Contents
Short answer
Prepare organisationally: record which processes depend on which cloud service, how long you can work without it and what must be available offline in emergency mode. Decide who makes the call, how the team communicates without the service and which systems must come back first. Not every service needs a second provider – weigh cost, effort and criticality.
Map your dependencies
Link processes to services
For each business process – quotes, orders, invoices, customer contact, scheduling – note which service it needs: email, file storage, accounting, shop, telephony.
Identify critical services
A service is critical if its outage directly affects revenue, delivery or obligations to customers. Many businesses find that two or three services carry most of the risk.
Impact over time
For each critical service, ask: what happens after one hour, one day, one week? That shows how much preparation is reasonable.
Single-provider dependency
If email, files, sign-in and telephony all run with the same provider, an outage or account lock hits everything at once. Record such concentrations deliberately.
If your most important cloud service fails tomorrow
- 1
Which work stops?
Name the processes that can’t run without the service.
- 2
Which work can continue?
What can be done temporarily locally, on paper or with another tool?
- 3
What does the team need offline?
Contact lists, appointments, open orders, access details for emergency communication.
- 4
Who contacts the provider?
Name, deputy, customer number and support route – stored outside the affected service.
- 5
How does the team communicate without it?
For example a phone tree, SMS or a second channel agreed in advance.
- 6
Which customers need to be informed?
Check who is affected by delays. Whether there are duties to inform depends on the case and your contracts.
- 7
What must work again first?
Set a recovery order, for example sign-in, email, then business applications.
Step by step
- 01
List your services
Create a simple list of all cloud services with purpose, owner and contract.
- 02
Rate criticality
For each service, note when an outage becomes noticeable – after an hour, a day or longer.
- 03
Keep data available separately
Clarify which data you need in an emergency independently of the provider, and back it up separately.
- 04
Store emergency information offline
Print or save contact lists, provider contacts and key procedures outside the service.
- 05
Set decisions and communication
Decide who declares emergency mode, who informs staff and, where relevant, customers, and via which channel.
- 06
Weigh alternatives
For the most critical services, check whether a fallback makes sense. A second provider for everything is rarely proportionate.
- 07
Walk through it once
Run through the scenario briefly with the team. Gaps usually show quickly.
Checklist
- All cloud services in use are recorded with purpose and owner.
- The two or three most critical services are named.
- For them, it’s known what happens after an hour, a day and longer.
- Important data is backed up independently of the provider.
- Contacts and emergency procedures are available offline.
- Decision path and fallback communication channel are set.
- A recovery order is documented.
Common mistakes
- Confusing the provider’s high availability with your own backup.
- Storing emergency information only in the service that’s down.
- Trying to duplicate every service instead of prioritising by criticality.
- Not deciding who declares emergency mode.
- Never walking through the plan with the team.
Frequently asked questions
Do we need a second provider for every cloud service?
No. For most small businesses it’s enough to know the most critical services, back up data separately and plan emergency operations. A fallback only pays off where cost and effort match the criticality.
Is file sync enough as a backup?
No. Sync also copies deletions and encryption. A backup lets you return to an earlier state.
Do we have to inform customers about an outage?
That depends on the case, your contracts and whether personal data is affected. Plan communication in advance and have duties checked if needed.
Is a cloud outage insured?
That’s a separate insurance topic. Some cyber policies only cover service-provider outages if agreed – see our guide to business cyber insurance.
How often should we review the plan?
Whenever services or processes change, and additionally at regular intervals that suit your business.
Sources
- BSI – Business Continuity Management (BCM) für KMU (05.11.2025)
- BSI – Sichere Nutzung von Cloud-Diensten
- BSI IT-Grundschutz – OPS.2.2 Cloud-Nutzung (Edition 2023)
- ENISA – Cybersecurity guide for SMEs: 12 steps (2021)
Checked on 7 October 2026.
This content is for general guidance. No measure guarantees that an attack or outage is prevented.