First
Services first
Start from the services customers depend on, not from the systems that run them.
Business continuity planning explained
Keep the services that matter running when something goes wrong.
What business continuity is, how the planning lifecycle works, how to run a business impact analysis and test a plan, and the point where a continuity programme becomes operational resilience. Written for operations, risk and resilience teams in regulated and mid-size organisations.
What is business continuity?
Business continuity is an organisation's ability to keep delivering its most important products and services at an acceptable level during a disruption. Business continuity planning is the work that makes that ability real before it is needed.
Limit
Tolerances
Decide how long each service can be down before the harm becomes intolerable.
Proof
Tested
A plan that has not been exercised is a hypothesis.
What is business continuity planning, and how is it different from a plan?
Business continuity planning is the process: deciding which services matter most, working out what they depend on, agreeing how long each can be down, choosing how you would keep them running or bring them back, writing that down, and proving it works. The business continuity plan is one output of that process, the document a team reaches for when something fails.
The distinction matters because most organisations have the document and far fewer have the process. A plan written once and filed describes the business as it was. Planning keeps the picture current as suppliers change, systems move and people leave.
Business continuity management is the programme that runs planning continuously, with an owner, a budget and a review cycle. ISO 22301, the international standard, calls it a business continuity management system and treats the plan as one clause among many. You do not need to certify against the standard to borrow its shape.
If what you need is the document itself, what a business continuity plan must contain sets out the ten sections, the question a regulator asks of each, and a worked example marked up for its gaps.
If you are choosing a tool to run it, how to choose business continuity software covers what it does and the questions to ask a vendor.
Why continuity planning is back on the agenda
ASD, 2024-25
6 min
how often a cybercrime is reported in Australia, on average
ASD, 2024-25
$81k
average cost of cybercrime to a business, up 50% on the year
ASD, 2024-25
1,200
serious cyber incidents ASD responded to in 2024-25, up 11%
Cyber and supplier disruption now arrive faster than annual reviews, which is why regulators in Australia and the UK ask for continuity to be planned, tested and kept current.
Why it matters
Why does business continuity matter?
Customers keep what they were promised. Payments clear, claims get paid, members can reach you. Continuity planning decides which of those promises come first when you cannot keep them all.
Regulators now ask to see it. APRA's CPS 230 requires a credible business continuity plan with a testing programme. The FCA's PS21/3 expects firms to stay within impact tolerances for their important business services. Both treat continuity as evidence, not intent.
Suppliers fail on their own schedule. A growing share of disruption arrives through a third party. Planning maps those dependencies before the outage does.
The business continuity lifecycle
Six stages, in the order ISO 22301 and the Business Continuity Institute describe them. Most organisations are strong at stage four and thin everywhere else.
Programme and policy
An owner, a scope, a budget and a statement of what the organisation will protect. Without this the rest is a side project.
Business impact analysis
Which services matter most, what each depends on, and how long each can be down before the harm becomes intolerable. The numbers every later stage uses.
Strategy and options
How you would keep each service running or bring it back: alternate sites, manual workarounds, second suppliers, spare capacity. Chosen against the tolerances from stage two, not guessed.
Plans and procedures
The documents a team runs under pressure. What a plan must contain covers the ten sections and the questions each must answer.
Exercising and testing
Walkthroughs, simulations and live tests against severe but plausible scenarios, with a record of what broke and what was fixed.
Review and improvement
At least annually and on material change. Lessons from real incidents and from tests go back into stages two to four.
See continuity planning inside RunReady
Drova RunReady
Critical services, dependencies, tolerances, tests and the plan itself, kept in one place and kept current.
What is a business impact analysis?
A business impact analysis is the exercise that identifies the services that matter most, what each one depends on, and how quickly each has to recover before the harm becomes intolerable. It produces the numbers the rest of the programme uses.
What it produces
- Critical services. The handful of services whose disruption would cause intolerable harm to customers, the organisation or the market. Regulators call these important business services (FCA) or critical operations (APRA).
- Dependencies. The people, systems, data, premises and suppliers each critical service relies on.
- Recovery time objective. How quickly a service must be back.
- Recovery point objective. How much data loss is acceptable.
- Maximum tolerable period of disruption. The point past which the harm is intolerable. In the regulatory vocabulary, the impact tolerance or tolerance level.
How to run one
- List the services you provide to customers and the market, not the departments that provide them.
- For each, describe the harm if it stopped, over an hour, a day and a week.
- Set the maximum tolerable period of disruption, then the recovery objectives inside it.
- Map what the service depends on, down to the supplier.
- Rank the services. The ranking is the planning priority for everything that follows.
A business impact analysis is not a one-off. ISO 22301 asks for it to be reviewed at planned intervals and after significant change; CPS 230 and PS21/3 both expect the critical services and tolerances it produces to be kept current.
How do you test a business continuity plan?
At least once a year, after any material change, and against scenarios severe enough to find something. A test that confirms the plan reads well tells you the plan reads well.
Three kinds of exercise, in rising order of effort
- Walkthrough. The response team reads the plan against a scenario and talks through each step. Finds gaps in roles, contacts and sequence. Half a day.
- Simulation. The scenario unfolds in stages and the team responds in real time, with injects. Finds gaps in decision-making and communication.
- Live test. A real failover, a real supplier switch, a real evacuation. Finds gaps nothing else will. Rare, planned, and the only one a sceptical regulator fully believes.
What a test has to produce
- The scenario, the date, who took part.
- Whether each critical service stayed within its tolerance.
- What broke, what was fixed, and what changed in the plan because of it.
Under PS21/3 this is the scenario testing the FCA expects firms to run against their impact tolerances. Under CPS 230 it is the testing programme whose results reach the board. For everyone else it is the difference between a plan and a hope.
Business continuity, disaster recovery and operational resilience
Three terms that overlap enough to be confused and differ enough to matter.
- Business continuity is about the services. How does the organisation keep delivering, or restart delivering, what customers depend on.
- Disaster recovery is about the technology. How are systems, data and infrastructure restored after a failure. A disaster recovery plan usually sits inside or beside the continuity plan.
- Operational resilience is the outcome. Which services must not stop, how long each can be down, what they depend on, and whether you have proved you can stay inside that limit. Continuity and disaster recovery are two of the ways you get there.
Operational continuity is the phrase people use when they mean business continuity applied to day-to-day operations rather than to the organisation as a whole: keeping a plant, a branch or a service line running through a disruption. It is the same discipline at a smaller scope.
Continuity under PS21/3 and CPS 230
Two regulators, one expectation
Both regimes expect continuity to be planned around critical services and tolerances, tested, and kept current. Each page sets out what its regulator asks for in full.
Where continuity planning fits in operational resilience
Continuity planning asks how you would recover. Operational resilience asks which services must not stop, how long they can be down before the harm is intolerable, and whether you have proved it. The first is a programme. The second is the standard it is now held to.
In the UK, PS21/3 has required firms to identify important business services, set impact tolerances, map dependencies and test against severe but plausible scenarios since 31 March 2022, with the transitional period over since 31 March 2025. In Australia, CPS 230 has been in force since 1 July 2025 and names business continuity planning as one of its three pillars beside operational risk management and service provider management. In the EU, DORA asks financial entities for an ICT business continuity policy and plans as part of their ICT risk management framework.
The common thread is that a continuity programme is no longer judged on whether it exists. It is judged on whether the services it protects were the right ones, whether the tolerances were set and tested, and whether the dependencies were mapped. Operational resilience explained covers that standard in full.
How RunReady supports continuity planning
RunReady is the operational resilience module of Drova's RunGood platform. It identifies what is critical to your business, maps where you are exposed and helps you prepare for disruption, aligned to APRA's CPS 230 and the FCA's PS21/3.
- The business impact analysis, as a living map. Critical services linked to the people, systems and suppliers they depend on, with the tolerances beside them.
- Scenario testing against tolerances. Run a severe but plausible scenario against a service and keep the result next to the plan it tested.
- Plans, owners and review dates in one place. The continuity plan sits with its evidence, and review and test dates are tracked as tasks rather than remembered.
FAQs
Business continuity planning, answered
What is business continuity?
An organisation's ability to keep delivering its most important products and services at an acceptable level during a disruption, and the planning that makes that possible.
What is business continuity management?
The programme that runs continuity planning continuously, with an owner, a scope, a review cycle and a testing programme. ISO 22301 describes it as a management system.
What is the difference between business continuity planning and a business continuity plan?
Planning is the process of deciding what matters, what it depends on and how it would be kept running. The plan is the document that process produces. What a business continuity plan must contain covers the document.
How often should a business continuity plan be reviewed and tested?
At least once a year and after any material change to the business, its suppliers or its systems. Regulated firms are held to that as a minimum.
Who owns business continuity?
An executive sponsor is accountable, usually the chief operating officer or chief risk officer. A named owner runs the programme and each critical service has a function lead who owns its part. Under CPS 230 the board is ultimately accountable; under PS21/3 senior managers carry the responsibility.
How is business continuity different from disaster recovery?
Continuity covers the services and how they keep running; disaster recovery covers the technology that restores systems and data. The disaster recovery plan usually sits inside the continuity plan.
What is operational continuity?
Business continuity applied to day-to-day operations, such as keeping a site, branch or service line running through a disruption. Same discipline, narrower scope.
Do small organisations need business continuity planning?
Yes, at a scale that fits. A short plan built from one of the free government templates, reviewed once a year, is better than none. The plan page links the UK and Australian government templates.
Ten sections, the question a regulator asks of each, and a worked example marked up for its gaps.
Start with what the plan has to contain
Operational resilience hub
Explore related topics
Business continuity plan: what it must contain
The ten sections, the regulator's question for each, and a worked example.
Business continuity software
How to choose it, and when operational resilience software fits better.
Operational resilience explained
The standard continuity is now held to.
FCA operational resilience
What PS21/3 requires of UK firms.
APRA CPS 230
What CPS 230 requires of Australian entities.
Impact tolerance
Set the limit a service must not cross.
Scenario testing
Exercise the plan to find the gaps.
Important business services
Decide which services the programme protects first.
DORA
The EU regime's continuity expectations.
