A company with $10 million in annual revenue averages $40,000 per business day if you assume 250 trading days. Five days represents $200,000 of revenue exposure. That is a hypothetical planning input, not a prediction that every five-day outage costs $200,000.
Separate the parts of the impact
| Item | What to estimate | Avoid counting twice |
|---|---|---|
| Revenue exposure | Work or sales interrupted during the scenario | Some revenue may be delayed and later recovered |
| Lost contribution | Permanently lost revenue less avoided variable costs | Do not add full revenue and the same margin loss |
| Incremental recovery cost | External response, overtime, replacement and restoration costs | Count additional cost, not ordinary payroll twice |
| Contract and customer impact | Applicable commitments and evidenced customer consequences | Do not assume every incident creates a fine or lost customer |
An outage can affect one department, one application or a wider environment. Email being unavailable does not automatically mean every sale stops. Ask the owner of each process what work can continue, what can wait and what cannot be recovered later.
An illustrative scenario, with explicit assumptions
Suppose $200,000 of activity is exposed, 20% is permanently lost, and the contribution margin on that lost activity is 40%. The contribution impact would be $16,000: $200,000 × 20% × 40%. Add $15,000 of hypothetical additional recovery spending and the scenario totals $31,000 before any separately assessed contractual effects. Change any assumption and the answer changes. These are invented planning inputs, not client results or a benchmark.
The purpose of this exercise is to identify a decision. If the critical process can resume from a tested recovery copy within the required time, the exposure scenario changes. If nobody knows what restores, the estimate remains uncertain.
Choose improvements by the failure they address
- Identity: review privileged access, authentication policies and emergency access.
- Data: identify the workloads and permissions that matter to the process.
- Recovery: agree a safe restore scenario and measure what it actually recovers.
- Operations: name the person who sees an alert and the person who authorizes action.
A Microsoft 365 risk and ownership review can document findings and priorities. A controlled recovery validation tests an agreed Microsoft 365 workload. Neither should promise to eliminate every incident or guarantee a financial saving.
Know what you own, what it costs, and what to fix first.
You get a verified map of the systems, a named owner against each, the decisions in priority order, and next actions with prices on them. Leadership or another provider can act on it directly.