Business Continuity

Business continuity as a discipline studies how an organisation keeps its critical processes running when a resource — building, system, supplier, staff — is lost. It works with business impact analyses, recovery time objectives (RTO) and recovery point objectives (RPO), and with fallback strategies, independent of the incident that caused the loss.

FM often supplies the resource continuity depends on — the building, the data-centre cooling, access — and therefore needs to know the recovery time the organisation actually requires, rather than contracting a generic fallback site that does not match the critical processes.

• Which business processes are genuinely critical, and what recovery time do they require?
• Does the FM fallback facility deliver the functionality the critical process needs, or only square metres?
• Is the continuity dependency on a single supplier mapped, including that supplier's own chain?

• ISO 22301 — business continuity management systems.
• Business Continuity Institute (BCI) — Good Practice Guidelines.

• A fallback site without tested functionality is an insurance document, not a continuity provision.
• RTOs FM does not know cannot be passed through into its supplier contracts.

• Business Continuity & Resilience (the Part 3 capability): the operational execution — fallback provision, recovery procedure, test regime — that this discipline prescribes. The discipline determines what is needed; the capability delivers it.

• Business impact analysis
• Fallback and recovery planning

• Demand organisation

  The client role must set RTOs explicitly; without that requirement the supplier fills them in unilaterally.

• ISO 22301:2019 — business continuity management.

The standards section arrives in Part 7.

• Conflated with emergency management: continuity is about the process continuing, emergency management about the initial response to the incident itself. They follow one another but are not synonyms.
• A backup data centre labelled a continuity measure without the recovery process ever being tested.

The dependency of continuity plans on third- and fourth-tier suppliers (the supplier's supplier) is barely verifiable with current audit tools, and recent regulation such as DORA and NIS2 requires it without yet offering a sound methodology to support it.

• ISO 22301:2019, business continuity management.
• BCI Good Practice Guidelines.