Interested in our Cybersecurity Framework?
Visit our article on how to organise an effective cybersecurity strategy to download a copy of our framework.
Could Someone Be Sending Emails as Your Organisation?
Learn how email spoofing protection helps safeguard your reputation and reduce cyber risk.
Award-Winning IT Services
Discover why we were named IT Services Provider of the Year by Corporate LiveWire. Read our latest blog to learn more about our innovative solutions and commitment to excellence
Interested in a Free Phishing Security Test?
VirtueUK are partners with KnowBe4, the world's largest security awareness training and simulated phishing platform.
If you're interested in assessing the Phish-prone percentage of your users, contact us to arrange a free simulated phishing attack.
If you're interested in assessing the Phish-prone percentage of your users, contact us to arrange a free simulated phishing attack.
The National Cyber Security Centre (NCSC) advises organisations to build resilience on the assumption that disruption will occur at some point, whether through a technology failure, cyber incident, supplier issue, or loss of connectivity. While cloud services such as Microsoft 365 are highly reliable, no platform can guarantee 100% availability. The organisations that recover most effectively are those that have planned ahead, identified their critical services, established alternative ways to communicate, and ensured key business functions can continue during periods of disruption. Business continuity is not about preventing every outage. It is about reducing the impact when one happens and maintaining services until normal operations resume.
For many UK organisations, Microsoft 365 underpins email, document storage, collaboration, and day-to-day communication. If access is disrupted, even temporarily, the impact can quickly spread across teams, customers, suppliers, and service delivery. That’s why resilience planning should be considered a business responsibility, not simply an IT concern.
Outages Happen, Even to Major Providers
Many organisations assume that using Microsoft, Google, or other large cloud providers removes the risk of downtime. In reality, every technology provider occasionally experiences service interruptions.
Microsoft 365 has experienced several high-profile incidents affecting Exchange Online, Teams, SharePoint, and authentication services. Internet service providers can also suffer outages, preventing access to cloud systems altogether.
The National Cyber Security Centre (NCSC) emphasises that cyber resilience is not simply about preventing incidents. It is about ensuring organisations can continue functioning despite setbacks and recover quickly when disruptions occur.
For many UK organisations, a handful of digital services support most daily operations. If one of those services becomes unavailable, productivity can slow significantly until it is restored.
What an Outage Can Do to Your Organisation
When a critical platform becomes unavailable:
- Staff lose access to email, documents, calendars, or applications.
- Customer enquiries may go unanswered.
- Booking, CRM, or finance systems may become inaccessible.
- Payment processing may be interrupted.
- Internal communication becomes more difficult.
- Productivity falls while staff wait for services to return.
In many cases, there is little an organisation can do to fix a provider-side outage themselves. The focus should instead be on maintaining operations, communicating clearly, and minimising disruption until normal service resumes.
Business continuity planning exists for precisely this reason.
Why Business Continuity Matters
43% of UK organisations and 28% of UK charities reported experiencing a cyber security breach or attack during the previous 12 months. While not all breaches cause outages, many organisations increasingly recognise that operational resilience is now a business risk issue rather than purely an IT concern.
What a Simple Continuity Plan Should Cover
A practical continuity plan does not need to be lengthy. For most small and medium-sized organisations, a single page can be sufficient.
Which systems are critical?
Identify the services that would significantly impact operations if unavailable for several hours, such as:
- Microsoft 365
- Finance systems
- CRM platforms
- Telephony systems
- Payment services
- Booking applications
Focus on the systems that genuinely stop work rather than every application in use.
How will people communicate?
If Microsoft Teams or Outlook become unavailable, staff still need a way to coordinate.
Consider:
- Mobile phone contacts
- SMS messaging
- Alternative communication platforms
- Emergency contact lists
What information must remain accessible?
Keep key information available outside your primary cloud platform:
- Customer contacts
- Supplier contacts
- Escalation procedures
- Emergency numbers
- Critical documents
This could be stored securely on mobile devices, offline devices, or printed copies where appropriate.
Who makes decisions?
Clearly identify:
- Incident lead
- Communications lead
- Technical escalation contacts
- External IT partner or MSP
When responsibilities are predefined, staff can respond quickly and confidently.
Where do you check for updates?
Maintain a list of key status pages and support contacts, including:
- Microsoft 365 Service Health
- Internet service provider status page
- Key software suppliers
- Internal IT support provider
What to Do When an Outage Occurs
1. Confirm the scope of the issue
Check the supplier’s service status page or verify whether other users are experiencing the same problem.
2. Inform staff
Tell teams what has happened, which services are affected, and which alternative processes should be used.
3. Switch to backup communications
Move to mobile phones, SMS, or alternative collaboration tools if necessary.
4. Communicate with customers
Where services are affected, provide clear updates and expected timescales where available.
5. Record key details
Document:
- Time the issue started
- Systems affected
- Actions taken
- Customer impact
This helps improve future response processes.
Practical Steps That Reduce the Impact of Outages
Keep important files available offline
OneDrive and SharePoint can synchronise files locally, allowing users to continue working when internet connectivity or cloud services are unavailable.
Maintain an alternative internet connection
A mobile hotspot can provide temporary connectivity during broadband outages.
Bookmark critical status pages
Knowing quickly whether an issue is local or provider-wide can save valuable time.
Store essential contacts independently
Keep important contact details outside cloud-only platforms.
Enable monitoring and alerts
Many Managed Service Providers (MSPs) can provide proactive outage monitoring and notifications.
Keep Your Continuity Plan to One Page
Business continuity plans are most effective when they are simple and accessible.
Your plan should include:
✅ Critical systems
✅ Alternative communication methods
✅ Key contacts
✅ Escalation procedures
✅ Supplier support information
✅ Leadership responsibilities
Review it at least annually to ensure information remains accurate.