Infrastructure · Infrastructure Resilience · 01
Business continuity planning
Business continuity planning establishes how the organization keeps its critical functions running, or restores them within an acceptable time, when a disruption removes people, premises, systems or suppliers. It is needed when no plan exists or the existing one was written for a different organization, when a customer, regulator or insurer requires a tested plan, when a recent disruption showed that recovery was improvised, or when the business has changed faster than its continuity arrangements. Planning produces a business impact analysis that identifies critical functions and their tolerable downtime, the recovery strategies for each, a plan written to the organization’s structure with roles and procedures, and the exercise and maintenance schedule that keeps the plan accurate.
Scope
What the review covers.
- Business impact analysis: critical functions, dependencies, tolerable downtime and data loss
- Recovery strategies for people, premises, systems and suppliers
- Plan structure: activation, roles, communications, procedures
- Integration with disaster recovery and incident response plans
- Exercise design and schedule
- Maintenance: ownership, review triggers, change control
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Business impact analysis | Critical functions, dependencies, objectives |
| Continuity plan | Activation, roles, procedures, communications |
| Recovery strategy set | Per function, with options and costs |
| Exercise and maintenance schedule | Owned and dated |
Prerequisites
What we need from you.
- Participation of function owners in the impact analysis
- The existing plan and any regulatory or contractual continuity requirements
- A sponsor with authority to accept recovery objectives
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
How is this different from disaster recovery?
Continuity covers the business: people, premises, suppliers and processes. Disaster recovery covers the technology that supports them. They are planned together.
Do you write the plan or help us write it?
We write it with your function owners, because a plan they did not shape is one they will not follow.
Will the plan satisfy our regulator or customer?
It is built to the requirement that drives it and includes the exercise records those parties expect to see.