The Plain English Version
Business continuity is how your organisation keeps operating during and after a disruption - whether that is a cyber attack, natural disaster, pandemic, or any event that threatens normal operations.
It is broader than IT disaster recovery. Business continuity covers your entire operation: people, premises, processes, suppliers, and technology.
Business Continuity vs Disaster Recovery
Business Continuity: Keeping the entire business running - staff, operations, communications, everything.
Disaster Recovery: Specifically recovering IT systems and data.
DR is a component of BC. You need both.
What a BC Plan Covers
- Critical functions - Which activities must continue? In what order?
- People - How will staff work? Who makes decisions?
- Premises - What if you cannot access your building?
- Technology - How will you access systems and data?
- Suppliers - What if key suppliers are affected?
- Communications - How will you reach staff, customers, stakeholders?
Key Metrics
RTO (Recovery Time Objective): How quickly must each function be restored? Finance might need 4 hours, marketing might tolerate 3 days.
RPO (Recovery Point Objective): How much data loss is acceptable? This determines backup frequency.
Testing Matters
An untested plan is just a document. Regular exercises - tabletop discussions, walk-throughs, and full simulations - reveal gaps and build confidence. When a real incident hits, you want muscle memory, not people reading a plan for the first time.