Government 'Be Ready' campaign is now critical. How to prepare for the worst that's yet to come..

The government has relaunched its Be Ready campaign, asking every household in the UK to be able to cope for three days without outside help. Severe weather and cyber attacks are named side by side. For a business the question is sharper: could you keep trading for three days if the power, the internet or your systems went down?

What the government's Be Ready campaign asks for

Led by the Cabinet Office and published on 22 October 2026, the updated campaign replaces the preparedness website first launched in 2024 and is set to run for three years. It advises people to keep enough water, non-perishable food and medical supplies for three days, along with a torch, spare batteries, a power bank and an FM radio, either wind-up or battery-powered, for news during an outage. It also recommends keeping some physical cash in case online banking and card payments stop working.

The government's reasoning is simple: "Being ready for three days helps you manage while support reaches those in need." The relaunch comes as ministers speak more openly about hostile-state threats and the possibility of conflict, alongside more familiar risks such as floods, storms and wildfires. The BBC's report on the campaign covers the wider background.

Why a household checklist isn't a business continuity plan

Tinned food and a torch will get a family through a power cut. They won't keep your phones answered, your invoices going out or your customer data safe. Most businesses now depend on a chain of things that all have to work at once: mains power, a broadband line, a firewall, Wi-Fi, a phone system, Microsoft 365, a card terminal and a backup that genuinely restores. Lose one link and the business stops, even if the building is untouched.

The useful exercise is to ask the government's three-day question of your IT. If the power went off on Monday morning, what would still be working on Wednesday afternoon? If ransomware encrypted your files tonight, how much would you lose, and how long would it take to get it back? If the office flooded, could your team carry on from home tomorrow?

The disruptions every business IT plan should cover

Four risks cover most of what the government's guidance describes, and each one has a practical IT answer.

Worst-case disaster planning for business IT

The government's checklist covers the emergencies most people will actually face. Clients also ask us about the larger ones: a software flaw exploited across thousands of businesses at once, AI-driven attacks, a data centre that loses everything, a national internet failure, a severe solar storm. Some of these are unlikely in any given year, but none of them is fiction, and the measures that protect against them also protect against everyday failures. This is how we approach each one.

Widespread vulnerabilities exploited at scale

Some of the most damaging attacks of recent years began with a single flaw in software that thousands of organisations had in common. Log4Shell, disclosed in December 2021, sat inside a logging library built into countless applications. In 2023 a flaw in the MOVEit file transfer tool let the Cl0p ransomware group steal data from organisations around the world, including British Airways, the BBC and Boots through their shared payroll provider. Once a flaw like that is public, the window before attackers use it is short. The NCSC says the time between disclosure and exploitation has already shrunk to days and that AI will almost certainly shorten it further, and in May 2026 it warned organisations to prepare for a wave of patches as AI speeds up the discovery of new flaws.

Defending against this comes down to speed and depth. We keep an inventory of every system and the software it runs, so when a critical CVE is announced we know straight away which systems are exposed. Internet-facing systems are patched first, with automatic updates wherever they are safe, and anything that can't be patched immediately is shielded or taken offline until it can be. Behind that sits a second line of defence: behaviour-based endpoint detection, network segmentation and backups an attacker can't reach, so a flaw exploited before the patch arrives doesn't become a business-ending incident.

AI-powered hacking and AI-driven attacks

AI has made attackers faster and more convincing. The NCSC assesses that criminals and hostile states are almost certainly already using it for reconnaissance, vulnerability research, exploit development, social engineering and writing malware. Phishing emails no longer give themselves away with clumsy spelling, and voices and faces can now be faked: in 2024 an employee at the engineering firm Arup in Hong Kong paid out around US$25 million after a video call in which every other participant, including the chief financial officer, was a deepfake. In November 2025 Anthropic reported disrupting an espionage campaign in which attackers used its AI coding tool to carry out most of the intrusion work automatically.

The defences are partly technical and partly procedural. Phishing-resistant multi-factor sign-in stops most stolen passwords from being useful, and email authentication with SPF, DKIM and DMARC makes it far harder for anyone to impersonate your domain. Most importantly, no payment, change of bank details or password reset should ever be approved on the strength of an email, a call or a video alone. A second check through a known number, or in person, defeats even a flawless deepfake. We help clients put those rules in writing, train staff to follow them, and back them with monitoring that watches for what an attacker does, not just for known malware.

When a data centre loses everything, backups included

In September 2025 a battery fire at South Korea's National Information Resources Service in Daejeon destroyed 96 government systems. Ninety-five had backups. The government's shared document store, holding several years of civil servants' work, did not, and around 858 TB was lost for good. In 2021 a fire destroyed an OVHcloud data centre in Strasbourg, and some customers found their backups had been kept on the same site. In 2024 a configuration error at Google Cloud deleted the entire cloud account of the Australian pension fund UniSuper, which recovered only because it also held backups with a different provider.

A backup in the same building, or with the same provider, does not protect you against that provider failing. We build backups to the 3-2-1-1-0 rule: three copies of your data, on two different types of media, one held off-site, one offline or immutable so that ransomware and admin mistakes can't reach it, and zero errors when we test a restore. For critical data, one copy sits with a separate company in a separate location, and one sits in your own hands.

Power cuts that last days or weeks

A UPS buys minutes, and a generator lasts only as long as the fuel deliveries keep coming, which in a wide-area emergency may not be long. Mobile masts and broadband street cabinets often have limited battery backup, so 4G failover can disappear within hours of a regional power cut. For sites that must keep running, we design solar and battery systems that carry a planned core load, such as the firewall, switching, a server and the phones, and shed everything else. Solar output in a UK winter is a fraction of summer output, so we size batteries and loads for the worst month, not the average.

Keeping data readable for decades

Long-term storage fails quietly. Hard drives left unpowered on a shelf are not an archive, file formats go out of use, and an encrypted backup is worthless if the key is lost with the server. There are several ways to keep data for the long term, and the right one depends on how much you hold, how long you must keep it and how quickly you would need it back, so we agree the approach with each business individually. Whatever the method, every copy is verified and refreshed on a schedule. Archives are kept in open formats such as PDF/A and CSV, the hardware needed to read them is stored with them, and encryption keys and recovery details are held securely offline. The recovery plan exists on paper too, because a plan that lives only on the failed system is no plan at all.

Solar storms and electromagnetic pulse

Severe space weather is on the UK's National Risk Register. A major geomagnetic storm induces currents in long conductors, so the main danger is to power grids, long-distance cables and satellites rather than to a laptop on a desk; the 1989 storm that blacked out Quebec is the usual example. For most businesses the practical effect is a long power and communications outage, which the plans above already cover.

A high-altitude nuclear electromagnetic pulse is different, because its fastest component can damage electronics directly. Hardening an entire building to military standards is beyond almost every business budget, and we won't pretend otherwise. What is realistic is a set of spare critical equipment and offline backups stored in shielded enclosures, surge protection on every incoming line, and fibre rather than copper for links between buildings, since glass fibre doesn't carry the surge. That won't make a business untouchable, but it leaves you something to restart with.

A failure at the heart of London's internet

A large share of the UK's internet traffic is exchanged in a small cluster of data centres in London Docklands. A serious loss there would cause widespread disruption, and two broadband lines from different providers won't help if both run through the same exchange, the same duct or the same core network. We check where each connection actually routes and choose genuinely separate paths, including satellite where it makes sense. Satellite needs checking too: if its traffic rejoins the internet in London, it isn't the independent route it appears to be.

The stronger defence is an office that keeps working without the internet at all. Local copies of files, an on-site server where it's justified, internal phone calls, CCTV recording, building access and card terminals with an offline mode can all keep running while the outside world is unreachable.

International fibre cut for months at a time

Subsea cables are cut more often than most people realise. In the Red Sea, the AAE-1 cable was out of service for around four months after a cut in December 2024, and several more cables were severed near Jeddah in September 2025, with repairs taking weeks because specialist ships and permits are scarce. Cables in the Baltic Sea have also been damaged repeatedly. The internet usually routes around a single cut, but several cuts at once, or a deliberate campaign, could leave links to the US or Europe slow or unusable for a long time.

The answer is to know which of your services depend on another continent. We map where your email, files, business software and sign-in actually run, keep data in UK data centres wherever possible, and hold local copies of the data you couldn't trade without. A business that can carry on for a few weeks on local systems is in a far stronger position than one where every click crosses an ocean.

How IT Pro Expert predicts, prepares and provides

Nobody can tell you when the next storm or cyber attack will arrive. What we can do is make sure that, when it does, you already know what happens next.

1. Predict

   We start by mapping what your business actually runs on and ranking what would hurt most if it failed: power, connectivity, data, phones, suppliers and people. Monitoring and regular testing, including our network protection tester, flag weaknesses before an attacker or a failing disk finds them.

2. Prepare

   Then we close the gaps: tested backups held off-site and offline, failover internet, battery backup, secure remote working and a written recovery plan with named contacts and clear first steps. Everyone knows who to call and what to do, and nothing depends on a single person or a single cable.

3. Provide

   When something does go wrong, contract customers deal directly with a senior engineer rather than a call centre, and even complex issues are typically resolved the same day. If data is lost or damaged, our data recovery service takes over, and the plan you rehearsed becomes the plan you follow.

Disaster recovery support in the UK, the US and worldwide

Our engineers work on-site across East and South London, Kent and East Sussex, and along the US East Coast from Florida to New York, where services are delivered by Ravtic LLC. Remote support is available worldwide. In more than 20 years we have supported more than 1,200 businesses, and our managed IT support is available on flexible contracts from 3 to 24 months, with many services also offered on a rolling month-to-month basis.

The government is asking households to prepare quietly, before anything happens. Businesses should do the same. If you aren't sure how your IT would hold up over three bad days, a resilience review is the place to start.