Library Business Continuity Planning: A Practical Guide

Every library faces disruptions. A server goes down. A pipe bursts. A ransomware alert arrives at 8 AM on a Monday. The question is not whether your library will face a disruption — it is whether you have a plan to keep essential services running when one arrives.

This guide introduces business continuity planning (BCM) for libraries and helps you decide what to document, who owns each piece, and how to test the plan so it actually works under pressure.

---

What is business continuity planning?

Business continuity planning (BCM) is the process of identifying which services your library must keep running, defining what you would do if each one failed, and documenting the steps clearly enough that any staff member could follow them in an emergency.

The international reference standard is ISO 22301, but most libraries do not need a full ISO-compliant management system. What you need is a short, practical document that:

• Lists your critical services and how long you can tolerate losing each one
• Describes what staff should do during common disruption scenarios
• Keeps contact information current and accessible
• Gets tested at least once a year

---

Why libraries need a BCM plan

Libraries occupy a particular position in a community. They often serve patrons who have no other access to internet, reference resources, or printed materials. A prolonged outage does not just inconvenience staff — it cuts off access for the people who need the library most.

At the same time, libraries typically operate with lean staff and limited IT resources. A BCM plan helps a small team respond quickly without depending on institutional memory that may not be available during a crisis.

Common disruption scenarios for libraries

Scenario	Frequency	Potential impact
Koha / ILS unavailable	Moderate	Staff cannot manage circulation
Internet outage	Moderate	OPAC, e-resources, email offline
Building closure	Low–moderate	All on-site services suspended
Power outage	Low–moderate	All systems down
Cyber incident	Low but rising	Data loss, credential compromise
Flood, fire, or storm damage	Low	Physical collection and hardware at risk
Key staff absence	High	Knowledge gaps, delays

---

The two questions that drive BCM

Before writing anything, answer these two questions for each service your library provides:

1. How long can we tolerate this service being unavailable before it causes serious harm?

This is called the Maximum Tolerable Period of Disruption (MTPD), or more practically, your downtime tolerance. Be realistic. Saying “zero tolerance” for everything is not useful.

2. What would we do instead if this service failed right now?

This is your workaround or fallback. If there is no answer — that is a risk to address.

---

Prioritising your critical services

Not all library services have the same urgency. A simple approach is to divide services into three tiers:

Tier 1 — Essential (restore within 4–8 hours)

• Circulation: checking items in and out
• Staff access to patron records (for holds, renewals, account queries)
• Public internet and computers (where the library is a primary access point)

Tier 2 — Important (restore within 24 hours)

• OPAC / catalogue search
• Email and patron notices
• Interlibrary loan processing

Tier 3 — Standard (restore within 2–5 business days)

• Cataloguing and acquisitions
• Reports and analytics
• Staff training systems

---

Manual workarounds: the backbone of continuity

A manual workaround is a low-tech fallback that lets staff keep working when a system is unavailable. Most libraries already have informal versions of these — the BCM plan makes them explicit.

Offline circulation

When Koha is unavailable, staff can record loans manually:

Date	Time	Patron card number	Item barcode	Item title	Staff initials

Koha itself includes an Offline Circulation plugin that works without a network connection and syncs transactions when connectivity is restored. This is the recommended workaround for Koha downtime.

OPAC unavailability

When the online catalogue is unreachable:

• Direct patrons to staff for assisted search using the staff interface (if still accessible on a local network)
• Maintain a short list of the most requested items at the desk
• Use a mobile hotspot for temporary staff connectivity if internet is the issue, not the server

Email notices suspended

If your notice system is down, note which patrons have upcoming due dates and call them directly for high-value loans. Suspend bulk overdue notices until the system is restored to avoid sending duplicates.

---

Koha and AWS: what KohaSupport manages vs. what you manage

Understanding the division of responsibility helps you know who to call and what to do first.

Layer	Who manages it
Physical AWS infrastructure	AWS
EC2 instance health and patching	KohaSupport (managed tiers) or you (self-service)
Koha application availability	KohaSupport (managed tiers) or you (self-service)
Database and backups	KohaSupport (managed tiers) or you (self-service)
DNS and domain name	You (with your registrar)
Staff credentials and passwords	You
Patron data and records	You
Local network and internet	You (with your ISP)

For a full breakdown, see Who Handles What: Self-Service vs. Managed AWS Responsibilities.

Contacting KohaSupport during an outage

If your Koha system is unreachable and you believe the issue is on the hosting side:

1. Check whether your internet connection is working (try another site)
2. Check whether you can reach your instance directly by IP (bypasses DNS)
3. Email [email protected] with your library name and a description of the issue
4. Note the time the issue started and any error messages you see

---

Five steps to a working BCM plan

Step 1: List your critical services

Write down everything your library does that patrons or staff depend on. Use the service table in the BCM plan template as a starting point.

Step 2: Set downtime tolerances

For each service, decide how long you can realistically operate without it. Involve department leads — they know their workflows best.

Step 3: Write your workarounds

For each critical service, write the specific steps staff would take if it failed. Be concrete: name forms, name contacts, name the fallback system.

Step 4: Identify your contacts

List emergency contacts for every external dependency: internet provider, AWS/KohaSupport, DNS provider, building facilities, insurance. Verify these annually.

Step 5: Test the plan

Run a tabletop exercise once a year: present a scenario (Koha is down at 9 AM), walk through the responses as a team, and identify gaps. Test your backup restoration at least once. Update the document after every real incident.

---

How to use the BCM template

KohaSupport provides a ready-to-use template that covers all the sections described here, pre-filled with Koha-specific guidance:

Library BCM Plan Template and Example →

The template includes:

• Document control section
• Critical services table
• Koha and AWS recovery information
• Scenario playbooks for the most common library disruptions
• Manual circulation form
• Staff communication templates

---

Further reading

• Koha Offline Circulation Plugin
• Koha Security Best Practices
• Koha Monitoring and Maintenance
• Who Handles What: Self-Service vs. Managed AWS Responsibilities
• ISO 22301: Business continuity management systems
• ALA Library Disaster Planning Resources