Business continuity: definition

In short

Business continuity is not only about IT: it is about how the company keeps working when something breaks. The reference standard is ISO 22301, which describes a business continuity management system (BCMS). The operational document that follows from it is the business continuity plan (BCP).

How it works

A continuity programme follows a few steps:

• the Business Impact Analysis, which identifies critical processes and their recovery times (RTO and RPO);
• the assessment of the risks that could interrupt those processes;
• the strategies: alternative sites, remote working, backup suppliers, stock, manual procedures, backups and redundant infrastructure;
• the plan: who does what, in what order, with which contacts and which communications;
• exercises and review, because a plan that has never been tested is a hypothesis.

Disaster recovery (DRP) is the technical part: how systems and data are restored. The BCP is broader and covers people, processes, sites, suppliers and communication. A company can restore its servers perfectly and still be at a standstill because nobody knows how to tell customers.

Why it matters

Prolonged downtime is often the most serious damage an incident causes, more than data loss. The NIS2 Directive includes among its mandatory measures business continuity, backup management, disaster recovery and crisis management; ISO/IEC 27001 requires information security to be maintained during disruption too; the DORA regulation requires the financial sector to have tested ICT continuity plans. And many customers ask to see the plan in their supplier questionnaires.

Example

A manufacturing company is hit by ransomware that locks its management system. The BCP, tested six months earlier, provides for: production continuing on orders already printed for two days, delivery notes filled in on paper forms, orders taken by phone in a log book, a prepared message to the main customers. Meanwhile the CSIRT handles the incident and IT restores the systems in the order set by the BIA. Turnover that week drops, but deliveries do not stop.

After the incident the plan is reviewed: what worked, which contacts were missing, which times were optimistic. The review is part of the cycle set out in ISO 22301, not an extra.

Related terms

• BIA
• RTO and RPO
• CSIRT
• Residual risk