Establish scope and preserve data
Identify affected devices, cloud/SaaS services, files and users. Record symptoms and timing, protect known-good copies and check whether cyber compromise is suspected.
BUSINESS PLAYBOOK 08 // IT + DATA OUTAGE
SYSTEMS ARE UNAVAILABLE.
RESTORE WHAT MATTERS FIRST.
Treat ordinary technical failure differently from a confirmed cyber incident. Protect data integrity, move the minimum operation to a safe workaround and restore services in critical order.
ACTION ORDER // REDUCE CONFUSION
CONTROL THE FIRST HOUR.
Use the documented minimum operation rather than improvising under pressure. Record decisions, ownership and the next review point as the incident develops.
Move the critical service to a workaround
Use the documented manual, alternate-device, alternate-service or offline process. Contact the responsible IT/provider route and prioritise the minimum operation.
Restore in dependency order
Recover from known-good sources, validate data and service behaviour, then reconnect dependent systems deliberately. Record what changed during the outage.
DECISION POINTS // WRITE THEM DOWN
DON'T WAIT FOR THE CRISIS.
Pre-agreed thresholds reduce hesitation and stop a degraded situation from drifting without ownership.
CAUSEIs this a normal fault or a security incident?
If compromise is suspected, switch to the Cyber Incident playbook rather than overwriting evidence through routine troubleshooting.
PRIORITYWhich system supports the critical service first?
Restore business services in dependency order, not simply whichever computer is easiest to fix.
BACKUPIs there a tested known-good copy?
A backup only counts if the required data can actually be restored within the business tolerance.
MANUAL MODECan work continue without the system?
Define what can be recorded safely offline and how those records will be reconciled later.
INTEGRITYHow will you prove recovery is correct?
Validate key records, permissions, transactions and synchronisation before declaring the system recovered.
CYBER OR ORDINARY FAILURE?
If there are signs of compromise, ransomware, unauthorised access, suspicious account activity or deliberate interference, stop treating this as a routine IT outage and switch to the Cyber Incident playbook. Preserve evidence and use appropriate technical support.
OFFICIAL ROUTES
CHECK THE SOURCE.
Use current provider, regulator and official guidance during a real incident. GPN is the planning layer, not the authority controlling the incident.
OFFICIAL SOURCENCSC // BACKING UP YOUR DATASmall-organisation guidance on backups, separation from primary systems and restoration.OFFICIAL SOURCENCSC // BUSINESS CONTINUITYCritical services, dependencies, workarounds, restoration order and exercises.OFFICIAL SOURCEGOV.UK // BUSINESS CONTINUITYGovernment guidance on maintaining and recovering key products and services through disruption.