What business continuity means in plain language
Business continuity is a company's ability to keep its critical processes running and keep earning during a disruption: a cyberattack, an IT failure, or the loss of a site, a supplier or key employees. Business continuity management (BCM) is the system that provides this ability: a list of critical processes, acceptable downtime, recovery plans, backup resources and regular exercises.
Failures, incidents and force majeure events happen to everyone, so the question is a practical one: when something important suddenly fails, how will the company keep working and earning?
You cannot prevent every accident. The task of BCM is to know in advance which processes are critical, how long the business can survive without each of them, and what exactly to do in the first hours after the hit so that you do not lose customers, money and reputation.
Real resilience starts with understanding where a hit will hurt cash flow most. IT comes next.
How BCM differs from IT backup and cybersecurity
This is the most common misconception: “we have an IT department and a cybersecurity specialist, so we are protected”. In fact these are different layers of protection, and one does not replace the other.
| Approach | What it covers | What it leaves open |
|---|---|---|
| Cybersecurity | Protecting data and infrastructure from attacks and leaks | What to do if the system stops anyway |
| IT backup and recovery (backups, DRP) | Restoring servers and data | Sales, supplies, people, communications |
| Business continuity (BCM) | Keeping the business working and earning in a crisis | — |
IT protects the infrastructure. But who is responsible for cash flow if the system stops anyway? BCM covers the whole business, beyond the servers: customers, suppliers, key people and money.
Why owners need it: the cost of downtime
Downtime is a concrete amount of money lost. While the business stands still, it earns nothing and still carries its costs: salaries, rent, obligations to customers. A stoppage is often followed by something that hurts more than the direct losses: customers leave for competitors and the reputation suffers.
So for an owner, BCM is a way to express risk in money: what one day of downtime of a key process costs, which scenarios can stop revenue and what to prepare in advance so that this does not happen. It is not paperwork for ticking a box.
Who needs business continuity
The short answer: any business for which a stoppage means lost money. But the approach is adapted to the size of the business:
- Small business (up to 50 people). The safety margin is smaller, and the dependence on one or two key people or suppliers is higher. The plan is compact: a few pages on the main scenarios.
- Mid-sized business. Supply chains, IT systems and regulatory requirements come into play. Here it is important to put numbers on how critical each process is and to set recovery times.
- Large companies and regulated industries. BCM is often required by standards (for example, ISO 22301) and by counterparties, exchanges and auditors.
What a continuity system is made of
One big document on a shelf is not a continuity system. A working system has several connected elements:
- Business impact analysis (BIA). We identify the critical processes and assess each one in money and in time: how long the company can survive without it.
- Business continuity plan (BCP). Step-by-step instructions of 2–3 pages for each scenario: who does what, by when, and what replaces the missing link.
- Disaster recovery plan (DRP). The IT part: how to restore systems and data, and the RTO and RPO targets.
- Exercises and testing. Only a live exercise shows what really works and what has stayed on paper.
Each element is covered separately: business impact analysis, business continuity plan, disaster recovery plan and exercises.
BCMS: what a business continuity management system is
BCMS stands for business continuity management system. The difference between BCM and BCMS is simple: BCM is the discipline, the subject people work on; the BCMS is the machinery through which a company manages that subject continuously rather than once. Russian documents use the abbreviation SMND for the same thing.
What the system is made of is set out above. The BCMS adds to those elements the thing that turns them into a system: the cycle.
| BCMS element | What it means in practice |
|---|---|
| Policy and scope | A signed document: which sites and processes are covered, and who is accountable |
| Roles and authority | Named people with the authority to declare a crisis and to spend money |
| Analysis and plans | BIA, risk assessment, continuity and recovery plans |
| Exercises and checks | An exercise schedule, reports, and a list of what did not work |
| Corrective actions | Findings from the previous cycle, closed with dates |
| Management review | Decisions by the chief executive at the end of the cycle, not a slide |
The requirements for such a system are set out in ISO 22301, and in banks the same role is played by the ONiVD plan and the related Bank of Russia procedures. A company with no certification obligations needs the system not for the audit but for one property: without the cycle, plans go stale within a year, and at the moment of disruption they are opened by someone who is not named in them.
Who is responsible for continuity in a company
The most common mistake is to put the IT director in charge. The logic is clear: systems are what stop most often, so let IT handle it. But the IT director has no authority to decide which process to restore first if there are resources for only one. That decision is about money and obligations to customers. It is not a decision about servers.
A working set-up looks like this. The process owner is the head of a business area who is responsible for a specific business process and knows what will happen if the process stops for a day. The process owner names the acceptable downtime and confirms it with their signature. The continuity coordinator is the person who puts the whole picture together, maintains the register and prepares exercises. In a company of up to a thousand people this is usually combined with another role. It is not a separate full-time position. The sponsor is a member of the management board or the owner, who protects the budget and settles disputes over priorities.
The crisis team is a separate matter. It is not the same people in the same roles. The team needs a decision-maker, a liaison with IT, a communicator and a person who keeps the event log. The team's membership and how it is convened are described in advance. Otherwise the first hours are spent working out who is in charge. More in the article on the company crisis plan.
How to tell a working system from a paper one
Documents can be bought or downloaded, and on the surface they will look decent. The difference shows in a few signs that are easy to check yourself.
- The business set the recovery time objective (RTO). If the RTO figures were set by a system administrator based on what the hardware can do, they describe the current state instead of a business requirement.
- The plan fits into the actions of the first hours. A thick document that nobody will open in a crisis is useless. A working plan starts with one page of specific steps.
- Exercises have been held, and something changed as a result. Exercises after which not a single item of the plan changed were most likely a formality.
- Backups have been restored as well as made. A copy from which no system has ever been restored is only an assumption. It guarantees nothing.
- External dependencies are covered. If the plan says nothing about suppliers, communication channels and contractors, its scope is incomplete. See the articles on supplier loss and single points of failure.
The crisis readiness checklist helps you check yourself quickly against all these points.
Resilience as the next step
Operational resilience is mentioned more and more often next to continuity. The difference is the starting point: continuity answers how to get back to work after a stoppage, while resilience requires that the service is never interrupted for longer than is acceptable. See the article operational resilience.
Terms you will come across
The topic has many English abbreviations, and they get in the way more than they help. Here is the minimum set. BCM is business continuity management, the whole system. BCP is the business continuity plan, a document about what people do. DRP is the disaster recovery plan, a document about restoring systems and data. BIA is business impact analysis, the procedure that determines how critical each process is. RTO is how quickly a process must be back in operation. RPO is how much data you can afford to lose, measured in time.
The article BCM, BCP and DRP: the differences explains the difference between the levels in detail, and the article how to measure business resilience covers measurable indicators.
Where to start
You do not need to order a big project straight away. Start with a quick self-assessment. It will show the resilience level of your business, the three main risk areas and the first concrete steps.
Take the 5-minute assessment →
Frequently asked questions
It is the answer to the question “what will we do tomorrow morning if the warehouse burns down or the server goes down tonight?” If the answer is written down, tested and known to people, you have continuity. If the answer is “we will figure it out”, you do not, however thick your documents are.
Five steps: a list of critical processes; the maximum tolerable period of disruption for each; a list of threats that can stop the process; a rating of probability and impact on scales; a decision on each risk: a plan, a backup, insurance or acceptance. The method, the scales and a template are explained in the article business continuity risk assessment (in Russian).
Yes. BCM is the English abbreviation for business continuity management. The Russian terms translate as business continuity management or operational continuity management. In banking documents the same thing is called operational continuity and recovery (ONiVD).
Yes, the ERGP certification course: 123 chapters, six modules, start on any day. The programme and terms are on the “ERGP certification” page.
No. BCM, business continuity management, is the subject itself: managing continuity. BCMS, business continuity management system, is the management system through which a company runs that subject: policy, roles, plans, exercises, review. In Russian a BCMS is called a continuity of operations management system, SMND. Saying business continuity management, BCM, is correct; implementing a BCMS means starting the cycle, not writing a plan.
Where should you start with BCM implementation?
With a quick assessment. Then you list the critical processes and calculate the cost of one day of downtime. After that you write the plan and run exercises.
Where to start with business continuity
13 questions and 5 minutes will show your readiness level. Then there are two paths: work it out yourself through the programme, or build the system with us.
Continuity basics
This is the core page of the section. Below are the other materials in the section. They cover specific parts of the topic.
- Operational continuity and going concernTwo meanings of one Russian term: a reporting principle and operational continuity
- BCM, BCP, DRP: the differencesManagement levels, a comparison table and examples
- The IT department does not protect the businessWhy antivirus software and a system administrator cannot save you from a stoppage
- BCM for the board of directorsHow to justify the investment in the language of money and risk appetite
- Operational resilience: what it is and how it differs from continuityContinuity of service for the customer and impact tolerance