Cybersecurity and Business Continuity Must Go Hand in Hand
For most businesses, email is as essential as electricity, telephone service, and access to the internet. Employees rely on it to communicate with customers, coordinate operations, exchange documents, process transactions, and make important business decisions. But what happens when that system suddenly stops working?
The recent Microsoft Outlook and Microsoft 365 outage on November 12, 2026, offered a timely reminder of just how dependent businesses have become on technology. Thousands of organizations and individuals experienced disruptions accessing Outlook, Microsoft Teams, and other Microsoft 365 services. At the height of the disruption, outage reports exceeded 130,000 for Outlook alone. Microsoft attributed the problems to infrastructure and server connectivity issues and worked to restore service.
While there was no indication that this particular incident resulted from a cyberattack, the lesson is equally important from a cybersecurity perspective: A business does not have to be hacked to experience a potentially devastating technology disruption.
This is where cybersecurity and business continuity planning intersect.
Cybersecurity Is More Than Preventing Hackers
When business owners think about cybersecurity, they often focus on protecting their networks from hackers, ransomware, phishing attacks, and data theft. Those are certainly critical concerns, but cybersecurity is only one part of protecting an organization.
Business continuity addresses a broader question: If an essential technology, service, or system becomes unavailable, can the business continue operating?
Consider the impact of an email outage. Employees may be unable to communicate with customers, vendors may not receive purchase orders, invoices may go unpaid, and time-sensitive contracts may be delayed. Employees working remotely may lose access to essential collaboration tools. Even internal communications can become difficult when companies rely heavily on Microsoft Teams or similar platforms.
For some businesses, a few hours of disruption may be an inconvenience. For others, it can mean lost revenue, missed deadlines, damaged customer relationships, and significant operational consequences.
The problem is not necessarily the technology itself. It is the absence of an alternative when that technology fails.
The Danger of Depending on a Single Technology Provider
Cloud-based services offer tremendous advantages. Businesses no longer need to maintain all their own servers, storage systems, and infrastructure. They can access information from virtually anywhere, collaborate across offices, and scale their operations without substantial investments in hardware.
However, convenience can create dependency.
When an organization relies on one provider for email, file storage, collaboration, scheduling, and other business-critical functions, a disruption affecting that provider can have a cascading impact.
This is sometimes referred to as a single point of failure.
Businesses should periodically examine their technology dependencies and ask themselves some important questions:
- If our email system becomes unavailable, how will employees communicate?
- If we cannot access our cloud-based files, can we retrieve essential information elsewhere?
- If our primary technology provider experiences an extended outage, can we continue serving customers?
- Do employees know what to do, or will they simply wait for the system to come back online?
These are not hypothetical questions. They are essential business preparedness considerations.
Five Steps Businesses Should Take
Preparing for a technology disruption does not necessarily require an enormous investment. It does, however, require planning, leadership, and periodic testing.
1. Develop an Alternative Communications Plan
Every business should have a secondary method of communicating with employees, customers, and vendors. This might include telephone contact lists, text messaging, an independently hosted communication platform, or an emergency notification system.
Importantly, the alternative should not depend entirely on the same technology provider that is experiencing the outage.
2. Maintain Secure and Accessible Backups
Businesses should maintain regular backups of critical information, including financial records, customer information, operational documents, and essential business files.
Backups should be protected from ransomware and unauthorized access. Ideally, organizations should maintain offline or immutable backups and periodically test their ability to restore information.
Remember, having a backup is not the same as knowing that the backup works.
3. Establish a Written Business Continuity Plan
A business continuity plan should identify essential operations, critical employees, technology dependencies, and procedures for maintaining operations during a disruption.
Employees should know who is responsible for making decisions, how to report problems, and what alternative procedures to follow.
The plan should address more than cyberattacks. It should include power outages, internet disruptions, cloud-service failures, natural disasters, and other events that could interrupt normal operations.
4. Train Employees to Recognize Cybersecurity Risks During an Outage
Technology disruptions create opportunities for criminals.
When employees cannot access their normal systems, they may be more willing to follow unfamiliar instructions or use alternative communication channels without verifying their authenticity.
Criminals can exploit the confusion by sending fraudulent messages claiming to be from IT support, Microsoft, company executives, or financial institutions. These messages may ask employees to reset passwords, click links, disclose credentials, or transfer money.
Employees should be reminded to verify unusual requests through an independent communication method and never provide passwords or authentication codes in response to unsolicited messages.
5. Test Your Plan Before You Need It
A business continuity plan sitting in a filing cabinet provides little protection if nobody knows how to use it.
Organizations should conduct periodic tabletop exercises simulating an email outage, ransomware incident, or loss of access to critical systems. Management should evaluate how quickly employees recognize the problem, communicate with one another, and implement backup procedures.
These exercises frequently uncover weaknesses that can be corrected before a real incident occurs.
Leadership Must Take Responsibility
Throughout my 20 years with the FBI, I participated in investigations involving national security threats, cybercrime, and attacks that disrupted organizations and individuals. One lesson consistently emerged: preparation and leadership make a significant difference when unexpected events occur.
Technology failures are inevitable. Cyberattacks are an ongoing threat. No organization, regardless of its size or resources, can guarantee that its systems will always be available.
What distinguishes a prepared organization from an unprepared one is not whether something goes wrong. It is how effectively the organization responds.
Business owners and executives must recognize that cybersecurity is not simply an IT department responsibility. It is a business risk that requires leadership involvement, employee awareness, appropriate investment, and accountability.
The Bottom Line
The Microsoft outage is a reminder that businesses cannot afford to assume their technology will always be available. Whether the disruption results from a technical failure, a cyberattack, ransomware, or an infrastructure problem, the consequences can be remarkably similar.
The objective should not simply be to prevent disruptions. It should be to build an organization capable of surviving them.
Ask yourself one question: If your company’s email, internet, and primary technology systems stopped working tomorrow morning, could your business continue operating?
If the answer is no, you have identified a vulnerability that deserves immediate attention.
In today’s business environment, cybersecurity protects your information, but business continuity protects your ability to operate. Successful organizations need both.
