Insights · Field note · Infrastructure and resilience
Business continuity for critical-service operators
For an operator the public depends on, continuity is a promise made to people who did not choose to rely on it. The plan is owned by the business, not by IT.
Business continuity for a critical-service operator is the organized ability to keep the service running during a disruption: which processes must continue, at what level, with what people, facilities, suppliers and workarounds, under whose authority, while technology is restored. It is owned by executive and operational leadership, built on a business impact analysis that sets what the public and the regulator can tolerate, coordinated with disaster recovery so that technology restores what matters first, exercised with the leadership team, and documented so that regulators, insurers and the operator’s own customers can see it. ISO 22301 is the management system standard for it.
In detail
What the evidence shows.
The impact analysis
Which processes deliver the service. How long each can be disrupted before the consequence becomes unacceptable to the public, the regulator or safety. What each depends on: systems, people, facilities, suppliers. The analysis sets the tolerances that everything else must meet, and it is the business, not IT, that sets them.
Workarounds and people
How each critical process continues without its usual systems, for how long, with manual procedures, alternate facilities and cross-trained staff. Key-person dependencies identified and covered. Staff safety and communication planned. For operators, the workarounds are often the difference between a disruption the public notices and one it does not.
Suppliers and communication
Critical suppliers and their own continuity commitments. Alternates where a single supplier is a single point of failure. Communication plans for staff, customers, regulators and the public, with templates, because an operator is judged on how it communicates during a disruption as much as on the disruption itself.
Exercise and evidence
Leadership exercises the plan at least annually and after material change. Records of exercises, decisions and improvements are the evidence regulators and insurers ask for. The business continuity plan outline lists the sections; see business continuity planning and the critical-service operators industry page.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days