines how the organization performs in the meantime. Few feel ready: in a Cockroach Labs survey of 1,000 senior technology executives, only 20% said their organizations were fully prepared to prevent or respond to outages [2].
Define Your Minimum Viable Operations
Every organization should be able to answer one question before a crisis: what is the smallest version of this business that still works? For a distributor, that may mean taking orders and releasing shipments.
The answer isn’t a list of everything that matters. Instead, it’s the handful of activities that must continue, even at reduced speed, for the business to stay solvent. Defining them in advance turns degraded operations into a planned state rather than an improvised scramble and gives IT a clear restoration order when every department wants to go first.
Build Manual Workarounds and Offline Fallbacks
Map how each essential activity could run without its usual systems. Practical fallbacks include:
- Paper or spreadsheet processes for orders, transactions, and inventory, with a plan to re-enter the data once systems return
- Offline copies of runbooks, contact lists, and vendor account details
- Pre-approved emergency spending authority, so managers can add staff or reroute shipments without waiting on offline approval workflows
Rehearse these workarounds with the teams responsible for each function so manual mode feels familiar when a crisis strikes.
Establish Clear Command and Decision Rights
Confusion over who can make decisions can cost as much time as the technical failure itself. Name three leads in advance: an incident lead who directs technical recovery, a continuity lead who keeps operations moving, and a communications lead who controls messaging.
Written decision rights, such as who can take a customer-facing system offline or authorize a switch to a backup provider, prevent hours of debate when minutes matter.
Restore in Order and Verify Before Reconnecting
Restore in the order your minimum viable operations require, not whichever system is quickest to fix. Delta’s IT teams, for example, had to repair and reboot each affected machine manually, then give applications time to resynchronize before they could communicate again.
When a cyberattack is the cause, speed carries added risk. The NIST Cybersecurity Framework (CSF) 2.0 calls for verifying backup integrity before restoring and confirming restored-asset integrity before declaring normal operations [3]. Reconnecting before closing the attacker’s entry point gives the intruder a second chance. Independent validation, such as CREST-certified penetration testing, can confirm a rebuilt environment is secure before it returns to production.
Communicate on a Predictable Cadence
In a prolonged outage, silence does more damage than bad news. Customers who hear nothing assume the worst and may fill the gap with a competitor’s offer. Commit to updates at fixed intervals, even when the only news is that work continues, and route external messages through a designated spokesperson to keep the story consistent.
NIST treats this communication as part of recovery itself, calling for progress updates to designated stakeholders and public updates through approved methods and messaging. Clients who later learn they were kept in the dark about a breach rarely extend the benefit of the doubt twice.
Reduce Concentration Risk in Your Stack
The 2024 outage also revealed that the tools organizations deploy for protection can become single points of failure. Parametrix concluded that a protective measure had become a risk aggregator that amplified the event’s impact. It also found that software and IT services firms were among the least affected, largely because they tend to run Linux in their cloud environments.
Diversification doesn’t mean duplicating every tool. It means knowing where a single vendor, platform, or operating system sits beneath your essential operations, and understanding which recovery tasks the shared responsibility model leaves to you. Even redundant designs hide weak spots, since common high-availability mistakes can quietly reintroduce single points of failure.
Declare Recovery Complete and Capture the Lessons
Recovery shouldn’t end just because complaints stop. NIST calls for declaring the end of incident recovery based on defined criteria and completing incident documentation. Set those criteria ahead of time: systems verified, data reconciled, manual records reentered, and customer backlogs cleared.
Then hold an after-action review while details are fresh. Which workarounds held up? Where did decisions stall? Feed the answers back into your continuity plan and control framework. HITRUST certification, which includes a business continuity and disaster recovery domain covering recovery testing, offers an independent way to confirm those improvements hold over time.
Plan for the Gap, Not Just the Restoration
Most continuity planning focuses on getting systems back online. Organizations that emerge from major outages with customers and reputations intact planned just as carefully for the hours and days in between. Investing in resilient infrastructure matters, but so does building a business that can keep working while that infrastructure recovers.
References
- Parametrix. (2024). CrowdStrike’s impact on the Fortune 500 [Impact analysis]. https://www.parametrixinsurance.com/reports-white-papers/crowdstrikes-impact-on-the-fortune-500
- Cockroach Labs. (2024). The state of resilience 2025: Confronting outages, downtime, and organizational readiness. https://www.cockroachlabs.com/guides/the-state-of-resilience-2025/
- National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). https://doi.org/10.6028/NIST.CSWP.29
Author Bio
Nazy Fouladirad is President and COO of Tevora, a global leading cybersecurity consultancy.
She has dedicated her career to creating a more secure business and online environment for organizations across the country and world.
She is passionate about serving her community and acts as a board member for a local nonprofit organization.