The Minimal Viable Company: The Foundation Every Business Continuity Programme Needs
The article at a glance
In this article, one of Bell's subject matter experts, Shaun Fuller, explores defining a minimum viable company, i.e what is the least you need to keep your business alive during a major disruption.
When disruption strikes, whether a cyber security incident, a critical systems failure, or operational crisis, organisations rarely fail to meet recovery times because they lack a recovery plan. They fail to meet the recovery times because no one has agreed on the business priority. Cyber security and IT teams work to restore all the Services, Systems and Applications, whilst the business waits for the things that actually matter.
Defining your Minimal Viable Company resolves that problem. It establishes the absolute minimum set of people, processes, technologies, facilities, and supplier relationships required to keep the organisation operating, meet its obligations, and needed to remain as a going concern during significant disruption. In short: what is the least we need to keep this business alive?
The defined minimal viable company ensures that the cyber security teams and IT teams focus and efforts during a major disruption are to restore ‘What the business actually needs’.
The Risk of Recovering Without Prioritisation
Without a defined Minimal Viable Company, organisations responding to a major incident typically fall into one of two traps:
- Over-recovering: Restoring non-critical functions whilst genuinely critical services remain offline.
- Under-recovering: Failing to prioritise essential capabilities, leading to financial loss, regulatory breach, or contractual failure
Consider the Maersk NotPetya malware attack in 2017, in which it is reported that 45,000 PCs and 4,000 servers were recovered in approximately ten days. Whilst widely described as a remarkable effort, the Minimal Viable Company question must be asked: were all of those assets genuinely required as the priority?
The Five Pillars of the Minimal Viable Company
A robust Minimal Viable Company is built across five interdependent pillars, each requiring assessment, definition, and validation:
- People — Who must be available, and what succession arrangements exist?
- Processes — Which activities are essential, and what manual workarounds exist for technology-dependent tasks?
- Technology & Data — Which systems and data sets are non-negotiable, with RTOs and RPOs aligned to genuine business need?
- Facilities & Physical Environment — Where can the business operate from if primary sites are unavailable?
- Suppliers & Third Parties — Which external relationships are critical, and where do single-source dependencies exist?
Making the Minimal Viable Company Work in Practice
The S-RM 2026 Cyber Security Report advises that cyber incidents rarely remain technical events. They rapidly become business continuity challenges. Incident response plans must therefore be tightly integrated with business continuity and disaster recovery frameworks. Recovery priorities should be driven by business‑critical services, and not just systems.
The Minimal Viable Company should be defined through structured workshops with senior leadership, operational managers, and subject matter experts. It requires cross-functional input, executive sponsorship, and formal board-level approval. The Business Impact analysis (BIA) ensures critical business activities, the minimum resources to sustain the business activity, recovery point and time objectives are derived from business need and not based on IT or departmental assumptions.
Critically, this is not a one-time exercise. The Minimal Viable Company should be reviewed at least annually, and immediately following any material change to the organisation’s structure, services, technology, or risk profile.
A well-defined Minimal Viable Company transforms abstract resilience concepts into a concrete, agreed, and actionable foundation — one that every person involved in incident response can act upon with clarity and confidence.
Bell Integration stands ready to help organisations build business continuity and disaster recovery programmes that work in the real world for your organisation.
Strengthen your cyber resilience, mitigate risk and contain attacks in your enterprise
Our end-to-end adaptive cyber security services enable you to outsource all or part of your cyber security function. In addition to an extensive suite of managed services that release your IT teams from having to do any heavy lifting, our comprehensive offerings also include cyber security strategy and advisory services that help you strengthen your defences and improve your security posture, identify and manage risks, and comply with regulations. Learn more.
To learn more about our cyber security services, get in touch with Billy Weatherall, Sales Specialist Manager at bweatherall@bell-integration.com or +447785 311652.
Shaun Fuller
Risk and Compliance Manager, Consulting Services, Bell Integration
Shaun Fuller is a resilience and risk professional with over seven years of experience at Bell Integration, advising clients across multiple sectors on regulatory compliance, Business Continuity, and Disaster Recovery planning and management. Prior to Bell Integration, Shaun held senior leadership positions within financial services, gaining broad experience in IT Operations, data centre services, and compliance across the UK, Europe, and Asia. This international background has given him a strong understanding of complex regulatory landscapes, operational risk frameworks, and the resilience challenges faced by enterprises organisations. Shaun holds the Certified in Risk and Information Systems Control (CRISC) and Certified Information Systems Auditor (CISA) certifications at Gold level, awarded by ISACA, reflecting his technical expertise and commitment to the highest standards of professional practice.
