Continuity planning has a budget problem: nobody knows what they're protecting against, so they either spend nothing or buy whatever the scariest salesperson suggested. The fix is one number: what an hour of downtime costs your business. It takes twenty minutes to calculate and it sizes every decision after it.
The formula
Downtime cost per hour = lost revenue + idle payroll + recovery cost + the slow losses.
- Lost revenue. Annual revenue divided by your operating hours gives revenue per hour. Then be honest about how much actually stops. An online store loses close to 100 percent when the site is down. A consultancy might lose 20 percent for an email outage, because people can still think without email, barely.
- Idle payroll. Loaded hourly cost of your team times the fraction who can't work. Fifteen people at $40 an hour loaded, three-quarters blocked, is $450 an hour, and it runs whether or not revenue does.
- Recovery cost. Emergency IT rates ($150 to $300 an hour), rush hardware, overnight shipping, overtime for the catch-up. Bad outages spend money at both ends.
- The slow losses. The customer who hit a dead site and bought elsewhere, the missed bid deadline, the reputation dent. Hard to compute, so pick a conservative estimate and label it. Zero is the one number that's definitely wrong.
A worked example
A 15-person services firm doing $2.5M a year, roughly 2,000 operating hours, so $1,250 revenue per hour. Their file server dies at 10 a.m. Tuesday.
- Revenue impact, call it 60 percent stopped: $750 per hour
- Idle payroll: 15 people × $40 × 0.75 = $450 per hour
- Running total: $1,200 per hour, before recovery costs
With backups that were tested and a spare to restore to, they're back in 4 hours: roughly $5,000 plus recovery labor. With an untested backup that turns out broken, they're rebuilding for two days: north of $19,000, plus data re-entry, plus the slow losses. Same failure, 4x the bill. The difference was a restore drill that costs a few hundred dollars a year.
What to do with your number
Run the math for your three or four ugliest scenarios: server death, internet outage, ransomware, key system down. Then compare each hourly cost against the monthly cost of shrinking it. A $100-a-month failover line against a $1,200-an-hour internet outage pays for itself in the first five minutes of the first incident. A $400-a-month recovery setup against a once-a-decade risk is a judgment call. That's fine. Now it's a judgment call with numbers in it.
This number is also your defense against fear-based selling. When a vendor waves a breach headline at you, you can answer with your own arithmetic: here's our exposure, here's what we'll spend against it. Sized spending beats scared spending every time. Start with finding your single points of failure, because that list tells you which scenario goes first.
Want this handled instead of homeworked? That's the job.
Email us →