Business continuity

The starting point is a business impact analysis, which answers which activities are critical, how long they may be unavailable before the damage becomes unacceptable, the target recovery time, how much data loss is tolerable and the minimum acceptable level of delivery. It also maps dependencies: people and skills, premises, ICT systems, suppliers and data. Without those figures, plans remain generic and unusable.

Strategies and solutions follow: redundant capacity, an alternative site or remote working, manual workarounds, alternative suppliers, stock holdings, and backup and restoration. Continuity plans define who activates them and when, who decides, how communication with employees, customers, authorities and the media is handled, and how the return to normal operations proceeds. Above this sits crisis management, which takes over when an event exceeds the anticipated scenarios.

A plan that is never exercised is merely an assumption. Testing ranges from document review and tabletop exercises to simulations and actual failover to alternative capacity; every exercise must produce findings that feed back into updated plans. Backups count only once their restoration has been verified, not when they are created.

Business continuity is not only good practice but a regulatory requirement: cybersecurity legislation requires it together with backup management and crisis management, while the framework for the financial sector requires an ICT business continuity policy and response and recovery plans along with their testing. The established management system framework is ISO 22301. Business continuity should be distinguished from disaster recovery, which concerns the restoration of ICT systems and is only one component of the whole.