When the office can't open Monday, what do you do?
Most continuity plans live in a binder nobody's read. We build plans that name names, identify the actual systems your business runs on, set real recovery targets, and get tested twice a year so leadership actually knows what to do when things go sideways.
Why most continuity plans don't work.
Plan written 3 years ago, never updated.
Half the people named no longer work there. Half the systems listed no longer exist.
Never tested.
Looks great on paper. Nobody knows if it actually works.
Generic template downloaded from the internet.
Doesn't reflect your business, your people, your real dependencies.
Leadership doesn't know what's in it.
Day of incident, they're reading it for the first time.
What's included.
- 01
Business impact analysis
Every function ranked by impact-of-downtime. Real numbers — hourly revenue, regulatory exposure, brand damage.
- 02
Recovery targets per function
Real RTO and RPO. Not aspirational. Aligned with what the business actually needs.
- 03
Named roles + responsibilities
Who calls who, in what order, with what authority. By name, with backup names.
- 04
System recovery runbooks
Each critical system has a step-by-step recovery procedure. Tested. Updated when systems change.
- 05
Communication plan
Internal staff, customers, vendors, regulators, media. Pre-approved messaging where appropriate.
- 06
Bi-annual tabletop exercises
Real scenarios run with leadership. Lessons learned. Plan updated. Repeat.
How we build a continuity plan.
- Weeks 1–2
Impact analysis
Interview business leads. Map every critical function. Score impact-of-downtime in real numbers.
- Weeks 3–4
Strategy + design
Recovery strategies decided per function. RTO and RPO set. Resources identified.
- Weeks 5–6
Plan documentation
Roles assigned by name. Runbooks written. Communication plans drafted.
- Week 7
Tabletop drill
Leadership team walks through a realistic scenario. Findings documented. Plan adjusted.
- Week 8
Final + handover
Plan finalized. Distributed. Stored in multiple accessible locations including offline.
- Ongoing
Bi-annual reviews
Twice a year: plan refreshed, drill conducted, lessons captured.
What feeds into the plan.
What we deliver.
Bi-annual minimum. Quarterly for high-risk firms.
Every revenue-critical system gets a step-by-step recovery procedure.
One executive owns the plan. Updates aren't optional.
Plan must be refreshed within 12 months. Tested twice per year.
“Our office flooded on a Wednesday. Tuesday we'd done a tabletop drill. The team knew exactly what to do. Operations back up in 6 hours. The drill saved us 3 days and probably six figures.”
Who needs this.
- Firms in regulated industries with mandatory continuity programs (financial, healthcare).
- Anyone whose business has hourly-revenue downtime cost in the four or five figures.
- Cyber-insurance applicants whose underwriting requires continuity testing.
- Firms recovering from a recent incident — write the plan so the next one isn't as bad.
Q01Is this the same as IT disaster recovery?
Is this the same as IT disaster recovery?
No — DR is a subset. Continuity covers people, communications, customers, vendors, premises, regulators. DR is what happens to the servers.
Q02How often should we test?
How often should we test?
Bi-annual is our standard. Annual is the regulatory minimum for most industries. Quarterly for high-risk firms.
Q03Can we do this without external help?
Can we do this without external help?
Yes — most don't. The reason they don't isn't capability, it's habit. External engagement forces the work to happen.
Q04Do you also run the plan during an actual incident?
Do you also run the plan during an actual incident?
We're available for crisis support during real incidents. Most clients keep a retainer for that scenario.
Free 60-minute continuity review.
Bring your current plan (or lack of one) to a call. We'll tell you honestly what's strong, what's missing, and what a real engagement would deliver.