A connection failure, cyberattack, or infrastructure breakdown can bring a business to a standstill in minutes. That is why experts urge businesses to have a clear plan for "Day X" today—the moment when critical systems suddenly stop working.
The National Cyber Security Centre (NCSC) under the Ministry of National Defence notes that there has been a rapid increase in reported software vulnerabilities, while advancing artificial intelligence solutions allow them to be discovered and exploited automatically with increasing speed.
The NCSC advises constant infrastructure monitoring, vulnerability management, and ensuring rapid response. Practical recommendations include maintaining an up-to-date list of systems and internet-facing resources, timely installation of security patches, phasing out unsupported software, assessing supply chain risks, using strong authentication and multi-factor authentication (MFA), and conducting penetration testing.
A resilient business starts with a plan
"Day X" does not necessarily mean a military scenario or a sophisticated cyberattack. Business operations can be disrupted by power outages, internet connectivity issues, cloud service failures, compromised accounts, supplier problems, or critical system malfunctions.
According to Tadas Burba, IT Development Manager at the IT solutions company Heximus, it is crucial to know not only what needs to be protected but also what to do when those protections fail. A business continuity plan should not be a document that a company only remembers after an incident occurs.
"First, you need to identify the main risks and what is critically important to the company. Then, you should plan for alternative system locations, backup communication channels, and how systems would be restored if the primary infrastructure fails. It is also important to understand under what conditions the business could continue to operate and when it can no longer do so," says T. Burba.
According to him, the same logic applies to connectivity. To restore operations quickly, it is not enough for a company to rely on a single internet provider or a single infrastructure point. Backup connectivity solutions, different locations, and infrastructure redundancy can help maintain operations when standard channels are down.
Having a backup does not mean the business is prepared
One of the most common mistakes is assuming that having data backups is enough for resilience. However, having a copy and being certain that you can restore operations from it are two different things.
The NCSC recommends not only creating backups regularly but also testing them. For a business, this raises another practical question: how long would it take to restore critical systems if the primary IT environment became inaccessible?
This question should also be linked to the RTO (Recovery Time Objective). If a company has not established how long it should take to restore different systems, priorities during a crisis may be set too late or incorrectly.
"Companies that recover quickly have an automated and regularly tested system recovery process in place, along with clearly defined recovery time objectives. Unprepared organizations face a 'chaos of dependencies' during a crisis—one non-functioning system blocks another, and recovery is carried out in the wrong order," states Ramūnas Liubertas, Senior Cybersecurity Engineer at NOD Baltic and ESET expert.
It is not just technology that matters in a crisis
The expert emphasizes that business continuity is not just an IT department task. During a crisis, it is not just technology that matters, but also people, decision-making, and processes.
"A truly resilient company is one whose ability to survive a crisis relies not only on technology but on the synergy of people, processes, and decision-making. Backup technological measures alone are not enough—without clear procedures and prepared employees, even the most modern systems can become useless during a crisis. Ultimately, a strong organization is able to not only withstand a blow but also use shocks as an opportunity to transform and grow stronger," says R. Liubertas.
Another frequently overlooked risk is dependency on other organizations. A company may have a backup of its own system, but its operations can still come to a halt if a critical service depends on a single supplier, their subcontractor, a specific data center, or a connectivity hub.
This means that companies should evaluate not only their own systems but their entire chain of critical dependencies: from internet and cloud services to payments, suppliers, employees, and communication channels.
"Advance preparation for working under unusual conditions is one of the most important factors. During a crisis, there will be no time to create new operating models. Alternative communication channels, remote access, redundancy of functions, and regular scenario simulations allow the team to act without panicking," the expert added.
Preparing for business disruptions
Expert T. Burba emphasizes that for most businesses, the biggest practical challenge is not the cause of the disruption itself, but its consequences: power outages, loss of connectivity, or loss of data accessibility. According to him, businesses should take care of a few things in advance:
- Cloud-based data backups – so that if local IT infrastructure or power supply fails, data remains accessible from another, geographically distant data center.
- Uninterruptible power supplies (UPS) – at least for a short time, until a generator kicks in or employees can safely shut down systems.
- Remote work infrastructure – so that if the office becomes inaccessible, employees can securely connect to company systems from any location with an internet connection.
- A clear business continuity plan – pre-defining who is responsible for which action in the event of a disruption and how information is communicated if standard channels are down.
- Alternative internet connectivity – for example, mobile or satellite internet solutions as a backup channel if the primary connection fails.
"It is easy to write down on paper that we will have geographically separate backup infrastructure and that everything will be planned, but once the real cost is calculated, companies often start cutting corners and abandoning some solutions. In such cases, the business continuity plan may remain just on paper and not work as intended in reality," says T. Burba.
"Day X" reveals how prepared a company is to operate under unusual conditions. Pre-assessed critical systems, clear responsibilities, and tested business continuity solutions help restore essential processes faster and maintain company operations in the event of a disruption.
