Professional IT services: business continuity
Business continuity and disaster recovery in Christchurch and New Zealand
Immutable backups, a written disaster recovery plan with measured recovery objectives, an incident response playbook and an annual live exercise, for businesses of 20 to 200 staff. Test restores are run monthly, recorded and reported. A plan that has never been tested is not a plan. It is a hope.
Or call 0800 242 206
If your systems went down tomorrow, how long until you were trading again?
Every 20 to 200 staff New Zealand business has a story about the time things almost went very wrong. Ransomware on a Friday night. A failed server with no working backup. A staff member who deleted the wrong folder. A fire, a flood, an earthquake. Most of the time these stories end with “we were lucky”. Luck is not a strategy.
Christchurch business owners know this better than most. Canterbury has lived through earthquakes, floods and multi-day power outages. Cyber incidents have been added to the list. A real business continuity plan is no longer optional. It is the difference between a bad week and a business-ending event.
What does business continuity actually cover?
Business continuity is the full stack of planning, technology and testing that keeps your business operating through disruption. It covers backup and restore, disaster recovery, incident response, communications planning and staff procedures. It is broader than IT backups. It is how the whole business keeps trading when something goes wrong.
The OxygenIT business continuity service delivers:
- Immutable, encrypted, off-site backups for your Microsoft 365 data, servers, endpoints and line-of-business systems.
- A documented disaster recovery plan with measurable recovery time and recovery point objectives.
- An incident response playbook for the most likely New Zealand scenarios: ransomware, data breach, supplier failure, natural disaster.
- A business continuity plan that covers communications, alternate working arrangements and key stakeholder contacts.
- Annual live recovery exercises, not just tabletop reviews, so your plans are proven under pressure.
A business continuity plan that has never been tested is not a plan. It is a hope.
When does a Christchurch or New Zealand SMB need formal business continuity planning?
Most owners know the moment they need one. Here are the five clearest triggers:
- Your cyber insurer is asking for a tested DR plan and for evidence of immutable backups and tested restores.
- A major customer is asking for evidence of your business continuity arrangements as part of their supplier assurance process.
- You are pursuing SMB1001 or ISO/IEC 27001:2022 certification and need documented, tested business continuity controls.
- You have grown past 20 staff and the operational impact of even a single day offline is now measured in tens of thousands of dollars.
- You have had a close call (ransomware attempt, failed backup, supplier outage) and the next incident needs to be caught with a plan, not with luck.
If two or more of these sound familiar, you need formal business continuity planning.
What is included in the OxygenIT business continuity service?
Our business continuity service is delivered across six workstreams, with an annual cycle of review, testing and update. Every element is documented, owned and regularly exercised.
Backup architecture and immutability
Immutable, encrypted, geographically separated backups for Microsoft 365 data, servers, endpoints and key line-of-business systems. Backups cannot be deleted by ransomware or by a compromised admin account. The backup platform itself is described on our data backup and disaster recovery page.
Recovery testing, not just backup monitoring
Every month we perform a random test restore, recorded and reported. Not an email saying the backup job completed. An actual file, database or virtual machine recovered, timed and documented.
Disaster recovery plan
A written disaster recovery plan with defined recovery time objectives (RTO) and recovery point objectives (RPO) for every business-critical system. Every scenario has an owner, a playbook and a test record.
Incident response playbook
A playbook for the New Zealand-relevant incident scenarios: ransomware, phishing-driven breach, stolen laptop, supplier failure, natural disaster. Roles, decisions and communications are pre-scripted so the response does not start with a blank page. The honest limitation: the playbook is planning. Hands-on cyber incident response during a live attack is scoped and charged separately, and we say so before you sign, not after.
Business continuity plan
Beyond IT: alternate working arrangements, communications scripts for customers and staff, key supplier contact lists, financial controls under stress and leadership decision authority. Owned by your leadership team, drafted with us.
Annual live exercise
Once a year we run a live exercise against a realistic scenario. Leadership team in the room. Playbook in hand. Clock running. The exercise finds the gaps before a real incident does.
How our business continuity service rolls out: your first 30, 60 and 90 days
First 30 days: risk baseline and scoping
Business impact analysis. Identify the business-critical systems and data. Set recovery time and recovery point objectives by system. Audit current backup and recovery posture. Scope the plan.
Days 30 to 60: build and document
Backup architecture upgraded where needed. Disaster recovery plan written. Incident response playbook drafted. Business continuity plan drafted with your leadership team. First test restore performed and timed.
Days 60 to 90: test, train, embed
Staff communications briefing. Leadership tabletop exercise against a realistic scenario. Plan refined based on findings. Annual live exercise scheduled. From day 91 onwards, you have a plan that has been tested, not just written.
Why Christchurch businesses choose OxygenIT for business continuity
Canterbury-tested
Founded in Christchurch in 2005. Our team has lived through the earthquakes, the floods and the multi-day outages. Our plans reflect real New Zealand disruption patterns, not a generic template.
Certified where it matters
Independently certified to ISO/IEC 27001:2022 for information security and ISO/IEC 42001:2023 for AI management (as at May 2026), audited annually. SMB1001:2026 assessor capability. We apply the same standards internally that we advise on externally.
We test, not just monitor
Every month we perform a random test restore. Every year we run a live exercise with your leadership team. Monitoring tells you a backup ran. Testing tells you it will actually recover.
Immutable backups by default
Every client backup we configure is immutable. Ransomware that compromises your network cannot delete or encrypt your backups. This is the single biggest lever against modern ransomware.
Plans owners can actually read
Your disaster recovery plan, incident response playbook and business continuity plan are written in plain English, not RTO and RPO jargon. Leadership teams actually open them during an incident.
How much does business continuity cost in New Zealand?
Business continuity at OxygenIT is delivered as a monthly retainer, with a project-based setup fee for the initial plan build and testing. Pricing scales with the size and complexity of your environment. We do not publish hourly rates for this service because every engagement is scoped to outcomes. Ask for indicative pricing for your business on the founder call, and see every price we do publish.
Continuity Essential
For 20 to 50 staff firms with a Microsoft 365 and single-site footprint. Immutable Microsoft 365 backups, written DR plan, annual live exercise, monthly restore testing. Priced from a monthly retainer plus setup project.
Continuity Standard
For 50 to 100 staff firms with multi-site, mixed cloud and on-premise or specific compliance obligations. Full backup architecture, DR plan, incident response playbook and business continuity plan, with monthly restore testing and quarterly plan review. Priced from a monthly retainer plus setup project.
Continuity Comprehensive
For 100 to 200 staff firms, regulated industries or multi-entity groups. Full BC and DR stack, embedded continuity consultant, integration with an ISO/IEC 27001:2022 or SMB1001:2026 compliance programme, two live exercises a year. Priced from a monthly retainer plus setup project.
How business continuity supports cyber insurance and compliance
Cyber insurers in New Zealand now expect evidence of tested disaster recovery, immutable backups and documented incident response before they will renew, let alone pay a claim. A business continuity programme gives you that evidence. Every test restore, every live exercise and every plan update is documented and can be supplied at renewal.
The same documentation supports your compliance position under the Privacy Act 2020 (notifiable breach readiness), SMB1001:2026 and ISO/IEC 27001:2022. One programme, multiple audiences: insurer, regulator, customer, auditor. Your leadership team knows the plan works because the plan has been tested. Ask any provider you are talking to when they last restored your data, and see what comes back.
Frequently asked questions about business continuity
What is business continuity?
Business continuity is the planning, technology and testing that keeps your business operating through disruption: cyber incident, hardware failure, natural disaster, supplier failure. It is broader than IT backups. It covers recovery of systems, communications with staff and customers, alternate working arrangements, financial controls under stress and leadership decision authority during a crisis.
How is business continuity different from disaster recovery?
Disaster recovery is a component of business continuity. Disaster recovery focuses specifically on recovering IT systems after a failure. Business continuity is broader and covers the whole business: people, processes, communications and finance, as well as IT. At OxygenIT our service covers both, because a recovered server with no communications plan is still a business in trouble. The technical backup platform is described on our data backup and disaster recovery page.
Do I really need a live exercise, or is a tabletop enough?
Both, at different frequencies. Tabletop exercises are good for walking a leadership team through a scenario. Live exercises find the real gaps: the admin account no one can find, the out-of-date contact list, the playbook that assumes a tool you no longer use. We run annual live exercises for every business continuity client.
What are immutable backups and why do they matter?
An immutable backup cannot be deleted, encrypted or modified once it is written, even by an administrator, even by ransomware. Modern ransomware specifically targets backups because destroying backups forces the ransom payment. Immutable backups are the single biggest technical defence against ransomware. Every OxygenIT client backup is immutable by default.
How much does business continuity cost in New Zealand?
Business continuity at OxygenIT is delivered as a monthly retainer with a project-based setup fee. We offer three tiers (Essential, Standard, Comprehensive) sized for 20 to 200 staff firms. We do not publish hourly rates for this service because every engagement is scoped to outcomes. Ask for indicative pricing for your business size and industry, and see the prices we do publish.
Will my cyber insurer accept your plan as evidence?
Our plans, exercise records and test restore evidence are designed to answer the specific questions New Zealand cyber insurers now ask. We have supported clients through underwriter reviews and renewals. Acceptance is the insurer’s call, not ours, so your broker is welcome to review the plan format before you engage us.
How often should the plan be reviewed?
At minimum annually, and whenever there is a material change to the business: new systems, new sites, significant growth, merger or acquisition, new regulatory obligations. Most of our clients schedule a formal review as part of the annual live exercise.
Do you cover non-IT aspects of business continuity?
Yes. The business continuity plan covers communications, alternate working arrangements, key supplier contact lists, financial controls under stress and leadership decision authority. We draft it with your leadership team, not in isolation. It is your plan. We provide the framework, the discipline and the testing.
Does business continuity cover AI-related risks?
Yes. As AI tools become embedded in business processes (Microsoft 365 Copilot, meeting summarisers, generative assistants), the failure modes change. OxygenIT is independently certified to ISO/IEC 42001:2023 for AI management. Our continuity planning includes AI service outage scenarios, AI vendor risk and shadow AI inventory. See what AI governance costs.
Do you only serve Christchurch, or all of New Zealand?
OxygenIT is based in Christchurch, with engineers in Auckland, Wellington and Christchurch, and delivers business continuity services across New Zealand. Planning work is delivered in person where practical and remotely where efficient. Our Canterbury presence matters because it puts a local team behind you, a team that has lived through the real disruptions New Zealand businesses face.
Talk to a founder about your recovery plan
Fifteen minutes with a founder, not a sales rep. Tell us when your backups were last restored and we will tell you plainly where the gap is.
Or call 0800 242 206
