Tony Beveridge, BC Sales Specialist at Wavenet.
Why offline plans still matter
In a world where every business process is digital, the latest advice from the National Cyber-Security Centre (NCSC) might sound almost quaint: keep a paper copy of your critical business plans. But before you dismiss it as old-fashioned, consider the stakes.
The UK is now experiencing an alarming average of four nationally significant cyber-attacks every week, according to the NCSC. That adds up to over 200 major incidents annually, double the number from just a few years ago1. These attacks aren’t hypothetical; they have real consequences for businesses and consumers alike. This year alone, hacks on major companies such as Marks and Spencer, The Co-op, and Jaguar Land Rover2 caused empty shelves and halted production lines, showing just how disruptive a cyber-attack can be.
As NCSC Chief Executive Richard Horne warns, organisations need to “have a plan for how they would continue to operate without their IT, and rebuild that IT at pace, were an attack to get through.” In other words, it’s no longer a question of if you’ll be targeted, but when3.
The reality of cyber risk
Here’s the uncomfortable truth: many businesses are woefully unprepared. Companies pour money into firewalls, antivirus software, and cloud security, but few ask the simple question: what happens when all of that fails? That’s where cyber risk awareness and resilience engineering comes in, and why the NCSC is recommending something radical: paper copies of critical plans.
Modern cyber criminals target an organisation’s infrastructure to cause maximum damage over a prolonged period. Having business continuity plans stored on your local infrastructure opens them up to the same threats as everything else, meaning you might not be able to get to them at the very moment you need them.
Shadow-Planner: making continuity plans accessible
A plan to address how your company will respond to a cyber attack, like all other aspects of operational resilience, needs to be planned, documented, and available. Clearly, if these plans sit on unavailable or compromised technology that is inaccessible due to the incident, they are of no use. That’s why our business continuity management planning software Shadow-Planner is such a game-changer. It can export plans to a physical copy while also providing a regularly updated download to your smart devices. With Shadow-Planner, you and key members of your organisation will always have incident management plans at hand, wherever you are, an essential element to cyber security resilience.
Having a third-party BCM software provider, where all critical business continuity, recovery plans, and emergency contact information are segregated from your own infrastructure, is a smart decision. An externally hosted solution makes it easier to access this critical information at the very time you most need it. The best solutions (like Shadow-Planner) should also include a mobile app, delivering plans directly to users and serving as a third line of defence against cyber risk.
The growing threat and why preparation matters
Some might see this advice as over-cautious. I see it as common sense. Digital systems are fragile, and hackers are relentless. Most attacks are financially motivated, but even a seemingly minor disruption can have huge consequences, as the UK has seen in healthcare and retail. The rise of domestic teenage hacking gangs alongside sophisticated international cyber-crime rings shows that no company is too small or too secure to ignore this cyber risk4.
Good business continuity software isn’t a luxury; it’s a must in a technology-driven world! Bad things happen, but it’s how prepared you are and how you respond that makes the difference. Managing cyber risk isn’t just about technology; it’s about foresight, adaptability, and preparation. Sometimes, the most modern solution is the one you can hold in your hand.
Take action: make your plans accessible
Not so much, dust off your pens, but certainly print out your contingency plans. Keep them safe. Combine them with Shadow-Planner to ensure key plans and communications are always accessible. It may feel nostalgic, but it’s far from retro, it’s pragmatism. Businesses that ignore this advice risk more than inconvenience, they risk catastrophe.
About the author
Tony Beveridge – BC Sales Specialist, Wavenet
Tony began his career as a Telecommunications Technician but has spent the past 40 years specialising in all aspects of Business Continuity. Over that time, he has helped the industry grow from its roots, from its early focus on mainframe IT recovery to its modern role as a vital component of organisational resilience and compliance. Tony has worked with companies around the world to ensure their critical business functions can continue, no matter what unexpected events or disruptions they face.
Get in touch with our team today — and protect not just your data, but your ability to deliver.
1 National Cyber-Security Centre (NCSC)
3 https://www.ncsc.gov.uk/collection/ncsc-annual-review-2025
