Business Continuity Planning Basics

Information only — not legal advice.

Business continuity planning starts with the work people must keep doing when a building, person, supplier or digital service becomes unavailable. A backup is one possible resource; the plan also needs decisions, contacts, priorities and a workable way to operate during disruption.

Begin with a small number of important activities rather than a long list of applications.

Set recovery priorities in business terms

For each activity, identify its owner, users, deadlines, dependencies and the impact of interruption. Include identity services, communications, specialist people, documents and external providers—not just the main application.

Two useful planning targets are:

• Recovery time objective (RTO): the target time within which the activity or supporting service should be restored.
• Recovery point objective (RPO): the point in time to which data must be recovered, expressed as tolerable data loss in time.

These are requirements to validate against actual capability, not promises created by writing a number in a plan. A four-hour RTO is implausible if obtaining the necessary access takes a day.

Example: an unavailable project workspace

In this fictional exercise, a site team loses access to its document service before a planned inspection. Its priority is safe access to the approved inspection package and a reliable way to record findings.

The fallback uses an authorised offline package with a visible revision and issue date. The team confirms that it remains valid, records new findings in a controlled temporary register and identifies who will reconcile those records when service returns. If the information cannot be verified as suitable for the activity, the plan identifies who can stop or reschedule the work.

This is more useful than telling everyone to “use downloaded files,” which could encourage reliance on superseded drawings.

Prepare the minimum usable plan

1. Define the event that activates the plan and the person authorised to do so.
2. Keep current contacts and an alternative communication route accessible during the outage.
3. Describe the minimum service or safe fallback, with its limitations.
4. Identify recovery dependencies, access credentials and responsible people.
5. Explain how temporary work is reconciled and normal service is declared restored.

Protect emergency access information appropriately. A continuity document should point to a controlled recovery mechanism, not expose passwords to everyone who reads it.

Exercise the assumptions

Run a discussion-based exercise with the people who would act. Then test important technical steps in a safe environment: retrieving a backup, opening restored records, accessing the alternate communication route and reconciling temporary entries.

Record observed recovery times, data gaps and decisions. A successful backup job does not show that a full restore will work. A tabletop discussion does not prove a technical recovery target has been achieved. Both exercises are useful when their evidence is described accurately.

Improve after each test

Assign gaps to owners and repeat the affected step after correction. Review the plan when suppliers, key staff, technology or business priorities change.

NIST SP 800-34 Rev. 1 provides an established reference for information-system contingency planning; its federal-system context should be adapted to your organisation. Pair this article with vendor management and incident management.

Important information

This article provides general information and does not constitute legal advice or replace a qualified professional's assessment of your circumstances. Laws, official guidance, standards and product features can change. Check current primary sources and the requirements applicable to your jurisdiction, contract and project before making decisions. Examples illustrate the discussion; they are not official rulings or instructions for a particular case. For legal decisions, consult a qualified lawyer; for technical or other specialist matters, consult the responsible professional.