A small business continuity plan for losing your phone

Separate the three dependencies

Losing the owner’s phone may remove access to conversations and login codes. Important agreements may also depend on the owner’s memory.

Those are different problems. A backup might address some data loss while doing little to explain which customer instruction is current.

The NIST small-business quick-start guide provides a general framework for cybersecurity and recovery planning. Check where information lives and who can access it.

Then ask how work continues when the device is unavailable. A small rehearsal can expose a missing access arrangement before an actual disruption.

Run the exercise without disrupting live work

Choose a period when the owner can observe and intervene if necessary. Do not disable accounts or remove access merely to make the exercise realistic. Ask a colleague to answer a few ordinary operational questions using their own approved access.

For a service business, start with today’s commitments and outstanding approvals. Check who can confirm requests and find the latest supplier instruction. Record each point where staff need the owner’s device or an unwritten explanation.

Verify recovery instead of assuming it

The NIST contingency-planning guide discusses recovery planning and testing. Although written for federal information systems, its planning principles can also be adapted voluntarily by other organizations. Review the arrangements for the tools you actually use.

Test account recovery as well as data restoration. The team needs to resume the work, not merely retrieve a folder.

Name the person responsible for account recovery and the person who checks backups or exports where supported. Keep sensitive recovery information in an appropriate controlled place. The handover should tell authorized staff how to get help without exposing credentials in a shared operational note.

Make important business context independent of the device

Move important instructions out of a single person’s memory or private device. The team needs accepted customer commitments, current work and clear responsibility. Check that colleagues can find these through normal authorized access.

Start with a few active jobs and ask a colleague to explain the next step. Their questions reveal what still depends on the owner being present.

Check recovery arrangements for the tools you actually use. Confirm which information is backed up, how authorized staff regain access and who can carry out a restoration.

Keep recovery instructions available through an appropriate separate route. Then test the operational handoff, because recovering files alone does not establish that the team can resume the work.

Repair the most consequential gap first

An exercise can uncover a long list of improvements. Start with the dependency most likely to stop a live commitment.

Check missing access, unknown decision owners and customer instructions nobody else can find. Give it a person and completion date, then repeat that part of the test.

1. Select a few active commitments and a safe time for the exercise.
2. Ask a colleague to retrieve them using their normal authorized access.
3. Record information, account-access and decision-authority gaps separately.
4. Verify recovery and backup arrangements with the responsible administrator.
5. Move the necessary operational context into a reviewed shared record.
6. Retest the repaired dependency and keep the handover current as the team changes.