How Long Can Your Business Operate Without Its Information Systems?

Take the computers out of the equation for a moment. Not in theory. For real.

No email. No CRM. No ERP. No shared folders. No access to the finance system. No service system.

Now continue your workday. How long is that possible?

Information systems have become the infrastructure of the business

In many businesses, technology is no longer a support tool. It is the way the business operates:

• Sales come in through a system.
• Customers are managed in a system.
• Invoices are issued in a system.
• Employees share information in the cloud.
• Production, logistics or service depend on systems.

That is why a significant technology failure can quickly turn into a business failure.

"The system is down" does not describe the damage

For IT, it may be a server that is not responding. For the business: ten salespeople cannot work, dozens of customers are waiting, invoices are not going out, orders are not being received, and management is not getting data.

These are two different descriptions of the same event. That is why recovery planning has to start from business impact, not only from infrastructure.

Which system really matters most?

The answer is not always what you think. A central, expensive system naturally looks critical. But a business process may actually depend on a small service that received little attention. For example:

• The core system is running, but there is no identity service, so employees cannot sign in.
• The files exist, but the VPN is unavailable.
• The sales system is running, but a small integration that connects it to another process is down.

That is why mapping systems alone is not enough. You need to understand processes and dependencies, and a cyber risk assessment is one way to do that.

How much downtime can the business absorb?

There is no universal answer. One company can work manually for a whole day. Another cannot provide service after an hour. One system can wait a week. Another has to come back within a short time.

These are decisions that need to be known before the incident.

And what if you cannot bring everything back?

In a significant incident, resources are limited: people, time, equipment and vendors. So you need to know what comes first. If everything is defined as "critical", in practice nothing is prioritized. And here too, a backup you can actually restore from is a basic requirement.

People are part of business continuity too

• What happens if the only person who knows how to operate a system is unavailable?
• What happens if a key vendor does not respond?
• Are the contact details stored only in a system that is unavailable?
• Do people know how to work temporarily in an alternative way?

Continuity is not only servers.

What about cloud providers?

The fact that a system is in the cloud can improve availability significantly. But dependencies still exist: internet connectivity, identities, accounts, the SaaS provider, configuration and integrations. The cloud changes the types of risk. It does not remove them.

The time to think is before the incident

During an outage, every minute feels urgent. It is not the ideal time for the first discussion about which system matters more. An organization that understands its processes in advance can recover in a much more orderly way. That is exactly what we discussed in our article on cyber incident readiness.

Business continuity with Marom Cyber

Marom Cyber helps organizations connect cyber, infrastructure, backups and business processes, to understand what needs to keep running and how to prepare for disruption. It is part of our information security and cyber advisory services.