Business continuity planning
Most business continuity plans are written once, filed, and first read during the incident. They assume the alternate site is ready, the generator has fuel, the backup restores and the people on the call list can get into the building. We build plans from what your operations actually depend on, then test those assumptions on site, so the plan works on the day you need it.
Who it is for
- Organizations writing their first business continuity plan, or replacing one nobody has opened in years.
- Teams preparing for ISO 22301 certification, or a customer, insurer or regulator asking for evidence of continuity.
- Financial entities in scope for DORA, and others whose regulator expects tested continuity and recovery.
- Operators of data centers, critical sites and single-site businesses where one building is a single point of failure.
Standards we work to
ISO 22301 readiness
ISO 22301:2019 sets the requirements for a business continuity management system, and is what organizations are certified against. Certification is issued by an accredited certification body; our work comes before that. We assess your system against the requirements, close the gaps, and check the evidence an auditor will ask for.
- Context, scope, leadership and the business continuity policy.
- Business impact analysis and risk assessment, following the method in ISO/TS 22317.
- Continuity strategies and solutions, plans and procedures, and the exercise program.
- Performance evaluation, internal audit and management review, using ISO 22313 as guidance.
DORA (EU financial sector)
The Digital Operational Resilience Act requires financial entities to keep an ICT business continuity policy, response and recovery plans, and backup and restoration procedures (Articles 11 and 12), and to test them. We assess and exercise the plans; ICT-specific testing is scoped with our Europe work.
Other frameworks
Continuity appears in most security frameworks: the Availability criteria of SOC 2, the Recover function of NIST CSF 2.0, the business continuity subdomain of Saudi Arabia’s NCA Essential Cybersecurity Controls, and ISO 27001’s controls for information security during disruption. One plan, mapped to each framework that applies, so you do not maintain five.
How we assess
- Business impact analysis: which activities matter most, how long each can stop, and what each depends on, down to the building, supplier and person.
- Risk assessment of those dependencies: fire, flood, power, loss of access to a site, a supplier failure, a cyber incident, and an intruder or insider.
- Recovery strategies: alternate sites, work from home, manual workarounds, spare equipment and supplier alternatives, each with a realistic time to stand up.
- The physical side most plans assume: whether staff can badge into the recovery site, generator fuel and contracts, where the keys and backup media actually are, and who can open the building at night.
- Crisis management and communications: who decides, who is told, and how when phones or email are down.
- Exercises: tabletop scenarios for leadership, walk-throughs of the plan, and live tests of a site evacuation, failover or relocation where agreed.
What you receive
- A business impact analysis with recovery time and recovery point objectives agreed with each activity’s owner.
- A business continuity plan, crisis management plan and site recovery procedures, short enough to use in an incident.
- An exercise report: what worked, what did not, and the changes to make, each with an owner.
- For ISO 22301: a gap assessment against each requirement, and the evidence pack an auditor will ask for.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. A first plan for a single site typically takes four to eight weeks, including the business impact analysis and one exercise. Gap assessments of an existing program take two to three weeks.
Common questions
Can you certify us to ISO 22301?
No. Certification is issued by an accredited certification body. We prepare you for it: the gap assessment, the missing pieces and the evidence, so the audit finds a system that works. We are independent of the certification bodies.
Is this the same as disaster recovery?
Disaster recovery is part of it: restoring IT systems and data. Business continuity covers the whole operation, including people, buildings, suppliers and the decisions made in the first hours. We cover both, and test that your recovery times are achievable, not just written down.
We already have a plan. Can you just test it?
Yes. We review the plan, run a tabletop exercise with the people named in it, and check its key assumptions on site. Most plans need changes after their first real exercise; you get a short list of them.
Why a physical security firm for continuity?
Because most disruptions are physical, and most plans fail on physical details: a recovery site nobody has a badge for, a generator with no fuel contract, backups stored in the same building. We check those on site, not on paper.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
Business continuity planning
We reply within one business day.
Nothing you send is shared outside Calibre.