Business continuity is your plan to keep working when something breaks — staff still answering clients, invoices still going out, phones still ringing. Disaster recovery is the narrower technical plan to restore systems and data after a failure. You need both, and most South African SMBs only have fragments of either, usually discovered the hard way during a fibre outage or ransomware scare.
What's the actual difference between business continuity and disaster recovery?
People use the terms interchangeably, which is where the trouble starts. They're related, but they answer different questions.
Disaster recovery (DR) answers: How do we get our systems and data back after something fails? Backups, server restores, cloud failover, rebuilding a domain controller. It's technical, and it lives mostly with your IT provider.
Business continuity (BC) answers: How does the business keep operating while that recovery is happening? It covers people, processes, premises, communication with clients, and workarounds. It's organisational.
Here's the gap: your IT guy might restore your file server in four hours (great DR), but if nobody told the receptionist to divert the landline to a mobile, you lost a day of client calls anyway (no BC).
| Aspect | Disaster Recovery | Business Continuity |
|---|---|---|
| Question answered | How do we restore IT? | How do we keep operating? |
| Scope | Systems, data, infrastructure | People, processes, clients, premises |
| Owner | IT provider | Business owner / management |
| Example | Restore Exchange from backup | Staff work from home with Teams |
| Measured in | RTO / RPO (hours, data loss) | Revenue continuity, client impact |
Why do SA businesses keep getting caught out?
Because the disasters we actually face aren't the dramatic ones. They're ordinary and frequent:
- Fibre goes down in the area for six hours
- Loadshedding moves to stage 6 and your UPS wasn't sized for it
- A staff member clicks a phishing link and your file server is encrypted
- The building's water main bursts above the server room
- Your accounting software vendor has a cloud outage during month-end
None of those are "disasters" in the Hollywood sense. They're Tuesdays in South Africa. But without a plan, each one costs you a day or two of productivity — and that adds up fast across a year.
The second problem: most businesses assume their backup and recovery setup is their continuity plan. It isn't. Backups are one ingredient. If your only internet line is dead, the best backups in the world won't help your sales team quote a client.
What should a practical BC plan actually cover?
You don't need a 90-page document. You need clear answers to a short list of questions, written down somewhere your management team can find them at 7am on a bad Monday.
1. What are your critical business functions? Not every process is equal. For a law firm it might be email, document management, and the ability to file at court. For an accounting practice, it's email, Caseware/Xero, and SARS eFiling. List the top five things that, if they stop, the business stops.
2. How long can each one be down before it hurts? This is your Recovery Time Objective (RTO) in plain English. Email down for 30 minutes is annoying. Email down for a day is a crisis. Be honest — some things can wait, others can't.
3. How much data can you afford to lose? Your Recovery Point Objective (RPO). If backups run nightly and the server dies at 4pm, you've lost a day's work. Is that acceptable? For most professional services firms handling client matters, no — you need more frequent snapshots.
4. What's the workaround for each failure mode?
- Fibre down → LTE failover router, or staff tether from phones
- Power out beyond UPS → work from home, or a secondary site
- Office inaccessible → everything in the cloud, staff work remotely
- Ransomware → isolated backups, incident response contacts ready
- Key staff unavailable → documented processes, shared mailbox access
5. Who calls whom, in what order? Contact tree. IT provider, insurance broker, landlord, key clients. Printed, not just on the server that's down.
How does managed IT actually fit into continuity?
This is where businesses who've only ever used break-fix IT get a shock. A proactive managed IT partner doesn't just fix things when they break — they design the environment so most failures either don't happen or don't matter.
That looks like:
- Proactive monitoring that flags a failing disk before it dies, not after
- Backups that are tested monthly, not just scheduled and forgotten
- Microsoft 365 configured so staff can work from anywhere the moment the office is unusable
- Documented recovery procedures your provider can execute without you having to explain what's where
- A phone that gets answered when you call — because during an outage, waiting in a queue is its own disaster
The security side matters too. ISO/IEC 27001:2022 certification means our continuity and incident-response processes are audited annually against an international standard — not just something we promise. For regulated clients (law, accounting, healthcare, financial advisory), that's often the difference between passing and failing a client due-diligence review. For more on the security layer, see our cyber security services.
What should you do this week?
You don't need a consulting project. Start small:
- List your top five critical systems. Email, accounting, document management, phones, internet — whatever yours are.
- Ask your IT provider for your current RTO and RPO. If they can't answer clearly, that's your first red flag.
- Test one backup. Pick a file, delete it, ask them to restore it. Time how long it takes.
- Walk through one scenario. "Fibre is down for the day — what do we do?" If the answer is blank stares, you have work to do.
- Write down the five phone numbers you'd need in a crisis. Print them. Stick them somewhere.
Frequently asked questions
Isn't a business continuity plan overkill for a 30-person firm?
No — it's actually more important. Large corporates have redundancy baked in; a 30-person firm feels every hour of downtime directly on the bottom line. A one-page plan is better than no plan, and it takes an afternoon to draft.
How often should we test our disaster recovery?
At minimum, quarterly for backup restores and annually for a full scenario walkthrough. Testing isn't optional — an untested backup is a hope, not a plan. Most of the horror stories we hear start with "we thought the backups were running".
Does POPIA require us to have a continuity plan?
POPIA requires you to take "reasonable technical and organisational measures" to protect personal information, which includes being able to recover from incidents. If there's a data compromise, the Information Regulator expects notification "as soon as reasonably possible" after reasonable grounds exist — you can't do that without a plan. See the Information Regulator at https://inforegulator.org.za/ for the full guidance.
Can one provider handle both IT support and continuity planning?
Yes, and ideally they should. Splitting them across vendors is how gaps appear — each assumes the other has it covered. One accountable team that knows your environment end-to-end is the simplest model. If you'd like to talk it through, book a free consultation and we'll walk through where your current setup stands.
If you're not sure whether your current setup would survive a bad Tuesday, that uncertainty itself is the problem worth solving. A short conversation with the MiBOT Support team will tell you where the real gaps are — and what a sensible plan looks like for a business your size.
Last reviewed: November 2026