How to build a business continuity plan

Every organization is exposed to incidents that can bring its operations to a halt and get in the way of business continuity. That is why it needs plans with response actions to control those events and their effects, through a Business Continuity Plan or Management System.

How does a Business Continuity Management System help an organization?

Having a Business Continuity Management System in place gives the organization the ability to survive events that could have a negative impact and put its operations at risk: pandemics, cyberattacks, fires, earthquakes, floods and so on.

How do you build a Business Continuity Management System?

The common framework for implementing and maintaining a Business Continuity Management System is ISO 22301, developed and published by the International Organization for Standardization (ISO). The current version is ISO 22301:2019. The main implementation steps are:

1. Define the scope: identify which of the organization’s business processes the BCMS will cover.
2. Carry out a business impact analysis (BIA) of each process in scope to determine how critical it is. It covers:
   • criticality: by studying the different types of impact (operational, financial, legal, reputational, etc.) that an interruption of the business process would have as time goes on;
   • the time and resource requirements for keeping the activity going and getting back to normal: people, infrastructure, suppliers, services, machinery, technology, recovery times, maximum tolerable downtime, minimum service recovery levels, etc.
3. Carry out a risk analysis, which involves:
   • identifying the possible threats to assets that the organization is exposed to;
   • determining the risk level of each threat by assessing its likelihood and the impact it would have if it happened. A high risk should tell us that business continuity for that asset is a concern;
   • putting in place a risk treatment plan, with controls, usually preventive ones, that help reduce the likelihood of the threats.
4. Based on the results of the risk analysis, identify possible crisis scenarios and set the recovery strategy for each one.
5. Create and document detailed response and recovery plans for the critical scenarios identified, covering every step from reporting the incident to getting back to normal. The aim is to avoid indecision or improvised decisions that could make the situation worse or irreversible.
6. Run tests and exercises of the response and recovery plans to check that they really work and are fit for purpose. Each one produces a report with the results and any issues found.
7. Carry out reviews and audits of the management system to keep it maintained and up to date and to put corrective measures in place. This is how it keeps improving.
8. Awareness: put in place measures that raise staff awareness of business continuity and knowledge of the plans in place.

With a Business Continuity Management System in place, any organization, whatever its sector or size, can be ready to handle a security incident that could affect its operations, with more security and a better ability to respond to whatever happens. At GlobalSuite Solutions we offer the help and advice needed to implement a business continuity plan and achieve certification. We also have GlobalSuite® software, developed entirely by our team, which supports the implementation, management and maintenance of every requirement in ISO 22301 for organizations of all kinds and sectors.