A Small Business Technology Continuity Checklist

Technology continuity means knowing which services your business depends on, who can restore access, and what to do when a service stops working. This checklist helps a small team record those basics without requiring a dedicated IT department.

Use it as a starting point and adapt it to your own operations. It is not a security certification or a replacement for a risk assessment. Keep credentials in an approved password manager, not in this checklist.

1. List the services work depends on

Write down the services that would interrupt work if they became unavailable. A typical list might include:

• Business email and shared files
• Business phone and customer messaging
• Website, online forms, and appointment tools
• Bookkeeping, invoicing, and payment systems
• Staff computers, network equipment, and important software

For each item, record its business purpose, the person responsible for it, and where to find support or recovery instructions. Avoid adding client details or passwords to the document.

2. Record access and recovery ownership

For each critical service, identify who can administer it and how the business can recover access if that person is unavailable. Confirm that recovery contacts and backup administrators are current. Use multi-factor authentication where the service supports it, and store recovery codes in the business's approved secure location.

The Canadian Centre for Cyber Security's baseline controls for small and medium organizations cover authentication, access control, incident planning, and other practical security measures. Use the guidance to check that your written process matches the tools you use.

3. Make backups understandable and restorable

Record which business files and system information are backed up, where copies are kept, how often they are updated, and who checks them. Then test restoring a small, non-critical sample and write down the result and date. A backup plan is easier to rely on when someone knows how to use it.

The Canadian Centre for Cyber Security recommends backing up and encrypting data as part of its baseline guidance. The right schedule and storage approach depend on how quickly your business needs to recover and how much information it can afford to lose.

4. Decide how the team will communicate during an outage

Choose a fallback way to reach staff if the usual email or phone service is unavailable. Keep a current list of service-provider support contacts and decide who will tell customers if a disruption affects normal service. Make sure more than one person knows where the instructions are stored.

The CIRA cybersecurity toolkit for Canadian business owners includes steps to consider during a cyber incident, including consulting your IT service provider and contacting the appropriate authorities.

5. Keep a short service and supplier record

For each important service, note the provider, renewal date, support route, and any information the business would need to move or restore the service. Review this list when a service changes or a staff member takes on a new responsibility.

6. Set a review date

Choose a date to review this checklist and revisit it after a significant change, such as replacing a core service, changing how staff work, or adding a new business-critical system. Record unresolved questions and assign someone to follow up.

Where to get further guidance

• Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations
• CIRA: Cybersecurity toolkit for Canadian business owners

LiberIT works with businesses on IT support and backup planning, business communications, and websites and hosting. For help reviewing a particular workflow, see business automation.