# Single-Vendor Outage Kit for Small Business

**Purpose.** This kit helps a small business plan for the day a single provider (Microsoft 365 is the example, but any email, file or phone vendor works) is down. Print it, fill in the worksheets, and keep a paper copy where staff can find it when the network is not available. It covers a dependency inventory, a cost worksheet, a runbook, message templates, a policy-review checklist and an offline-copy checklist. All figures in the examples are hypothetical; use your own.

## Checklist

- [ ] List every business function that stops if Microsoft 365 is down: email, calendar, Teams calls, file shares, phone system, e-signature, invoicing, booking.
- [ ] Name one person who decides "this is a provider outage" and one backup person.
- [ ] Set up a second free email address that staff can use if the main system is down, and write its details on the runbook page.
- [ ] Export the shared contact list (clients, vendors, key staff) to every phone and print one paper copy.
- [ ] Pick your 20 most-used files and keep a synced local copy of each on the relevant laptops.
- [ ] Print tomorrow's appointments or deadlines each afternoon on heavy-booking days.
- [ ] Bookmark the Microsoft 365 service health page and one third-party status monitor, and subscribe to alerts.
- [ ] Write a one-page client notice and a staff notice (templates below) and store them where you can reach them without email.
- [ ] Read your cyber and business-interruption policies for dependent business interruption, waiting period, sub-limit and cloud or provider exclusions.
- [ ] Email your broker the questions in the policy review section and keep the written reply.
- [ ] Run one one-hour test with email and Teams unavailable and record what breaks.
- [ ] Agree a rule: no password resets or system shutdowns until the provider confirms the cause.
- [ ] Set a date to review this kit again, in six months.

## Worksheet 1: Dependency inventory

Fill one row per tool. Impact is High, Medium or Low. The fallback should be the cheapest thing that works.

| Tool or function | Who uses it | What stops when it fails | Impact | Fallback | Owner |
|---|---|---|---|---|---|
| Email | | | | | |
| Calendar | | | | | |
| Teams calls or phone system | | | | | |
| File shares (OneDrive, SharePoint) | | | | | |
| Invoicing | | | | | |
| Booking or scheduling | | | | | |
| E-signature | | | | | |
| Other: | | | | | |

## Worksheet 2: Outage cost calculator

Staff count: ______ Hours of outage: ______ Average loaded hourly cost: $______

Share of work that depends on the provider (as a decimal, e.g. 0.6): ______

- Work hours at risk = staff × hours × share = ______
- Hours recovered by fallback (phone, local files, second email) = ______
- Delayed or lost hours = at risk minus recovered = ______
- **Cost of delay = delayed hours × hourly cost = $______**

Missed appointments or deadlines:

- Items you could not confirm or deliver: ______
- Share that fail (no-show, late, cancelled): ______
- Value per failure: $______
- **Cost of misses = items × share × value = $______**

**Total outage cost = cost of delay + cost of misses = $______**

Worked example (hypothetical): 12 staff, 6-hour outage, $95 per hour. At risk if everything stops: 12 × 6 × $95 = $6,840. With a fallback recovering 3 hours each, the cost of delay is 12 × 3 × $95 = $3,420. The fallback saves $3,420 on that day.

## Worksheet 3: Outage runbook

**First hour**

- Confirm it is the provider: check the service health page and the third-party monitor. Time: ______
- Tell the decision person: ______
- Switch to the fallback email address and phone contact method.
- Send the staff notice and post the client status line.
- Do not reset passwords or take systems offline until the provider confirms the cause.

**Hour 1 to 4**

- Call or text high-priority clients and tomorrow's appointments from the printed list.
- Work from local file copies; log anything you could not do.
- Check status every 30 minutes and record the time of each check.

**Hour 4 to 24**

- Keep the client status line current.
- Track delayed work in a simple list for catch-up.
- When service returns, check that mail sent and received during the outage was not lost, and send the follow-up message.
- Record hours lost and misses, then update Worksheet 2.

## Worksheet 4: Policy review checklist

Questions to put to your broker in writing. Record the answer and the date.

- [ ] Does my policy include dependent (contingent) business interruption for a third-party provider outage? Answer: ______
- [ ] What is the waiting period (in hours)? Answer: ______
- [ ] What is the sub-limit for dependent business interruption? Answer: ______
- [ ] Are cloud, software-as-a-service or provider failures excluded or narrowed? Answer: ______
- [ ] Does the cover require a cyber event, or does a non-malicious outage qualify? Answer: ______
- [ ] How is lost income calculated and what proof is needed? Answer: ______
- [ ] Is there extra cover for added expense (temporary tools, overtime) during an outage? Answer: ______
- [ ] Is there any aggregation or catastrophe clause that limits payment when many customers claim from one provider event? Answer: ______

## Worksheet 5: Offline-copy checklist

Choose the 20 files your team can't work without. Keep a synced local copy and note when it was last checked.

| # | File | Who needs it | Local copy location | Last checked |
|---|---|---|---|---|
| 1 | | | | |
| 2 | | | | |
| 3 | | | | |
| 4 | | | | |
| 5 | | | | |

(Continue to 20. Include the client contact sheet, current schedule, invoice template and open-invoices list.)

## Templates

**Client message (use when the provider is down)**

```text
Hello [name], our email provider is having a widespread outage, so you may not receive replies from us right away. To reach us in the meantime, please call or text [phone] or email [fallback address]. We are working normally by other means and will follow up by [time] with an update. Thank you for your patience.
```

**Staff message**

```text
Team: our email and Microsoft apps are affected by a provider outage. This is not a confirmed attack, so please do not reset passwords or shut anything down. Use [fallback email] and [phone method]. Work from your local file copies. Check in with [person] at [time]. Send the client notice to anyone expecting a reply today.
```

**AI prompt: build your first outage plan**

```text
Act as a business continuity consultant. I run a [type of business] with [number] employees and use Microsoft 365 for email, files, Teams and phones. Build a one-page outage plan covering the first hour, a 4-hour outage and a 24-hour outage, with who does what and what clients are told. Base it only on the details I give you. If you need a fact I haven't provided, ask me instead of assuming it, and tell me which parts you're least sure of.
```

**AI prompt: review a policy**

```text
Here is the text of my cyber insurance policy: [paste]. Identify the sections on business interruption, dependent or contingent business interruption, waiting period, sub-limits and exclusions for third-party or cloud provider failure. Explain in plain English whether a 6-hour Microsoft 365 outage would be paid. Quote the exact wording you rely on. If the text is unclear or something is missing, say so rather than guessing, and list questions for my broker.
```

**AI prompt: cost an outage**

```text
Help me estimate the cost of a 6-hour email and file outage. I have [number] staff, an average loaded hourly cost of [amount], [percent] of their work depends on Microsoft 365, and [number] client appointments or deadlines per day. Show the math step by step and separate what is lost from what is only delayed. State every assumption and flag any figure that would change the result a lot if I got it wrong.
```

**AI prompt: map dependencies**

```text
Make a dependency map of my business tools. I will list the tools, who uses them and what happens when each fails: [paste your list]. Rank them by impact on revenue and client contact, and suggest the cheapest fallback for the top five. Use only the facts I've listed and ask a question if something is ambiguous. Mark any ranking that is a judgement call.
```

## Sources

- https://www.npr.org/2026/11/12/nx-s1-6039343/is-outlook-down-widespread-outage-hits-microsoft-email-and-other-apps
- https://www.gmanetwork.com/news/topstories/world/1009366/australia-s-spy-agency-federal-police-hit-by-microsoft-outage/story/
- https://www.reinsurancene.ws/marsh-re-expects-impact-of-microsoft-365-outage-on-insurance-market-to-be-minimal/
- https://www.nextgov.com/modernization/2026/11/legacy-tech-issue-led-faas-nationwide-ground-stop/417232/
- https://www.federalreserve.gov/newsevents/pressreleases/bcreg20261113a.htm
- https://apprised.news/desk/tech/2026-11-13
- https://apprised.news/desk/insurance/2026-11-14