Small Business Digital Continuity Checklist

A digital continuity checklist for email, DNS and recovery

The uncomfortable test

This digital continuity checklist tests whether your business can recover access, not just files. Most businesses can say they have backups. Far fewer can answer a more useful question: could we continue operating today if we lost access to email, the domain control panel, or our shared files?

That is a continuity question, not just a backup question. A successful restore matters, but a business can still be stalled if nobody can change DNS, receive password-reset codes, contact customers, find current documents or decide who is authorised to act.

This checklist is designed for a small business that uses common cloud services and does not need a full enterprise disaster-recovery programme. It does not replace specialist security, legal or IT advice. Its purpose is to expose ownership gaps early and create a short, tested recovery path.

The Australian Cyber Security Centre’s business guidance recommends baseline mitigation strategies and provides separate material on incident response and the small-business threat environment. Use this checklist alongside those resources, rather than treating it as a security certification. Cyber.gov.au business guidance

Run a 30-minute digital continuity checklist drill

Choose a quiet time. Do not deliberately break production systems. Instead, simulate the following situation on paper and by using safe account checks:

It is 9:00 am. Your normal email service is unavailable, a staff member cannot access the domain registrar account, and the latest client folder has to be recovered. Which people can act, which accounts are required, and how do customers hear from you?

Record the answer for each check as pass, partial, or fail. A partial result is valuable: it shows exactly what needs an owner.

Check	Pass looks like	Common failure
Contact tree	Two authorised people can reach staff, suppliers and customers through a non-email method.	The only contact list sits in an unavailable inbox.
Domain ownership	The legal business owner, registrar, renewal date and recovery method are documented.	A former employee or web developer owns the login.
DNS control	Two authorised people know where DNS is managed and can identify the current records.	Registrar and DNS provider are confused, or credentials are single-person only.
Email recovery	Administrators, recovery addresses and multi-factor methods are current and accessible.	Password-reset codes go to the unavailable mailbox.
File recovery	A non-critical sample file can be restored to a separate location and opened.	Backups exist, but nobody has checked recovery or permissions.
Alternative communications	A pre-approved phone/SMS/website message route exists.	The team assumes email is the only way to reach customers.
Decision rights	One incident lead and one backup can approve urgent changes.	Several people can act, but no one knows who decides.

1. Start the digital continuity checklist with ownership

Create a one-page register and keep an offline or independently accessible copy. It should name the service, the business owner, operational administrator, renewal/billing contact, recovery method and next review date.

Minimum services to list:

domain registrar and DNS host
website host, content-management system and backup service
business email and identity provider
shared-file platform
customer relationship management or booking system
payment, phone and social-media accounts that customers rely on

Do not put passwords or recovery codes into this register. Store credentials in an approved password manager or another protected process. The register should simply tell the business where control sits and who can access it.

2. Separate domain registration from DNS hosting

These services are often held in different places. The registrar controls the domain registration and nameservers; the DNS host manages records such as website and email routing. A digital continuity checklist needs both.

For each domain, record:

registrar name, account owner and renewal date
nameserver provider
where DNS changes are made
who can approve a DNS change
which records are business-critical: website, email, verification and subdomains
the current escalation path if access is lost

Avoid making untested changes during the drill. The aim is to prove that the authorised people can locate control and understand the consequences of a change.

3. Test email recovery without taking email offline

Email is usually the first dependency to fail visibly and the first place password-reset links are sent. Confirm that:

at least two current administrators exist
recovery email addresses and phone numbers belong to the business, not a single individual
multi-factor authentication is enabled for administrators and there is a controlled recovery process
emergency contact details can be reached outside the affected email system
an alternative short-term communication channel is agreed in advance

If a staff member leaves, remove access promptly and update the register in the same task. Access reviews are far easier than incident reconstruction.

4. Prove one file can be recovered and used

A digital continuity checklist needs a restore test, not just a “backup completed” notice. Once per quarter, choose a low-risk sample document and restore it to a separate location. Ask an authorised person to open it and confirm the version.

Capture three details:

Recovery point: how recent was the recovered copy?
Recovery time: how long did it take to locate and restore?
Usability: could the relevant person open it with the required permissions and software?

Do not overwrite live files as part of a test. Restore elsewhere, compare, and delete the test copy when finished under your normal retention rules.

5. Write a customer communication fallback

Prepare a short, factual message before an outage. It should explain what customers can do now, not speculate about cause or timing.

Example:

We are currently experiencing an issue with one of our business systems. Our team is working on it. For urgent enquiries, please call [phone number]. We will update this page when normal service resumes.

Identify an approved alternative if email is unavailable. Options include a website notice, phone recording, verified social account or SMS response. Make sure only authorised people can issue it.

6. Decide who leads and who backs them up

Small businesses do not need a large incident committee, but they do need clear authority. Assign:

an incident lead to coordinate facts and decisions
a technical contact for provider and recovery work
a customer contact for updates and staff communication
a backup for each role

Write down the first three decisions that may be needed: whether to take a site offline, whether to change DNS, and who approves customer messaging. This removes delay when pressure is high.

7. Use the result to make one improvement at a time

After the drill, log the top three failures, the responsible owner and a due date. Good improvements are specific:

add a second domain-account administrator
replace a personal recovery email with a business-controlled address
document nameserver ownership
schedule a quarterly restore test
move the emergency contact list to an independently accessible location

Retest the exact failure after it is fixed. Then repeat the digital continuity checklist every six to twelve months, and whenever a key person, provider or domain changes.

Digital continuity checklist record sheet

Date	Scenario	Pass / partial / fail	Gap found	Owner	Fix due	Retest date
	Email, DNS and file recovery

Small-business digital continuity checklist: email, domain, DNS and backups