Develop a business continuity strategy
A prolonged outage of the information system, the unavailability of a site, a ransomware attack, or the failure of a critical supplier do not have the same effects. Yet they all raise the same governance question: Can the organization maintain its priority activities at an acceptable level? To develop a business continuity strategy, therefore, it is necessary to go beyond simply producing a written plan and to make explicit choices regarding which activities to protect, which resources to preserve, and which decisions to make under constraints.
An effective business continuity strategy links business requirements to verifiable operational capabilities. It provides direction for business unit leaders, IT, cybersecurity, procurement, human resources, and crisis management. It must also be defensible before an auditor, regulator, or executive committee, with consistent assumptions, priorities, and evidence of preparedness.
Start with business challenges rather than solutions
Business continuity does not begin with the selection of a fallback site or the implementation of technical replication. These measures may be necessary, but they do not constitute a strategy in and of themselves. The starting point is understanding the consequences of a disruption on the organization’s missions, customers, regulatory obligations, contractual commitments, and reputation.
A Business Impact Analysis(BIA) provides a structured framework for this understanding. It identifies critical processes, their dependencies, the duration of an outage, and the minimum acceptable service levels. In particular, it helps define the maximum permissible downtime, often expressed as MTPD or MAO depending on best practices, as well as the recovery objectives specific to the resources in question.
This analysis must be conducted in collaboration with the business units, not solely based on questionnaires sent to managers. A process labeled “critical” without justification, identified dependencies, or a realistic recovery objective does not allow for the prioritization of investments. Conversely, an overly detailed BIA can delay decision-making without improving the organization’s ability to respond. The appropriate level of granularity depends on the organization’s size, its risk exposure, and its industry-specific requirements.
Set Consistent Business Continuity Objectives
Once the priority activities have been identified, the strategy translates business needs into measurable objectives. These objectives do not pertain solely to recovery time. They also specify the level of service to be maintained, the minimum processing volume, the necessary data, the required staffing levels, and the terms of communication with stakeholders.
A customer service department, for example, can continue to operate in degraded mode with reduced processing capacity and temporary manual tracking. Operations involving payments, healthcare, or industrial safety will often have a much lower tolerance for disruption. Business continuity, therefore, does not necessarily aim for an immediate return to normal operations; rather, it ensures continuity that is proportionate to the criticality of the operation and the consequences of an outage.
Objectives must be compatible with one another. A two-hour IT recovery objective is not sufficient if reference data, remote access, business procedures, or authorized personnel are not available within that same timeframe. This alignment between business continuity, the IT disaster recovery plan, cybersecurity, and crisis management is one of the key criteria for assessing the maturity of a system.
Determining the level of protection
Any ability to ensure continuity comes at a cost: redundancy, safety stock, alternative sites, telework solutions, supplier contracts, drills, and maintenance of operational readiness. The strategy must make these trade-offs clear.
An organization may choose accelerated recovery for its most critical processes, a more gradual recovery solution for important activities, and then deferred recovery for the rest. The key is that these choices be approved at the appropriate governance level. Without formal decision-making, business continuity objectives often become implicit, contradictory, or dependent on decisions made under pressure.
Building a governance structure that enables action
Developing a business continuity strategy requires a clear division of responsibilities. Senior management sets the risk appetite and allocates resources. Business unit leaders define operational priorities and approve continuity plans. IT ensures the restoration of digital services and infrastructure. Security, risk management, compliance, procurement, and human resources each contribute their specific requirements.
The business continuity manager should not be the sole custodian of the system. His or her role is to coordinate the process, consolidate analyses, monitor action plans, and flag any deviations. Responsibility for business continuity remains shared among process owners and custodians of critical resources.
A regularly convening steering committee is useful when it makes decisions: validating scopes, addressing unaddressed dependencies, accepting residual risks, scheduling exercises, and monitoring corrective actions. A governance structure that is limited to receiving dashboards does not reduce operational vulnerability.
Treating addictions, including external ones
Major incidents rarely result from a single failure. A critical operation depends on applications, data, facilities, expertise, telecommunications, service providers, power, and sometimes regulatory approvals. The strategy must identify these dependencies end-to-end and then determine which ones require a backup solution or a specific contractual commitment.
Suppliers are a particular area of concern. It is not enough simply to ask a service provider whether it has a business continuity plan. It is necessary to verify whether its recovery objectives align with the organization’s needs, whether responsibilities are contractually defined, and whether crisis communication procedures have been tested. For critical outsourced services, business continuity must be assessed as early as the selection phase, not only when an incident occurs.
Human dependencies require the same level of rigor. A procedure can be properly documented yet still be unworkable if it relies on a single person, on non-transferable authorizations, or on skills that are rarely used. Versatility, designated substitutes, and secure access to operational information are all part of the solution.
Formulate operational responses
Business continuity plans translate strategy into concrete actions. They must be designed to be used under pressure by people who may not have been involved in drafting them. Concise procedures, explicit activation criteria, up-to-date contact lists, and decision sheets are often more useful than a comprehensive document that is difficult to use.
The plan must cover activation, operation in degraded mode, crisis management, communication, recovery, and a controlled return to normal operations. Communication requires specific preparation: customer messages, notifications to authorities, instructions for employees, and coordination with partners. A technically effective response can lose its value if communications are delayed or inconsistent.
Alignment with the principles of ISO 22301 provides a useful framework for organizing this process. It helps integrate policy, risk analysis, BIA, continuity strategies, plans, exercises, and continuous improvement into a coherent management system.
Test the strategy before it’s needed
A plan that has not been tested remains merely a hypothesis. Exercises verify both the feasibility of the measures and the quality of decisions, escalation procedures, and communications. They should increase in complexity: literature review, technical test, tabletop exercise, crisis simulation, and then an operational exercise when conditions permit.
The goal is not to prove that everything works perfectly. A useful exercise reveals the gaps between the planned system and reality: unavailable access points, outdated contacts, overlooked dependencies, decisions that take too long, or unrealistic goals. These findings must lead to specific actions that are scheduled, assigned, and tracked until completion.
The frequency of testing depends on the criticality of operations, changes to the information system, organizational changes, and regulatory requirements. Following a major transformation, the introduction of a new critical tool, or a change in service provider, waiting for the annual testing cycle may not be sufficient.
Fostering continuity as a management skill
Business continuity cannot be maintained simply by updating a document once a year. It evolves alongside projects, process changes, new cyber risks, restructuring, and changes in suppliers. Targeted metrics make it possible to track coverage of critical activities, the completion of drills, the progress of actions, and the management of residual risks.
This discipline also relies on recognized skills. Professionals responsible for leading or auditing a program must be well-versed in the relevant standards, know how to conduct a BIA, challenge recovery objectives, and engage stakeholders. The training programs and certifications offered by DRI France meet this need for professional development by linking international methods to the operational realities of French and French-speaking organizations.
The value of a business continuity strategy is ultimately measured when the organization must make decisions, take action, and communicate in a disrupted environment. Preparing for these decisions in advance makes it possible to protect what matters most without having to improvise on matters that should already be under control.
This post is also available in:
