Continuity architecture for organisations up to 200 employees

Continuity isn't a luxury reserved for the largest companies — it's a precondition for any organisation whose operations depend on IT. For organisations up to 200 employees, the challenge isn't the technology itself — that's widely available — but the balance between risk, cost and manageability. A well-thought-out continuity architecture is therefore always a series of deliberate choices, not a copy of what an enterprise would implement.

The starting point is an honest analysis of what “critical” really means in your context. Which processes can be down for how many hours before the business suffers real damage? How much data can you afford to lose — minutes, hours, or a whole day? These RTO and RPO targets form the compass for every subsequent choice. Without this foundation, every investment in continuity leads to an arbitrary outcome.

At the infrastructure level, continuity means systematically identifying and addressing single points of failure. That starts at the basics: dual internet connections via different providers, redundant power at the office, and a virtualised server environment where the failure of one host doesn't take services down. For the mid-market, a private cloud at a Dutch data center is often a more efficient route than maintaining duplicate hardware on-site.

Backup and recovery form the second pillar. The 3-2-1 principle remains the standard: at least three copies of your data, on two different media, with one copy offsite and preferably immutable (unchangeable, protecting against ransomware). More important than the strategy is the testing practice: a backup that has never been restored is not a backup. Periodic restore tests belong in the standard regime, not in an annual audit.

Cybersecurity has by now become an integral part of continuity. A ransomware attack is, for many mid-market organisations, the most likely disaster scenario. Network segmentation, multi-factor authentication, endpoint detection, structured patch management and staff awareness together form the protection model. This should be paired with an incident response plan that has actually been rehearsed, so no one has to improvise during a real incident.

Don't forget the human side either. Continuity stands or falls on procedures that still work when the lead administrator is on holiday, when the director is unreachable, or when the standard communication channels themselves are down. A fallback location doesn't have to be a second office — but there does need to be an agreement on where people gather, how they get access, and who does what in the first 24 hours.

A fitting continuity architecture for the mid-market therefore combines standard components in a deliberate way: cloud-based redundancy, immutable backups, basic security hygiene, and a simple but rehearsed incident response plan. The total investment is typically a fraction of what a serious disaster would cost — provided you base your choices on your own risk profile rather than generic checklists.