A business continuity plan (BCP) is not a compliance checkbox — it is the document your team reaches for when something goes wrong. Mycelium 365 develops and maintains business continuity plans for Australian businesses using Microsoft 365 and Azure, mapping your technology recovery procedures to your critical business operations. The result: a tested, documented plan that covers what to do when your email goes down, when you're hit by ransomware, when your office floods, or when a key person is unavailable.
Most continuity failures we see are not exotic. A fibre cut takes out the office internet for two days. A ransomware infection encrypts the file share on a Friday afternoon. The one person who knows the admin password is on leave. A BCP does not prevent these events — it ensures the business keeps operating through them, with recovery steps that have been written down, assigned to a named owner, and tested before they are needed. For a broader view of how the platform supports this, read our guide to Microsoft 365 and Azure for business continuity.
Four phases, delivered as a fixed-price advisory engagement over 4–6 weeks, with an annual review and test included in the ongoing relationship.
We identify which operations are critical to your business and define the maximum tolerable downtime for each. A five-person payroll run and a customer-facing booking system have very different recovery requirements — the plan reflects that. This phase sets the recovery time objectives (RTOs) and recovery point objectives (RPOs) that every later decision is measured against.
We map technology risks to each critical operation: cyber attack and ransomware, ISP outage, hardware failure, Microsoft 365 service disruption, and key person dependency. Each risk is assessed for likelihood and impact so the plan spends effort where the exposure actually is, not where a template says it should be.
We write the recovery procedures for each critical system — clear ownership, step-by-step instructions, and the credentials and tools required. Procedures are written to be followed under pressure by someone who did not write them, and they are accessible offline, because a plan stored only in the system that just failed is not a plan.
We ensure the platform meets the documented objectives: Azure Backup with tested recovery procedures, Exchange Online retention, SharePoint versioning, OneDrive backup, and Intune device management — all configured to meet the RTO and RPO the plan commits to. Annual review and a live test are included in the engagement.
The deliverable is a written, tested business continuity plan — not a template. Each recovery procedure names an owner, lists the tools and credentials required, and has been exercised at least once before sign-off.
Microsoft 365 is itself a business continuity asset — Exchange Online, Teams, SharePoint, and OneDrive run on Microsoft's globally redundant infrastructure with 99.9% uptime SLAs. When the office is inaccessible, staff keep working from home or from a mobile phone with no change to how they reach email, files, or meetings. For most Australian SMBs, this is the single largest continuity improvement available, and it is already included in the licences they pay for.
But Microsoft's uptime guarantee does not cover your data. Accidental deletion, ransomware, and administrative errors sit outside the SLA and require independent backup. Mycelium 365 configures Microsoft 365 Business Premium to meet documented BCP requirements: Azure Backup with tested recovery procedures, Exchange Online retention policies, SharePoint versioning, OneDrive backup, and Entra ID conditional access ensuring staff can authenticate even during a partial outage. Each control is mapped to the recovery time and recovery point objectives in the plan, and the annual test includes a live restore — not just a screenshot of a green backup job.
For businesses running servers in Azure, continuity configuration extends to the Secure Cloud managed package, which includes backup policy management, recovery testing, and retention governance from $150/server/month.
APRA CPS 230 (effective July 2025) requires all APRA-regulated entities — banks, insurers, and superannuation fund trustees — to maintain documented, tested business continuity plans for critical operations. The standard is explicit that plans must define tolerance levels for disruption, identify critical operations, and be tested annually with evidence retained.
Mycelium 365 develops CPS 230-compliant BCPs for Australian financial services firms, including technology risk assessment, recovery procedure documentation, annual test scheduling, and evidence packs suitable for APRA audit. Where the continuity plan sits inside a broader governance uplift, our Governance and Compliance Readiness engagement covers the surrounding policy, control, and evidence requirements.
For a 20–100 user Australian business on Microsoft 365 and Azure, a realistic BCP is not a hundred-page document. It covers the disruptions that actually happen, with recovery steps sized to the team that will execute them. Mycelium 365 tailors each BCP to the specific risks and recovery requirements of the business.
Exchange Online carries a 99.9% uptime SLA and remains accessible from any mobile device even if every office machine is unavailable. For most SMBs, email continuity is a configuration question, not an infrastructure purchase.
SharePoint and OneDrive keep working documents accessible from any device, anywhere. Version history and recycle-bin retention provide the first line of recovery for accidental deletion and overwrite.
A failed laptop is replaced through Autopilot with company policies re-applied by Intune within about two hours — the user signs in and keeps working. No manual rebuild, no imaging queue.
Azure Backup restores data to a clean snapshot — within four hours for most environments we manage. Recovery procedures are documented and tested so the first restore is not attempted during an incident.
A managed router with 4G/5G failover keeps the office online when the primary link fails, and Teams Voice continues on mobile regardless. The plan documents who declares the failover and how staff are notified.
Admin procedures are documented and shared credentials are held in a secure vault, so the business does not depend on one person being reachable when something breaks.
The same five steps Mycelium 365 follows in every BCP engagement — useful whether you build the plan with us or start internally.
Identify which business operations and technology systems are critical. Prioritise by recovery time objective (RTO) — how quickly each system must be restored before the disruption becomes unacceptable.
Map the risks that could disrupt each critical system: cyber attacks, ransomware, hardware failure, ISP outages, Microsoft 365 service disruptions, and key person dependencies. For each risk, assess likelihood and impact.
Write step-by-step recovery procedures for each critical system — who is responsible, what tools and credentials are needed, and the exact steps to restore service. Procedures must be accessible offline.
Ensure Azure Backup covers all critical data with tested recovery procedures meeting your RPO. Configure Exchange Online retention, SharePoint versioning, and OneDrive backup. Test a full restore before finalising the plan.
Run an annual tabletop exercise and at least one live restore test. Update the BCP whenever your technology environment changes significantly.
Use this checklist to assess whether your business has a complete BCP in place:
If any item above is incomplete, contact Mycelium 365 for a BCP assessment — we will identify the gaps and provide a prioritised remediation plan, including the Microsoft 365 and Azure configuration needed to meet your documented recovery objectives.
Business continuity planning sits alongside our advisory, backup, and managed security services.
Ready to put a tested plan in place? Contact Mycelium 365 for a BCP assessment — we will scope the engagement against your environment and provide a fixed-price proposal.
Book a free, no-obligation Discovery Call to talk through your Microsoft 365, Azure, security, or support needs — no sales pitch, just a straight conversation.
We respond to every enquiry within 4 business hours. Monday to Friday, 7am–7pm AEST.
