Senegal SME business continuity plan: 30-day program (2026)

BCP in Senegal SMEs 2026: why now

BCP (Business Continuity Plan) = set of procedures that let the company keep operating after a disaster. Not a nice-to-have, a business life insurance.

Senegal realities justifying a BCP:

• SENELEC: 4-12 outages / month by zone (Médina, Yoff, Almadies, Plateau differ), 2-20h duration.
• Rainy season: August-October, Dakar and suburb flooding, flooded premises.
• Cyberattacks: ransomware rising in Senegal (3 SMEs I've seen hit in 2024: Plateau pharmacy, Mermoz accounting firm, VDN import trade).
• Key employee loss: CFO / CTO resignation without handover = 2-6 weeks blockage.
• Fire: 14 Dakar market/office fires 2024 (ANSSI security bulletin).

Out of 100 SMEs I've audited, 8 had a written BCP. 0 tested it. BCP is the most poorly-leveraged ROI measure in SME cybersec.

H2: RTO and RPO — the 2 numbers to set

RTO (Recovery Time Objective): maximum acceptable downtime before resuming activity after an incident.

RPO (Recovery Point Objective): maximum acceptable data loss.

Senegal SME examples:

• Bakery / restaurant: RTO 24h, RPO 24h. Physical activity tolerates 1 day downtime.
• Accounting firm: RTO 4h, RPO 4h. Clients demand responsiveness, recent files critical.
• Wave/OM e-commerce: RTO 1h, RPO 15 min. Each hour of downtime = ~5-50 KFCFA revenue lost by volume.
• Clinic: RTO 2h, RPO 1h. Patient records critical, ongoing emergencies.
• Digital bank: RTO 30 min, RPO 5 min. BCEAO regulator requires <2h.

Lower RTO/RPO → more expensive BCP. Find the right balance per critical function.

H2: 3-2-1-1-0 backup strategy

Industry standard:

• 3 copies of critical data
• 2 different media (disk + cloud, or disk + tape)
• 1 offsite copy (cloud datacenter, other building)
• 1 offline copy (immutable, anti-ransomware)
• 0 errors during restore tests

Backup tools for Senegal SMEs

Common Senegal SME error: believing Google Workspace = backup. False. Workspace deletes trash at 30 days. Ransomware encrypts synced Drive. Always third-party backup.

H2: 5 BCP scenarios to document

Scenario 1 — Extended SENELEC outage (8h+)

• Detection: UPS monitoring, employee alert.
• Immediate action: switch to UPS (30 min autonomy), generator if applicable.
• Extended action: telework from home (each has personal inverter), failover data to cloud.
• Prevention cost: UPS 150-450 KFCFA, generator 800K-3.5 M FCFA, cloud subscription already existing.

Scenario 2 — Rainy season office flooding

• Detection: team calls.
• Immediate action: save critical equipment (NAS, servers on high shelves), telework switch.
• Extended action: backup co-working / shared office (Almadies, Plateau spaces: 50-150 KFCFA/day).
• Prevention cost: NAS on high shelf, backup co-working agreement.

Scenario 3 — Ransomware

• Detection: EDR alert, encrypted files detected, ransom note .txt.
• Immediate action (CRITICAL — 30 min): isolate infected machines (disconnect network), stop cloud sync (Drive/OneDrive), notify CIO + leadership + CDP/ANSSI by context.
• Extended action: restore from immutable offline backup, forensic audit, NEVER pay ransom (75% of paid cases = no working key).
• Prevention cost: 3-2-1-1-0 backup, widespread MFA, EDR (Microsoft Defender business, CrowdStrike).

Scenario 4 — Key employee loss without handover

• Detection: resignation, accident, illness.
• Immediate action: access audit (who has what), critical procedure documentation (reverse engineering), replacement hiring.
• Extended action: structured handovers among team members (shared Notion/Confluence documentation, runbooks).
• Prevention cost: 4-12h/month documentation per critical function, 0 EUR direct.

Scenario 5 — Fire / premises theft

• Detection: alarm, firefighters, police.
• Immediate action: insurance, CDP declaration (data theft = 72h notification), telework switch.
• Extended action: offsite backup restore, new infrastructure.
• Prevention cost: business insurance (200-1,500 KFCFA/year by coverage), MANDATORY offsite backup.

H2: 30-day BCP building program

Week 1 — Mapping

• D1-2: list critical business processes (sales, billing, payroll, delivery, customer support).
• D3-4: for each process: acceptable RTO / RPO, needed apps, needed data, needed people.
• D5-7: criticality matrix (impact × probability) → top 5 risks.

Week 2 — Strategy + tools

• D8-10: backup strategy choice (Backblaze + Restic, or Synology + cloud).
• D11-14: backup configuration, first full backup, restoration tests.

Week 3 — Written procedures

• D15-21: 5 runbooks (1 per scenario) — who does what, in which order, who to call. Stored Notion / Drive + paper version safe.

Week 4 — Tests + training

• D22-25: real backup restoration test (random file restored, validated).
• D26-28: tabletop exercise with leadership (simulated ransomware scenario, team reacts).
• D29-30: employee training (outage procedures, who to call on incident), quarterly review planning.

H2: Realistic costs SME 15-25 employees

SME 20 employees total: upfront ~3-8 M FCFA, recurring ~1.5-4 M FCFA / year. Compare with average incident cost (1 ransomware = 5-50 M FCFA in downtime + remediation).

FAQ

BCP and DRP, are they the same?

DRP (Disaster Recovery Plan) = technical subset of BCP (IT restoration after disaster). BCP = broader view (HR, premises, communication, customers, suppliers).

How long to maintain a BCP?

Quarterly review (1 day/quarter), annual major update. Monthly backup restoration test (automatable). Bi-annual tabletop exercise.

Who owns the BCP in an SME?

Ideally CEO signs BCP + CTO/CIO executes + one referent per direction (HR, Accounting, Sales). In micro-business: leader carries project, outsources technical parts.

Cloud-only SME without physical server: simpler BCP?

Yes, much. But still: SaaS backup (Google Workspace, Microsoft 365 don't backup indefinitely), telework procedures, account access incident handling (MFA recovery), team power continuity.

Can BCP be a contractual obligation?

Yes — large accounts (banks, telecoms, retail) now require BCP clauses in supplier contracts. Firm, agency, IT provider: having BCP = B2B tender selection criterion.

Let's discuss your case

If you want to build an operational BCP for your Senegal SME in 30 days, we can run the project and train the teams. WhatsApp +221 77 596 93 33.