If your systems went down tomorrow, how long until you were trading again?
Every 20 to 200 staff NZ business has a story about the time things almost went very wrong. Ransomware on a Friday night. A failed server with no working backup. A staff member who deleted the wrong folder. A fire, a flood, an earthquake. Most of the time, these stories end with, we were lucky. Luck is not a strategy.
Christchurch business owners know this better than most. Canterbury has lived through earthquakes, floods and multi-day power outages. Cyber incidents have been added to the list. A real business continuity plan is no longer optional. It is the difference between a bad week and a business-ending event.
What does business continuity actually cover?
Business continuity is the full stack of planning, technology and testing that keeps your business operating through disruption. It covers backup and restore, disaster recovery, incident response, communications planning and staff procedures. It is broader than IT backups. It is how the whole business keeps trading when something goes wrong.
The OxygenIT Business Continuity service delivers:
- Immutable, encrypted, off-site backups for your Microsoft 365 data, servers, endpoints and line-of-business systems.
- A documented disaster recovery plan with measurable recovery time and recovery point objectives.
- An incident response playbook for the most likely NZ scenarios: ransomware, data breach, supplier failure, natural disaster.
- A business continuity plan that covers communications, alternate working arrangements and key stakeholder contacts.
- Annual live recovery exercises, not just tabletop reviews, so your plans are proven under pressure.
A business continuity plan that has never been tested is not a plan. It is a hope.
When does a Christchurch or New Zealand SMB need formal business continuity planning?
Most owners know the moment they need one. Here are the five clearest triggers:
- Your cyber insurer is asking for a tested DR plan and for evidence of immutable backups and tested restores.
- A major customer is asking for evidence of your business continuity arrangements as part of their supplier assurance process.
- You are pursuing SMB1001 or ISO 27001 certification and need documented, tested business continuity controls.
- You have grown past 20 staff and the operational impact of even a single day offline is now measured in tens of thousands of dollars.
- You have experienced a close call (ransomware attempt, failed backup, supplier outage) and the next incident needs to be caught with a plan, not with luck.
If two or more of these sound familiar, you need formal business continuity planning.
What is included in OxygenIT’s Business Continuity service?
Our business continuity service is delivered across six workstreams, with an annual cycle of review, testing and update. Every element is documented, owned and regularly exercised.
Backup architecture and immutability
Immutable, encrypted, geographically separated backups for Microsoft 365 data, servers, endpoints and key line-of-business systems. Backups cannot be deleted by ransomware or by a compromised admin account.
Recovery testing, not just backup monitoring
Every quarter we perform a test restore against a real recovery scenario. Not an email saying the backup job completed. An actual file, database or VM recovered, timed and documented.
Disaster recovery plan
A written disaster recovery plan with defined recovery time objectives (RTO) and recovery point objectives (RPO) for every business-critical system. Every scenario has an owner, a playbook and a test record.
Incident response playbook
A playbook for the NZ-relevant incident scenarios: ransomware, phishing-driven breach, stolen laptop, supplier failure, natural disaster. Roles, decisions and communications are pre-scripted so the response does not start with a blank page.
Business continuity plan
Beyond IT: alternate working arrangements, communications scripts for customers and staff, key supplier contact lists, financial controls under stress and leadership decision authority. Owned by your leadership team, drafted with us.
Annual live exercise
Once a year we run a live exercise against a realistic scenario. Leadership team in the room. Playbook in hand. Clock running. The exercise finds the gaps before a real incident does.
How our Business Continuity service rolls out: your first 30, 60 and 90 days
First 30 days: risk baseline and scoping
Business impact analysis. Identify the business-critical systems and data. Set recovery time and recovery point objectives by system. Audit current backup and recovery posture. Scope the plan.
Days 30 to 60: build and document
Backup architecture upgraded where needed. Disaster recovery plan written. Incident response playbook drafted. Business continuity plan drafted with your leadership team. First test restore performed and timed.
Days 60 to 90: test, train, embed
Staff communications briefing. Leadership tabletop exercise against a realistic scenario. Plan refined based on findings. Annual live exercise scheduled. From day 91 onwards, you have a plan that has been tested, not just written.
Why Christchurch businesses choose OxygenIT for business continuity
Canterbury-tested
Founded in Christchurch in 2005. Our team has lived through the earthquakes, the floods, the multi-day outages. Our plans reflect real NZ disruption patterns, not a generic template.
Certified where it matters
Independently certified to ISO 27001 for information security and ISO 42001 for AI management. SMB1001:2026 assessor capability. We apply the same standards internally that we advise on externally.
We test, not just monitor
Every quarter we perform a real test restore. Every year we run a live exercise with your leadership team. Monitoring tells you a backup ran. Testing tells you it will actually recover.
Immutable backups by default
Every client backup we configure is immutable. Ransomware that compromises your network cannot delete or encrypt your backups. This is the single biggest lever against modern ransomware.
Plans owners can actually read
Your disaster recovery plan, incident response playbook and business continuity plan are written in plain English, not RTO/RPO jargon. Leadership teams actually open them during an incident.
How much does business continuity cost in New Zealand?
Business continuity at OxygenIT is delivered as a monthly retainer, with a project-based setup fee for the initial plan build and testing. Pricing scales with the size and complexity of your environment. We do not publish hourly rates because every engagement is scoped to outcomes. Ask for indicative pricing for your business.
Continuity Essential
For 20 to 50 staff firms with a Microsoft 365 and single-site footprint. Immutable M365 backups, written DR plan, annual live exercise, quarterly restore testing. Priced from a monthly retainer plus setup project.
Continuity Standard
For 50 to 100 staff firms with multi-site, mixed cloud and on-premise or specific compliance obligations. Full backup architecture, DR plan, incident response playbook and business continuity plan, with quarterly testing. Priced from a monthly retainer plus setup project.
Continuity Comprehensive
For 100 to 200 staff firms, regulated industries or multi-entity groups. Full BC and DR stack, embedded continuity consultant, integration with ISO 27001 or SMB1001:2026 compliance programme, biannual live exercises. Priced from a monthly retainer plus setup project.
How business continuity supports cyber insurance and compliance
Cyber insurers in NZ now expect evidence of tested disaster recovery, immutable backups and documented incident response before they will renew, let alone pay a claim. A business continuity programme gives you that evidence. Every test restore, every live exercise and every plan update is documented and can be supplied at renewal.
The same documentation supports your compliance position under Privacy Act 2020 (notifiable breach readiness), SMB1001:2026 and ISO 27001. One programme, multiple audiences: insurer, regulator, customer, auditor. Your leadership team gets the peace of mind that comes from knowing the plan works because the plan has been tested.
Frequently asked questions about business continuity
01. What is business continuity?
Business continuity is the planning, technology and testing that keeps your business operating through disruption: cyber incident, hardware failure, natural disaster, supplier failure. It is broader than IT backups. It covers recovery of systems, communications with staff and customers, alternate working arrangements, financial controls under stress and leadership decision authority during a crisis.
02. How is business continuity different from disaster recovery?
Disaster recovery is a component of business continuity. Disaster recovery focuses specifically on recovering IT systems after a failure. Business continuity is broader and covers the whole business: people, processes, communications and finance, as well as IT. At OxygenIT our service covers both, because a recovered server with no communications plan is still a business in trouble.
03. Do I really need a live exercise, or is a tabletop enough?
Both, at different frequencies. Tabletop exercises are good for walking a leadership team through a scenario. Live exercises find the real gaps: the admin account no one can find, the out-of-date contact list, the playbook that assumes a tool you no longer use. We run annual live exercises for every business continuity client.
04. What are immutable backups and why do they matter?
An immutable backup cannot be deleted, encrypted or modified once it is written, even by an administrator, even by ransomware. Modern ransomware specifically targets backups because destroying backups forces the ransom payment. Immutable backups are the single biggest technical defence against ransomware. Every OxygenIT client backup is immutable by default.
05. How much does business continuity cost in NZ?
Business continuity at OxygenIT is delivered as a monthly retainer with a project-based setup fee. We offer three tiers (Essential, Standard, Comprehensive) sized for 20 to 200 staff firms. We do not publish hourly rates because every engagement is scoped to outcomes. Ask for indicative pricing for your business size and industry.
06. Will my cyber insurer accept your plan as evidence?
Yes. Our plans, exercise records and test restore evidence are designed to answer the specific questions NZ cyber insurers now ask. We have supported clients through underwriter reviews and renewals. Your insurer broker is welcome to review the plan format before you engage us.
07. How often should the plan be reviewed?
At minimum annually, and whenever there is a material change to the business: new systems, new sites, significant growth, merger or acquisition, new regulatory obligations. Most of our clients schedule a formal review as part of the annual live exercise.
08. Do you cover non-IT aspects of business continuity?
Yes. The business continuity plan covers communications, alternate working arrangements, key supplier contact lists, financial controls under stress and leadership decision authority. We draft it with your leadership team, not in isolation. It is your plan. We provide the framework, the discipline and the testing.
09. Does business continuity cover AI-related risks?
Yes. As AI tools become embedded in business processes (Microsoft 365 Copilot, meeting summarisers, generative assistants), the failure modes change. OxygenIT is independently certified to ISO 42001 for AI management. Our continuity planning includes AI service outage scenarios, AI vendor risk and shadow AI inventory.
10. Do you only serve Christchurch, or all of New Zealand?
OxygenIT is based in Christchurch but delivers business continuity services across New Zealand. Planning work is delivered in person where practical and remotely where efficient. Our Canterbury presence matters because it puts a local team behind you, a team that has lived through the real disruptions NZ businesses face.
