--- title: "For COOs: Planning Operations Around a Day Without Systems" url: https://trnsfrm.tech/blog/coo-guide-operational-resilience-downtime description: "Planning operations for a day without systems: what keeps running, what stops, who decides, and what a COO should ask IT for." lang: en --- Back to blog (https://trnsfrm.tech/blog) Image: For COOs: Planning Operations Around a Day Without Systems (https://trnsfrm.tech/blog-covers/cloud-misconfig.jpg) By Jeff Dennis (https://www.linkedin.com/in/jefferydennis), Founder & CEO October 30, 2026 # For COOs: Planning Operations Around a Day Without Systems Leadership Guides (https://trnsfrm.tech/blog?category=Leadership+Guides)#coo #it-resilience #business-continuity #nist-csf Most security planning focuses on preventing an incident. Operations leaders need to plan for the day prevention fails, or the day something unrelated to security takes the systems down: a failed update, a cloud outage, a cut fiber line, a power problem. On that day, the COO is the person everyone looks to. This guide is for COOs and operations managers. It covers how to plan operations around a day, or several days, without your core systems. ## Why this belongs to operations IT can restore systems. It cannot decide which customers get served first, which orders ship, which patients are seen, or which deals close. Those are operational decisions, and they need to be made before the outage, not during it. The NIST Cybersecurity Framework 2.0 treats recovery as its own function, including RC.RP, executing the incident recovery plan. NIST SP 800-34, the federal contingency planning guide, starts with a business impact analysis for the same reason: you cannot plan recovery until you know what the business needs most and how long it can wait. Regulated industries carry it into rules. HIPAA requires a contingency plan with an emergency mode operation plan under 164.308(a)(7). The FTC Safeguards Rule requires a written incident response plan under 314.4(h) for covered institutions with information on 5,000 or more consumers. Defense contractors that handle controlled unclassified information under NIST SP 800-171 need an incident handling capability under requirement 3.6.1. ## Step 1: Know what you cannot stop doing Work with department heads to list the critical operations: the things that, if they stopped, would hurt customers, revenue, safety, or regulatory standing quickly. For a manufacturer, that might be production scheduling, shipping, and quality records. For a dealership, sales, F&I, service, and parts. For a practice, scheduling, clinical documentation, and prescribing. For each operation, write down: - Which systems it depends on - How long it can be down before the impact becomes serious - How much recent data it can afford to lose, for example a day of entries or only the last hour NIST calls these concepts maximum tolerable downtime, recovery time objective, and recovery point objective. You do not need the jargon. You need honest answers from the people who run each area. ## Step 2: Find the gap Take those answers to IT and ask a direct question: if we lost these systems today, how long would recovery actually take, and how much data would we lose? Ask them to prove it with a restore test rather than an estimate. The difference between what operations needs and what IT can deliver is the gap. Some gaps get closed with investment: better backups, redundant internet, cloud failover. Some get closed with manual workarounds. Some get accepted as a business risk. All three are legitimate, as long as the decision is deliberate and written down. ## Step 3: Build the manual workarounds For each critical operation, decide how it continues without the system. Examples: - Printed or offline copies of schedules, open orders, or appointment lists, refreshed on a regular cycle - Paper forms for work orders, repair orders, or clinical notes - Phone trees and personal contact lists stored outside company email - A process for taking payments or deposits manually, and for recording them securely - Agreements with key suppliers and customers about how you will communicate during an outage Keep the workarounds simple and store them where people can find them without a computer. ## Step 4: Decide who decides In an outage, confusion about authority costs time. Settle these questions in advance: - Who can declare an outage and activate the plan? - Who decides whether to keep operating, scale down, or close temporarily? - Who talks to customers, and what do they say? - Who approves emergency spending? - Who coordinates with IT, the insurer, and outside counsel? Write the answers down with backups for each role. The person who normally decides may be on vacation. ## Step 5: Plan for the security case A cyberattack is a harder outage than a vendor failure. Systems may need to be disconnected deliberately. Restoring too early can reinfect the environment. Investigators and your insurer may need evidence preserved. Recovery can take longer than anyone expects. Make sure your operating plan assumes that some systems may be unavailable or untrustworthy for an extended period, and that email and file shares may not be available for coordination. Our post on building an incident response plan you will actually use (https://trnsfrm.tech/blog/building-an-incident-response-plan-you-ll-actually-use) covers the response side. ## Step 6: Practice Run a tabletop exercise with department heads at least annually. Pick a realistic scenario and walk through the first day: what stops, what continues manually, who calls whom. You will find gaps in an hour. Fix them and update the plan. For larger operations, consider testing a manual workaround for real during a quiet period. Nothing reveals problems like actually doing it. ## What to ask IT for A COO does not need to manage backups. You do need regular, plain answers to these questions: - When was the last successful restore test, and how long did it take? - Are backups protected from deletion or encryption by an attacker? - What is our recovery order, and does it match our operational priorities? - What single points of failure remain, and what would it cost to remove them? ## The industry angle Healthcare practices should read our post on EHR downtime procedures (https://trnsfrm.tech/blog/ehr-downtime-procedures-contingency-plan) and our healthcare page (https://trnsfrm.tech/industries/healthcare). Dealers should see our automotive page (https://trnsfrm.tech/industries/automotive) and FTC Safeguards overview (https://trnsfrm.tech/frameworks/ftc-safeguards). Manufacturers should see our manufacturing page (https://trnsfrm.tech/industries/manufacturing) and NIST overview (https://trnsfrm.tech/frameworks/nist). ## How we help TRNSFRM helps businesses line up recovery capability with what operations actually needs, and then test it. Start with the free compliance checklist (https://trnsfrm.tech/compliance-checklist), or book your free risk review (https://trnsfrm.tech/book). ## Related articles Leadership Guides ### For Owners: The Security Decisions Only the Owner Can Make Your IT team can handle most security work. These seven decisions belong to the owner, and when owners skip them, they get made by default. Read article https://trnsfrm.tech/blog/owner-guide-security-decisions-only-you-make Leadership Guides ### For CFOs: Seven Questions to Ask About Cyber Risk Seven plain questions a CFO can ask to understand cyber risk, tie it to the NIST CSF Govern function, and make better spending decisions. Read article https://trnsfrm.tech/blog/cfo-guide-cyber-risk-questions Leadership Guides ### Choosing the Right Cybersecurity Firm: 2026 Buying Guide and Provider Directory A transparent, segment-aware guide to evaluating cybersecurity companies in 2026 — software vendors, endpoint specialists, and operational MSSPs compared. Read article https://trnsfrm.tech/blog/cybersecurity-companies Call Now: +18777776855 ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "name": "TRNSFRM", "legalName": "Bitboyz LLC", "alternateName": [ "TRNSFRM Technology", "Bitboyz", "Bitboyz LLC", "Bitboyz LLC DBA TRNSFRM" ], "url": "https://trnsfrm.tech", "logo": "https://trnsfrm.tech/wp-content/uploads/2021/11/trnsfrm-logo.svg", "image": "https://trnsfrm.tech/og-image.png", "description": "Cybersecurity, compliance, and managed IT services for manufacturers, construction, automotive, and healthcare organizations.", "foundingDate": "2008", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "founder": { "@type": "Person", "name": "Jeff Dennis", "jobTitle": "Founder & CEO", "url": "https://trnsfrm.tech/", "sameAs": [ "https://www.linkedin.com/in/jefferydennis" ] }, "areaServed": [ { "@type": "Country", "name": "United States" }, { "@type": "City", "name": "Cleveland", "containedInPlace": { "@type": "State", "name": "Ohio" } }, { "@type": "City", "name": "Columbus", "containedInPlace": { "@type": "State", "name": "Ohio" } } ], "address": [ { "@type": "PostalAddress", "streetAddress": "10143 Royalton Rd Suite J", "addressLocality": "North Royalton", "addressRegion": "OH", "postalCode": "44133", "addressCountry": "US" }, { "@type": "PostalAddress", "addressLocality": "Columbus", "addressRegion": "OH", "addressCountry": "US" } ], "contactPoint": { "@type": "ContactPoint", "contactType": "customer service", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "areaServed": "US", "availableLanguage": "English" }, "knowsAbout": [ "CMMC", "NIST 800-171", "ISO 27001", "HIPAA", "FTC Safeguards", "ITAR", "Managed IT", "vCISO", "vCIO", "Cybersecurity", "Microsoft GCC High" ], "makesOffer": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity", "url": "https://trnsfrm.tech/cybersecurity", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Governance & Compliance", "url": "https://trnsfrm.tech/governance", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT", "url": "https://trnsfrm.tech/managed-it", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "vCISO", "url": "https://trnsfrm.tech/vciso", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Integration & Implementation", "url": "https://trnsfrm.tech/services/ai", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft GCC / GCC High", "url": "https://trnsfrm.tech/services/microsoft-gcc", "provider": { "@type": "Organization", "name": "TRNSFRM" } } } ], "aggregateRating": { "@type": "AggregateRating", "ratingValue": "5.0", "reviewCount": "177", "bestRating": "5", "worstRating": "1" }, "sameAs": [ "https://www.linkedin.com/company/trnsfrmtech", "https://www.linkedin.com/in/jefferydennis", "https://clutch.co/profile/trnsfrm", "https://maps.google.com/?cid=0x8830ed5d3a6900c5:0xe344c24d13357f96", "https://www.goodfirms.co/company/trnsfrm", "https://www.bestitmsps.com/company/trnsfrm/" ] }, { "@context": "https://schema.org", "@type": "WebSite", "name": "TRNSFRM", "url": "https://trnsfrm.tech", "publisher": { "@type": "Organization", "name": "TRNSFRM" }, "potentialAction": { "@type": "SearchAction", "target": "https://trnsfrm.tech/blog?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "ProfessionalService", "name": "TRNSFRM", "legalName": "Bitboyz LLC", "alternateName": [ "TRNSFRM Technology", "Bitboyz", "Bitboyz LLC", "Bitboyz LLC DBA TRNSFRM" ], "url": "https://trnsfrm.tech", "image": "https://trnsfrm.tech/og-image.png", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "address": { "@type": "PostalAddress", "streetAddress": "10143 Royalton Rd Suite J", "addressLocality": "North Royalton", "addressRegion": "OH", "postalCode": "44133", "addressCountry": "US" }, "areaServed": [ { "@type": "Country", "name": "United States" }, { "@type": "City", "name": "Cleveland", "containedInPlace": { "@type": "State", "name": "Ohio" } }, { "@type": "City", "name": "Columbus", "containedInPlace": { "@type": "State", "name": "Ohio" } } ], "priceRange": "$$", "sameAs": [ "https://www.linkedin.com/company/trnsfrmtech", "https://www.linkedin.com/in/jefferydennis", "https://clutch.co/profile/trnsfrm", "https://maps.google.com/?cid=0x8830ed5d3a6900c5:0xe344c24d13357f96", "https://www.goodfirms.co/company/trnsfrm", "https://www.bestitmsps.com/company/trnsfrm/" ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "BlogPosting", "headline": "For COOs: Planning Operations Around a Day Without Systems", "description": "Planning operations for a day without systems: what keeps running, what stops, who decides, and what a COO should ask IT for.", "author": { "@type": "Person", "name": "Jeff Dennis", "jobTitle": "Founder & CEO", "url": "https://www.linkedin.com/in/jefferydennis", "sameAs": [ "https://www.linkedin.com/in/jefferydennis" ], "worksFor": { "@type": "Organization", "name": "TRNSFRM", "url": "https://trnsfrm.tech" } }, "datePublished": "2026-10-30T12:14:35.207413+00:00", "publisher": { "@type": "Organization", "name": "TRNSFRM", "url": "https://trnsfrm.tech" }, "image": "https://trnsfrm.tech/blog-covers/cloud-misconfig.jpg" }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://trnsfrm.tech/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://trnsfrm.tech/blog" }, { "@type": "ListItem", "position": 3, "name": "For COOs: Planning Operations Around a Day Without Systems", "item": "https://trnsfrm.tech/blog/coo-guide-operational-resilience-downtime" } ] } ] } ] ```