Business continuity
Continuity planning beside your risk and incident records
ISO 22301, DORA and NIS 2 all expect a business impact analysis, recovery objectives, tested plans and a record of what happened when a plan was used. Certifyi keeps continuity work in the same workspace as your risk register, incidents and suppliers.
In short
A continuity programme is the impact analysis, the plans, and the exercises that show the plans work. Certifyi keeps that work in the same workspace as the risks, incidents and suppliers it depends on. Book a demo to see the continuity module on an example programme.
Business impact analysis
Every continuity programme starts by agreeing which processes matter most and how long each can be down. ISO 22301 clause 8.2.2 asks you to assess the impact of disruption over time and set the timeframe for resuming each prioritised activity.
For each critical process, a BIA usually records:
- RTO. The recovery time objective: how quickly the process must be running again.
- RPO. The recovery point objective: how much data, measured in time, you can afford to lose.
- MTPD. The maximum tolerable period of disruption, after which the damage becomes unacceptable.
- Minimum service. What the process must still deliver while it recovers.
- Dependencies. The systems, people, suppliers and sites the process needs.
Dependencies and suppliers
Plans usually fail on a dependency nobody wrote down: one database behind three critical processes, or one supplier behind half of them. Mapping dependencies is slow work, and it is what turns a BIA into something you can plan from.
Continuity and recovery plans
A plan an auditor will accept names its owner, says when it is invoked, lists the recovery steps, says who must be told and what resources are needed, and has been reviewed recently. Keep it short enough to follow under pressure.
- Activation criteria. The conditions that trigger the plan, and who can invoke it.
- Recovery steps. What to do, in order, with the person responsible for each step.
- Communication. Who must be told, inside and outside the organisation.
- Resources. The people, systems, suppliers and space the recovery needs.
Exercises
ISO 22301 clause 8.5 requires an exercise programme, and auditors will ask to see the report from the last one. Each exercise should record the scenario, who took part, what went wrong and the actions agreed. The usual formats are below.
| Exercise type | Effort | Typical length | What it tests |
|---|---|---|---|
| Tabletop | Low | One to two hours | Whether the plan makes sense when people talk it through |
| Walkthrough | Medium | Two to four hours | Each step of the procedure, in order |
| Full-scale | High | Half a day to two days | Live recovery under a simulated disruption |
When a plan is used for real
Record the decisions, actions and outcomes as they happen, then hold a review once things are back to normal. Track the actions from that review the same way you track actions from incidents and audits, so they are followed up.
In Certifyi, incidents follow a tracked lifecycle from first report to closure, in the same workspace as your continuity work.
Involve the process owners
Process owners know their dependencies better than the security team does. Asking each owner to review their own BIA and plan before an exercise or audit catches gaps early and spreads the work.
What ISO 22301 auditors usually check
A useful self-check before a certification or surveillance audit.
-
A current BIA
Reviewed at planned intervals and after significant changes to the business.
-
Plans that meet the objectives
The recovery steps in each plan can meet the RTO the BIA set.
-
Exercise evidence
Reports from recent exercises, with the actions raised and their status.
-
Supplier cover
Critical suppliers identified, and what happens if one of them fails.
Related modules
Continuity work draws on these modules: the assets and suppliers a process depends on, the risks that could disrupt it, and the incidents that set a plan in motion.
How Certifyi helps
Continuity work in your GRC workspace
What Certifyi gives a continuity programme alongside the rest of your compliance work.
-
One risk register
Continuity risks sit beside your other risks, with likelihood, impact, treatment and owner.
-
Incidents tracked to closure
Report, triage and close incidents in the same workspace as your continuity records.
-
DORA register export
Export your DORA ICT third-party register as xBRL-CSV.
Questions
Business continuity questions
Does Certifyi replace a dedicated BCMS tool?
That depends on what your current tool does. If the same team runs continuity, compliance, risk and incident response, keeping the records in one workspace saves reconciling them before each audit. Compare the two against your own requirements in a demo.
Which standards is the module designed around?
ISO 22301. The same records also serve the continuity duties in DORA and in Article 21 of NIS 2.
What should a BIA record?
For each critical process: the impact of disruption over time, the RTO, the RPO, the maximum tolerable period of disruption, the minimum service during recovery, and the systems, people, suppliers and sites it depends on.
How often should we exercise our plans?
ISO 22301 asks for exercises at planned intervals and after significant change, without setting a frequency. A yearly exercise for each critical plan is a common baseline. Plans that matter most, or that have changed recently, deserve more.
Which type of exercise should we start with?
A tabletop. It costs a couple of hours and shows quickly whether the plan makes sense. Move to walkthroughs and full-scale exercises once the plan holds up in discussion.
See continuity planning beside your risk register
Book a demo to see how continuity work sits with your risks, incidents and suppliers in one workspace.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them