We confirm scope and price in writing. The main factors are:
- Complexity of the site and its integrations.
- Recovery targets, since tighter targets need more tools.
- Number of systems to document.
- Drills and training.
- Ongoing reviews, if wanted.
Storage, backup tools and standby hosting are paid to those providers and are separate from our fee. A short plan for a small site is a modest project. A plan for a store with integrations and tight targets is larger.
Tell us about your site and how much downtime you could accept, and we will reply with a plan and a quote.
Communication is a part of recovery that technical plans often forget. Customers want to know whether their orders and data are safe, and staff want to know what to tell them. We draft short template messages for common situations, such as a temporary outage, a security incident or a data issue, so that nobody has to write under pressure. Messages are factual, avoid blame and say what is being done and when the next update will arrive.
Third-party services deserve their own section. If your payment gateway, shipping tool, booking system or email service fails, your site may still be up but your business is not. The plan lists each dependency, how you would know it is down, what the fallback is and who to contact. Sometimes the fallback is as simple as taking orders by phone or WhatsApp for a few hours, and saying so in advance makes it easier.
Financial and legal points are noted rather than decided. We encourage you to check whether your business insurance covers cyber incidents, whether customers or regulators must be notified after a data breach and whether contracts with clients set uptime expectations. These are matters for professional advice, but having them written in the plan means they are not forgotten when an incident occurs.
Ransomware and account takeover are scenarios worth planning for explicitly. For ransomware, the plan stresses isolated, off-site backups that attackers cannot reach, and a decision process that does not rely on paying criminals. For account takeover, such as a hijacked domain or hosting login, it lists the recovery routes with each provider and the proof of ownership they may ask for, because delays in proving ownership can be costly.
We also plan for the slow disasters. A site that gradually accumulates outdated plugins, unsupported software and unmanaged accounts becomes fragile long before any single event. The review schedule in the plan includes simple housekeeping: remove old users, update software, renew domains and certificates and check that backups still run. Small regular tasks prevent large failures.
A good plan is kept short enough to be used. We resist the temptation to produce a long manual that nobody opens. The first page lists the five things to do in the first hour, the key contacts and where the detailed runbooks are stored. Further pages cover each scenario. Copies are kept somewhere that stays reachable when the main systems are down, such as a shared cloud folder with offline copies for the key people.
Training is brief and practical. We walk the team through the plan, assign roles and run a short tabletop exercise: we describe an incident, such as a hacked admin account on a busy sales day, and the team talks through what they would do and checks it against the plan. Gaps appear quickly in conversation and cost nothing to fix on paper.
Changes to the business should trigger updates to the plan. A new payment provider, a new hosting plan, a new staff member responsible for the website or a new integration changes who needs access and what must be restored. We add a simple change checklist to the plan, so that updating it becomes part of normal work and not a yearly chore.
