What is business continuity? Business continuity planning

Definition of business continuity

Business continuity is the advanced planning and preparation required to ensure that an organization can maintain essential operations in the event of a disaster, emergency, or other unexpected event that causes significant disruption. The planning and preparation for business continuity covers all people, processes, technologies, and supporting frameworks. 

The scope of business continuity planning includes not just internal functions, but also those of partners and other service providers. An effective business continuity effort is an ongoing process, with plans evolving and adapting to account for dynamic environments. 

The objective of business continuity planning is to take proactive measures that enable optimal organizational resilience. Beyond recovery strategies and plans to resume operations as quickly as possible, business continuity also includes risk management elements.  

Business continuity risk assessment and planning consists of an evaluation of potential losses and the resulting impact as this informs recovery approaches and priorities.

Business continuity identifies requirements and creates plans for many areas, including: 

• How to communicate with customers, vendors, and other third parties, along with what information they will need 
• How to provide products and services to customers  
• Roles and responsibilities of teams who will lead recovery efforts  
• Order and timing of recovery activities required to restore operations, taking into consideration process dependencies and documentation 
• How to support employees in various emergency events   
• Technology that should be in place to facilitate recovery, and how will it be accessed   
• Where interim operations will be set up in the event that primary locations are unavailable   

Business continuity triggers at a glance

Examples of events that can trigger the launch of a business continuity plan include:  –Cyber attacks  –Data breaches  -Equipment failures  -Fires  -Health emergencies and pandemics  -Legal issues  -Natural disasters  -Power outages  –Regulatory compliance issues  -Sudden staff departure  –Supply chain disruptions  -Terrorism

Why business continuity is important

Business continuity is important for all organizations that want to have the highest probability of coming through a major operational disruption intact with as little loss as possible. Savvy enterprises prioritize business continuity because they understand that it truly can be the difference between shutting down or resuming operations.  

Having a business continuity strategy and plan in place before an emergency situation occurs also: 

• Maintains competitive advantages 
• Preserves relationships with customers, employees, third-party partners, and vendors 
• Protects against legal or regulatory compliance issues 
• Saves organizations valuable time and money 

What is included in business continuity?

Business continuity varies by organization, but includes three core tenets: 

1. Contingency 
2. Recovery 
3. Resiliency 

Business continuity includes proactive measures to prepare organizations for an unexpected, disruptive event, such as: 

• Clear and comprehensive guidelines  
  • When the business continuity plan should be implemented  
  • What an organization must do to maintain or resume operations, including specific steps for what to do when faced with potential incidents (i.e., situations that could plausibly occur, such as an earthquake in California or a tornado in Texas)  
  • Who should be contacted with contact information 
• Defined levels of deploying a business continuity plan 
  • Define levels of response (e.g., low priority to mission-critical) 
  • Prioritize areas and assign a response level  
  • Establish expected recovery time objectives and recovery point objectives  
• Collaborative and transparent processes  
  • Plan development overseen by executive management 
  • Input sought from groups across the organization 
  • Business continuity plan executed by a defined team with functional leads for different areas (e.g., IT, communications, and sales)    

A carefully thought-out business continuity plan that includes detailed actions under each of the three core tenets (i.e., contingency, recovery, and resiliency) will expedite recovery and minimize damage and expense. 

Failure to include specific actions will result in extended downtime and its negative consequences.   

What is business continuity management? 

Business continuity management is the oversight of the execution of planning and response. Functions include:  

• Developing a plan that reflects this prioritization 
• Ensuring that an organization’s most crucial functions are maintained despite an incident 
• Prioritizing different business functions according to importance in a business impact analysis report 

An umbrella term, business continuity management integrates multiple incident response categories, such as:

• Crisis communication 
• Crisis management 
• Disaster recovery  
• Emergency response 

What is a business continuity plan?

A business continuity plan is the documentation for reacting to an unexpected, disruptive incident. The documentation provides specific direction and instructions for what should happen after an incident occurs. A business continuity plan ensures that the organization can operate with as little disruption as possible and meet the minimum thresholds for service delivery in a crisis. 

A commonly used business continuity framework

The ISO 22301:2019 Security and Resilience — Business Continuity Management Systems — Requirements framework is widely used for legal and regulatory certification of business continuity systems. The recommendations in ISO:22301 are deliberately generic, so they can be used by any organization regardless of the type, size, and nature of the organization. The application of the recommendations is driven by the complexity of an organization’s operations.   According to ISO 22301, a business continuity plan is defined as “documented procedures that guide organizations to complete the four R’s: Respond, Recover, Resume, and Restore to a predefined level of operations following disruption.”

Benefits of business continuity planning

Business continuity planning benefits and results are largely driven by the number of resources that contribute to the plan. This includes people, money, time, and systems.  

With the appropriate investments, benefits of business continuity planning that an organization can expect to realize include the following—these range from general organizational benefits to specific incident response and recovery benefits. 

General organizational benefits 

Adheres to legal and regulatory compliance requirements 
Having business continuity plans in place helps organizations meet their legal and regulatory obligations. Entities and regulations that require business continuity planning include:   

• All Central Banks  
• Federal Energy Regulatory Commission (FERC) 
• Federal Financial Institution’s Examination Council (FFIEC) 
• Financial Industry Regulatory Authority (FINRA) 
• Financial Services Authority (FSA)  
• General Data Protection Regulation (GDPR) 
• Health Insurance Portability and Accountability Act of 1996 (HIPAA)  
• Joint Commission on Accreditation of Healthcare Organizations (JCAHO) 
• North American Electric Reliability Corporation (NERC)  
• The International Regulatory Framework for Banks (BASEL III)  

Gains deeper visibility into the organization’s operations infrastructure and processes 
Undertaking the process of business continuity planning forces organizations to review and document all aspects of an organization’s operations infrastructure and processes, including people and their roles, as well as the types and locations of key systems and data. This information also supports strategizing and other areas of organizational development and planning. 

Increases awareness of the importance of business continuity preparedness 
The process of business continuity planning engages employees from across the organization and brings to the forefront risks and their role in prevention and recovery. Organizations with robust business continuity planning see a rise in awareness of and responsibility for risk management. 

Meets vendor requirements for business continuity planning 
Many customers require that organizations that provide essential products and services have a business continuity plan in place. Increasingly, these requirements include details that are only achieved with a carefully considered process.  

Taking time to create a business continuity plan helps streamline the onboarding of new customers. The plan also provides a competitive advantage by demonstrating an ability to quickly recover from a major incident with minimal impact on customers.  

Optimizes insurance coverage      
Developing business continuity plans helps organizations optimize their insurance coverage by accurately identifying, quantifying, and reducing risk. A business impact analysis (BIA) is used to identify the profit and losses as well as the costs that must be paid in the event of an incident that triggers an insured risk. This allows organizations to identify risks to help mitigate them as well as effectively determine how much and where insurance is needed.   

Protects reputation   
Business continuity planning helps organizations protect their reputations externally and with employees. Being prepared for whatever incident may happen helps protect against risks, such as cyber attacks, when it comes to delivering to customers, minimizing downtime, and reducing the cost of recovery. 

Incident response and recovery benefits

Confirms the right recovery systems are in place and ready to launch 
Business continuity planning ensures that the systems needed to restore operations after an incident are in place and ready to activate. This saves critical time that is lost without having the technology components of the operation set up and documented—from data backups to mirrored production systems.   

Ensures services or products are available for customers
The primary objective of proactive business continuity planning is to ensure that organizations can still operate at a capacity that allows them to deliver their products or services to customers in a timely fashion despite a major disruption. Organizations have appropriate ready-to-deploy responses to a variety of issues ranging from disruptive to catastrophic, allowing operations to resume quickly with minimal disruption for customers.

Identifies steps in business continuity processes proactively
Business continuity planning ensures that the critical response steps are well-documented and easy for everyone to understand. Taking the time for proactive business continuity planning brings clarity in a potentially chaotic time. Teams will be able to follow the business continuity plan to know what to do and when and to have an idea of expected recovery times based on estimates provided.   

Provides necessary support for employees 
An important benefit of business continuity planning is that it helps determine what employees will need in the event of different types of incidents.  

Keeping employees productive is critical to achieving business continuity and expediting the resumption of normal operations. 

Business continuity support for employees helps in a variety of ways, from providing access to information related to the response plans to alternative systems for them to use to conduct their daily tasks. 

Creating a business continuity plan

Effective business continuity plans share several characteristics, such as being:   

• Comprehensive
  The business continuity plan should consider as many potential incident or disruption scenarios as possible, as well as factors that could play a role in an incident and its response.
• Adaptable
  No business continuity plan can anticipate every incident that can happen, so the plan should be created in a way that it can be easily adapted to different or changing scenarios. 
• Realistic
  Time should not be spent developing sections of a business continuity plan for scenarios that are very unlikely to happen. 
• Efficient
  Those tasked with implementation should be able to execute the components of a business continuity plan efficiently. To do this, the plan needs to be clear and concise and provide the details needed for speedy execution (e.g., key contacts’ phone numbers).

The first stage of business continuity planning should be to conduct a business impact analysis (BIA) and risk assessment to gather key information to help direct and prioritize work. 

Business impact analysis for business continuity

Risk assessment for business continuity

-Reveals possible weaknesses  -Highlights the consequences of a disaster on various departments  -Identifies the most crucial functions and systems  -Facilitates communications with management to gain their support by providing data  -Defines what data is essential  -Establishes the acceptable amount of downtime for various systems and functions   -Determines what the recovery point objective should be

-Identifies all potential threats to an organization, such as cyber attacks, utility services disruption, natural disasters, or technology failures  -Directs risk mitigation strategies and implementations  -Assesses how risks could affect customers  -Estimates potential damage to reputation  -Determines the likelihood of risks

Key business impact areas should be identified and prioritized according to how important each is to recovery. Understanding these priorities helps organizations craft effective rapid-response strategies and tactics that consider not just the priority items, but all dependencies, and ensure that these are part of recovery plans.  

Areas to consider include: 

• Data and information 
• Infrastructure 
• People 
• Processes 
• Resources 
• Technology 

Work conducted to assess business impact informs the planning of an effective response. 

 A business continuity plan takes into account all aspects of business impact and provides specific guidance on how to prepare to avoid or mitigate it when an incident occurs. 

This includes describing actions that are needed and who is involved in implementation, as well as related resources (e.g., equipment or workspace) and timelines. These timelines explain not just how long each step should take, but also the acceptable downtime for each area.  

Core sections of a business continuity plan should include: 

• Purpose, scope, and users
  Why the business continuity plan was created, key objectives, areas covered, and target audiences  
• Reference documents
  Including a Business Continuity Policy, Business Impact Analysis, Business Continuity Strategy, Disaster Recovery Plan, and Risk Assessment  
• Assumptions
  Prerequisites for the business continuity plan to be effective
• Roles and responsibilities
  Key people required for the response to the incident and what they need to do, as well as who is in charge of the overall effort and specific areas
• Communication 
  • An overall communication strategy 
  • Contact information for incident follow-up, including internal comms leads, customers, partners, governing bodies, law enforcement, and press 
  • Pre-drafted emails, press releases, and social media posts 
• Plan activation and deactivation
  Scenarios when a business continuity plan should be activated and the conditions that need to exist to deactivate the plan
• Incident response
  First steps to take after an incident occurs to minimize damage  
• Plan to maintain operations
  Steps the organization needs to take to ensure key processes and systems remain operational or return to normal as quickly as possible, including the order for recovery activities
• Required resources
  A list of all the resources (e.g., employees, third-party services, facilities, infrastructure, data, and equipment) needed to recover, where they are, and how they will be reached

Business continuity success requires testing

No matter how simple or complex a business continuity plan is, it can only be successful with testing. Every component should be thoroughly examined and tested for viability, efficacy, and efficiency.  

A business continuity plan is not theoretical, and policies and procedures that sound effective when created in neutral times often will not provide the desired results when implemented. The only way to verify that the plan will be ready to guide a disaster response is to run real-world and tabletop exercises to find and fix flaws.  

Tests should be repeated on an ongoing basis to identify areas that need to be updated based on changes. Testing business continuity plans results in readiness, rapidity, and success when responding to the unexpected. 

You might also be interested in: