On Thursday afternoon, millions of people in more than 70 countries opened Outlook and found nothing there. Mailboxes wouldn’t load, messages turned up hours late, and Teams and Copilot were disrupted too. More than twelve hours later, Microsoft was still working at pace to restore service.
For some, it was an irritating afternoon. For many more, from global brands to small businesses, it meant core communications grinding to a halt. Yet plenty of Microsoft users carried on with surprisingly little disruption, and what set them apart was preparation, done long before Thursday.
It’s tempting to see an outage like this as a technology problem for the provider to fix. That view doesn’t hold up for long. When one platform carries your email, meetings, documents and, increasingly, your artificial intelligence (AI) tools, its failure is a business problem. Customers still expect answers, suppliers still need instructions and regulators still have deadlines, whatever state your inbox is in. Resilience is the ability to keep delivering what matters most when the tools you depend on disappear, and it has to be built in advance.
That’s exactly what ISO 22301 is designed for. The International Organization for Standardization (ISO) standard for business continuity management systems asks organisations to understand their context, identify critical activities through a business impact analysis, assess the risks to them, and set out how they’ll keep operating at an acceptable level when disruption hits. Crucially, it’s a management system: led from the top, then tested, reviewed and improved. A document written once and filed away will not cut it.
Know what matters, and how long you can go without it
Thursday raised the questions a good business impact analysis should already have answered. Which processes depend on email or Teams? How long can each one go without them before the harm becomes serious? What are the manual workarounds, the alternative channels, the offline copies of key contact lists? Plenty of organisations discovered their crisis contact details were sitting in the very mailbox they couldn’t open. Clearly not ideal, but about as good a real-world case for contingency planning as you’ll find.
A plan only works if people use it
One of the failures I see most often is hesitation: a plan exists, but nobody is quite sure when to pull the trigger. Teams wait for the problem to fix itself, assume someone else has escalated it, or aren’t sure what threshold triggers action. Clear response structures, defined roles and agreed activation criteria make all the difference. When an outage stretches from minutes into hours, the organisations that cope best are the ones that made the call early, loudly and clearly, and moved to pre-agreed channels and workarounds whilst everyone else was still refreshing their browser.
Everyone’s responsibility
Business continuity is too often handed to a single owner or the information technology (IT) team. That’s a mistake. Continuity happens on the front line: the account manager who knows how to reach a key customer by phone, the operations lead who can run a shift from a printed rota, the communications team with a holding statement ready to go. That’s why ISO 22301 sets requirements on awareness, competence and communication; resilience depends on people knowing their part before they need to play it. Leadership sets the tone, but every employee carries a piece of the plan and should understand how they can help when disruption and uncertainty hit.
Thursday was also an opportunity: a live test that cost nothing to arrange. I’d encourage every organisation to run a short, honest review in the coming days. What worked? Where did people improvise? Which dependencies caught you out?
Outages on this scale are no longer rare, and governments around the world increasingly expect organisations, and individuals, to take responsibility for their own preparedness. We can’t control when the next major disruption comes. We can control how ready we are when it does.
ISO 22301’s cycle of exercising, evaluating and improving is how uncomfortable lessons become stronger arrangements. It gives any organisation a solid foundation for operating through disruption, and for those who value the standard, it’s highly likely Thursday’s disruption had less impact on them than on others. So, if it happened again tomorrow, how would your Thursday look?
Find out more about ISO 22301 business continuity management certification, or watch our on-demand webinar on ISO 22301 and cyber resilience.
