What Is Business Continuity?

Business continuity is the capability to keep operating through a disruption. It is broader than technology recovery: it covers people, premises, processes, suppliers and communication, with systems as one component.

The distinction from disaster recovery is worth keeping. Recovery restores the technology; continuity is how the organisation functions while that is happening.

What a plan has to cover

How the work gets done without the systems — manual procedures, paper forms, reduced service levels. Who decides to invoke the plan and with what authority.

How people are contacted and coordinated when normal channels are unavailable. Where they work if premises are inaccessible. What customers, suppliers and regulators are told, by whom. And how the organisation returns to normal, including reconciling whatever was recorded manually.

Manual procedures are the substance

The most valuable part of most continuity plans is the documented, practised way of operating without the system. In healthcare that is paper charting and downtime forms; in manufacturing, manual production recording; in finance, an offline approval process.

These extend the tolerable outage considerably and cost almost nothing compared with the infrastructure needed to shorten recovery. They also atrophy — staff who have never used the paper process will not manage it under pressure.

Cyber incidents break continuity assumptions

Traditional planning assumed a discrete event affecting infrastructure: fire, flood, power. A ransomware event is different — it may affect every system simultaneously, including the ones holding the plan, and recovery takes weeks rather than hours.

It may also mean systems cannot be trusted rather than merely being unavailable, and that the recovery site is compromised too because it was connected. Plans written before that scenario frequently do not survive it.

Testing beyond the walkthrough

A discussion-based review finds gaps in the plan. A functional test finds out whether the manual procedures work, whether staff can follow them, and whether the reconciliation afterwards is achievable.

The most revealing tests are unannounced and partial: one department operating on the paper process for a shift. That finds problems no tabletop exercise surfaces.

Regulatory expectations are rising

Operational resilience requirements in financial services and several other regulated sectors now specify impact tolerances, mapping of important business services and evidence of testing — which is a considerably higher bar than holding a plan.

Where those apply, the plan has to demonstrate that the organisation can remain within a stated tolerance, which requires the impact analysis to be genuine rather than nominal.

Suppliers and the continuity you do not control

Where a critical process depends on an external provider, your plan has to account for their outage as well as your own. Their continuity arrangements become part of yours, and they are frequently not examined beyond a contractual availability figure.

The practical questions are what happens if that provider is unavailable for a day or a week, whether an alternative exists, and how long switching would take. Concentration risk matters too: several critical services resting on one provider is a single point of failure the contract does not describe.

Where to start

Ask one department how they would work for a day with no access to their main system. If there is no answer, that is the most valuable continuity work available to you.

See a 72-hour downtime plan and continuity and recovery together. GuardsArm delivers incident response planning.