Business Continuity Planning for MSP Clients
How MSPs should approach business continuity and disaster recovery planning for their clients — RTO, RPO, testing, and documentation.
Business continuity planning (BCP) is about ensuring your client's business can keep operating when something goes wrong — whether that's a ransomware attack, a natural disaster, a hardware failure, or a cloud service outage. As their MSP, you're the one responsible for making that plan real.
RTO and RPO: The Foundation
Recovery Time Objective (RTO): How quickly must systems be restored after a disruption? A 4-hour RTO means the client expects systems to be operational within 4 hours of an outage.
Recovery Point Objective (RPO): How much data loss is acceptable? A 1-hour RPO means backups must be taken at least every hour — any data created in the last hour before the outage may be lost.
RTO and RPO should be defined per system, not globally. The client's email might have a 1-hour RTO, while their marketing website might be acceptable at 24 hours. The accounting database might need a 15-minute RPO, while the file server might be fine at 4 hours.
BCP Components
Backup Strategy: Aligned to RPO requirements. Critical systems with tight RPOs need frequent backups (continuous or hourly). Less critical systems can use daily backups. All backups need immutable copies for ransomware protection.
Recovery Procedures: Documented, tested procedures for restoring each critical system. Who does what, in what order, using which tools. The order matters — you can't restore the application before the database it depends on.
Communication Plan: Who gets notified during a disaster? How do employees access systems if the office is unavailable? How do clients communicate with you if email is down?
Alternate Operations: Can employees work remotely if the office is unavailable? Do you have failover for internet connectivity? What about phone systems?
Testing: The Part Everyone Skips
A business continuity plan that hasn't been tested is a wish, not a plan. Test levels:
Quarterly: Tabletop exercise — walk through the plan scenario by scenario. "The file server is encrypted by ransomware. What do we do first?" This finds gaps in procedures without any system impact.
Semi-annually: Partial recovery test — restore one or more critical systems to a sandboxed environment. Verify they boot, function, and have current data. Measure actual recovery time vs. RTO target.
Annually: Full DR test — simulate a complete site failure and recover all critical systems in the correct order. This is the ultimate validation of your BCP. Document the results, gaps found, and improvements needed.