A one-page continuity plan for a small business

A one-page business continuity plan for a small Singapore firm should answer a simple question: who does what during the first working day when a critical service stops? A thick document that nobody can find during an outage is less useful than a current contact list, a safe manual fallback and a date to test it. This template starts with a one-day interruption and can be expanded for longer or sector-specific risks.

What belongs on the one page?

Put the business owner and an alternate at the top with phone numbers stored in a place reachable when the main system is down. List three critical activities, the system or person each depends on, and the longest interruption the business can tolerate. For each, write the first manual step, the source of the needed data and the person allowed to approve it. Add a customer message template, staff update channel, supplier contact, restart checklist and date of the next rehearsal. Keep sensitive credentials out of the plan; say where authorised staff can retrieve them securely.

The plan must fit the firm's obligations. For example, a payroll outage does not remove the need to manage pay correctly; MOM's paying-salary guidance is the official page to check for the applicable rules. A customer-data outage or breach needs a separate data-protection response; the PDPC obligations overview is a starting point, not a full incident plan. A regulated business should add its sector regulator's requirements. The page itself should name the person responsible for checking those sources.

How does the template work in a one-day outage?

Take a fictional 12-person service firm whose booking system is unavailable on a Tuesday morning. The owner appoints the operations lead as incident owner and a second person to communicate with customers. The team stops accepting bookings through a broken form, records new enquiries in a controlled temporary log, calls customers with appointments that day, and sets a 2pm checkpoint for either restoration or a further update. The log uses only the minimum details needed to manage the booking and is moved back into the approved system when it is restored. The incident owner confirms that no request was lost before the temporary copy is deleted under the firm's policy.

This example is a decision sequence, not evidence that a particular system or vendor failed. It exposes questions a real team must answer: can staff still reach a customer list, what if the normal chat tool is also down, who may approve a refund, and where are written customer messages stored? IMDA's SMEs Go Digital pathway is one route to explore suitable digital capability support, but adopting a tool does not replace rehearsing the fallback.

How do you test and maintain the plan?

Run a 30-minute tabletop exercise with the owner and two people who would act on the day. Hide the main system for the exercise and ask them to find contacts, send a sample update and carry a fictitious booking through the manual path. Record each blockage: a contact only in the unavailable system, an unclear approval, a message no one owns. Fix those gaps and repeat the test after a material change. Date the contact list and name the person who checks it quarterly. A plan that worked once can become wrong when a staff member or supplier changes.

Ask a service provider for help only after writing the business's own priorities. A scoped proposal should say which risks it covers, how backups are restored and tested, who owns data, what staff must do, and what happens after hours. The process-writing guide helps make the instructions usable, customer-enquiry approval rules support the fallback messages, and operations guides cover related controls. You may send Methodology a question about scoping a continuity exercise as an editorial enquiry; we do not provide an emergency response service or promise a vendor introduction.

Common questions