12-point checklist
Tick what is already done:
- The 3–5 critical processes are identified: those the business cannot work without for a single day.
- The cost of one day of downtime of a key process is calculated.
- Recovery time objectives (RTO) and acceptable data loss (RPO) are set.
- Points of risk concentration are found (a single server/supplier/person/channel).
- There are short instructions for the first 2 hours after a disruption, on paper or in a messaging app.
- People responsible for decisions in a crisis are appointed.
- There are backups, and restoring them has been tested.
- Isolated (offline) copies exist in case of ransomware.
- There are backup suppliers and backup channels for reaching customers.
- A financial cushion for the downtime period is calculated.
- The team has run an exercise based on a disruption scenario.
- The plan has been reviewed in the last 12 months.
What to do next
Close the gaps in order of priority: first critical processes and instructions for the first hours, then redundancy and exercises. Details are in “How to write a BCP” and “Business impact analysis (BIA)”. For an accurate picture, take the free resilience assessment: 13 questions.
Frequently asked questions
How many “yes” answers mean the business is ready?
10–12 out of 12: high readiness. 6–9: medium, with gaps. 5 or fewer: high vulnerability, so start with the basic measures.
How is the checklist different from the assessment on this site?
The checklist is a quick self-check. The 13-question assessment gives your resilience level, the three main risks and the first steps, with the result shown on screen.
From the requirements of the standard to a working system
The assessment shows the gap between your documents and reality. Then the system is built either by your own team in the programme or by us as a turnkey project.
