Business continuity

What it means

Business continuity is the work of keeping your important services going, or getting them back quickly, when something goes wrong. The disruption might be a cyber incident, a cloud outage, a supplier failure, a power cut or the loss of key people.

It is wider than IT. A plan names the services that matter most, how long each can be down, who decides what, how customers are told, and what people do while systems are unavailable. Disaster recovery is one part of it, focused on technology.

Why it matters

Customers judge you by whether the product works when they need it. An outage during payroll week or a sale costs revenue, and repeated outages cost contracts. Many enterprise buyers and regulators now ask for a written continuity plan and evidence that it was tested.

An incident is when untested plans fail. A plan that exists only as a document will not help at three in the morning. Standards such as ISO 22301 expect plans to be exercised and improved, and your incident response plan should fit with it.

How it shows up

Start with the services that earn money or carry legal duties. For each, set a recovery time objective and a recovery point objective, list the systems and suppliers it needs, and decide a workaround. Then run a tabletop exercise. Keep the plan short enough that people will read it under pressure.

Plans fail when contact lists are stale, when the backup tool is down with the system, when nobody knows who may declare an emergency, and when supplier dependencies were never listed. Review the plan after every major change and after every real incident, and keep a printed copy somewhere reachable.