Site & Business Unit Continuity Plan Template
One site's or business unit's plan for losing its building, a large part of its people, a supplier or its systems, with the first steps, the minimum resources and the vital records.
Available soon
- Format
- Word
- Size
- 75 KB
- Length
- 26 pages
- Version
- 1.1
- Updated
What's inside
- First steps of this plan
- About this template
- Legal note
- How to use this template
- The site or unit and what it carries
- When this plan starts and stops
- Who does what, and the call tree
- The four losses
- Minimum resources
- Vital records
- Telling people
- Returning to normal
- Testing and review
- Annex: the distributor's sites and units
- Adapting this template
- Framework references
- Definitions
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
First steps of this plan
Print this page and keep it at the site, with every copy of the plan, where the lead and the deputy can reach it at night. It is the first page because it is the one the lead needs first. The site or unit continuity lead takes these steps at once, without waiting for anyone; the crisis lead invokes the rest (RR-22, RR-17).
Do this | Who | Rule | |
|---|---|---|---|
1 | Make people safe. If the building or the situation is unsafe, get everyone out and account for every person at the assembly point, visitors included. Call the emergency services first if anyone is hurt. | Lead, or the deputy | RR-22 |
2 | Start the call tree. Hand the call tree (CP-3) to the deputy or the supervisors, so that everyone, the next shift included, hears what to do. | Lead, or the deputy | RR-22 |
3 | Call the crisis lead. Say which loss it is, what still works and what you need. No answer within 30 minutes: call the crisis lead's deputy. | Lead, or the deputy | RR-22; RR-17 |
4 | Keep the vital records at hand. Check that the vital records (CP-6) are safe. Take them with you only if it is safe to do so. | Lead, or the deputy | RR-22 |
5 | Ask whether it could be an attack. If it could be, tell the crisis lead so that the incident manager is called, and restart, reconnect or plug in nothing. | Lead, or the deputy | RR-07; RA-05 |
6 | Start the site log. Write down the time, what happened, who was told and each decision. | Lead, or the deputy | RA-16 |
7 | Get the response ready. Prepare the response to the loss (CP-4), and start it when the crisis lead invokes the plan. | Lead prepares; crisis lead invokes | RR-17; RA-04 |
EXAMPLE. At Warehouse 2 the lead is the Warehouse 2 Manager, the deputy the Warehouse 2 Shift Supervisor, and the crisis lead the Chief Operating Officer. The plan gives its first steps as:
- If the building is unsafe, get everyone out and account for them at the assembly point.
- Call the crisis lead and start the call tree.
- Check that tonight's printed pick lists are at hand, and tell the carriers.
- Start the site log: the time, what happened and who was told.
Never: speak to the press, customers or social media (only the communications lead does: RR-27, and P09 IM-09 in a cyber incident); reconnect anything the incident manager has cut off; or send anyone back into a building nobody has cleared.
About this template
This template is the form in which [[Organisation Name]] writes the continuity plan of one site or business unit, as the Business Continuity & ICT Resilience Policy requires (RR-22). A continuity plan is a site's or business unit's plan for keeping its part of the critical services running when it loses its building, a large part of its people, a supplier it relies on, or its systems (RR-22).
Write one plan for every site or business unit that a critical service needs: a warehouse, an office, or a team such as finance or customer contact. The site or unit continuity lead writes it and owns it. The policy owner approves it, after consulting the business owner of each service the site or unit carries and the resilience coordinator, and the crisis lead is told (RA-21).
The mistake this template exists to prevent: plans that cover the systems but not the building, the people or the suppliers. Give every site and unit a plan for all four losses (RR-22).
How it differs from a service's recovery plan
The Cyber Recovery Plan Template plans the recovery of one critical service: its objectives, its dependencies, the order its systems come back in, and the gates they pass. This plan does a different job. It keeps one site's or unit's part of several services running while the building, the people, a supplier or the systems behind them are lost, and it hands over to each service's plan for the recovery itself. It never repeats a service's recovery steps; it names the service's plan instead.
Which document answers which question:
Question | Answered by |
|---|---|
How long can each service be down, and how much data can it lose? | The Critical Service Recovery Objectives Matrix (RTO, RPO, MTD), from the Business Impact Analysis Questionnaire |
What does this site or unit do when it loses its building, its people, a supplier or its systems? | This plan |
How does a service come back after a destructive cyberattack? | That service's plan in the Cyber Recovery Plan Template, run by the Cyber Recovery Operating Procedure |
How is a failed system repaired, failed over or failed back? | The IT Disaster Recovery Procedure |
What do we tell staff, customers and suppliers? | The Outage Communications Template Set; in a cyber incident, P09's Incident Communications Template Set |
When a cyberattack is the cause
Classic disaster recovery assumes the systems you recover with can be trusted: fail over to the second site, restore last night's backup, and carry on. A destructive cyberattack breaks that assumption. Replication copies the damage to the second site, the attacker may have been inside for weeks before the encryption, and the sign-in directory and administrator accounts you would recover with may be the attacker's. Recovery then starts with the foundations, rebuilt from sources you can trust, and every system is checked before it goes back.
For a site or unit that means one thing above all. When its systems are lost to an attack, the Security Incident Management pack (P09) runs the incident, the site or unit works on the services' workarounds, and it reconnects only when the incident manager allows it. This plan quotes P09's rules and decisions by ID and changes none of them.
Legal note
This document helps you plan and test business continuity and recovery from a disruption, including a destructive cyberattack. It is not legal advice, and following it is not a statement that you comply with NIS2, DORA, the GDPR, HIPAA, ISO 22301 or any other law, standard or set of criteria. Which continuity and recovery duties apply to you depends on your sector and the law that applies to you: confirm them with counsel, your auditor or your supervisor.
The NIS2 Implementing Regulation (EU) 2024/2690 binds only the providers its Article 1 names, such as cloud computing, data centre and managed service providers; other entities may read its Annex as good practice. DORA binds financial entities only, and the entities of its Article 16(1) follow a simplified framework instead of its Article 11. HIPAA binds covered entities and business associates only. EXAMPLE: the distributor is an important entity under NIS2 in its Member State, and not a financial entity, so DORA's reporting duties do not apply.
If HIPAA applies to you
Three implementation specifications of the HIPAA Security Rule ask a covered entity or business associate for procedures that a site or unit plan can hold. Each is quoted below from 45 CFR Part 164, with where this template helps. Using the template does not put any of them in place for you: the procedures, and the decision on each, are yours.
Specification | What it asks | Where this template helps |
|---|---|---|
§ 164.308(a)(7)(ii)(C) Emergency mode operation plan Required | “Establish (and implement as needed) procedures to enable continuation of critical business processes for protection of the security of electronic protected health information while operating in emergency mode.” | CP-4 (losing systems) and CP-6 (vital records): how each critical process carries on without its systems, and the records it uses meanwhile. Add how electronic protected health information, and paper copies of it, stay secure while the site works this way. |
§ 164.310(a)(2)(i) Contingency operations Addressable | “Establish (and implement as needed) procedures that allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency.” | CP-4 (losing the building): who may enter the site, or the alternative place, in an emergency, and how they get in when the access control system is down. |
§ 164.312(a)(2)(ii) Emergency access procedure Required | “Establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency.” | CP-6 (vital records): which records the site or unit needs in an emergency and how it reaches them. The technical procedure for systems belongs with your IT team; name it in CP-6. |
Two of the three are required and one is addressable; the note under the framework references says what addressable means. The worked example's distributor is not a covered entity or a business associate, so its plan holds none of this.
How to use this template
The plan opens with a one-page card of the first steps, and has nine sections, CP-1 to CP-9. Each opens with a line naming its ID, what it holds and its rules, and a guidance box on what good looks like; delete the boxes before approval. Your entries are in [[double brackets]]; beside them, or in rows marked EXAMPLE, is the worked example.
Write the plan in this order:
- List the services the site or unit carries, their objectives and its processes, and agree the reduced level with each business owner (CP-1).
- Write the response to each of the four losses, using each service's own workaround for the loss of systems (CP-4), then the minimum resources and the vital records (CP-5, CP-6).
- Fill in the roles, the call tree and the first-steps card (CP-3); have the plan approved (RA-21), print it, and put the copies where CP-3 says.
- Book the first trial of each untried workaround (CP-9).
EXAMPLE. The worked example is the pack's wholesale distributor with about 900 staff, three warehouses and an online ordering service, after its ransomware incident INC-2026-014 (P09). Its Head of Risk, who runs no system in scope, coordinated a resilience review from 14 Sep 2026 to 25 Sep 2026, and figures are as at 30 Sep 2026. The plan is for Warehouse 2 (SU-02), one of the five sites and units the distributor's critical services need. Its plan was rewritten in the September review, after INC-2026-014 cut Warehouse 2's office network off on 12 and 13 August 2026 (P09). The annex lists the others.
The site or unit and what it carries
CP-1 · The site or unit, its lead and deputy, the critical services it carries a part of, its processes, and the reduced level it keeps them at · Rules RR-22, RR-21
This section says which site or unit the plan is for, what it does for the critical services, and how much of that it keeps going during a disruption. Everything else in the plan serves that reduced level.
Guidance — delete before approval
What good looks like. Each critical service the site or unit carries a part of is listed with its objectives copied from the Critical Service Recovery Objectives Matrix (RTO, RPO, MTD), never set here. The reduced level is agreed with each service's business owner, in words the site can act on: which orders, which customers, how late. The processes come from the Business Impact Analysis Questionnaire, with the point at which each one's harm becomes Severe.
The rule behind it. RR-22: “Every site or business unit that a critical service needs has a continuity plan for four losses: its building, a large part of its people at once, a supplier it relies on, and its systems, for which it uses the service's workaround (RR-06). The plan gives the least the site or unit needs to keep the service running at its agreed reduced level, its vital records, and how its people are told. Its lead takes the first steps at once (people safe, the call tree started, the crisis lead called); the crisis lead invokes the rest (RR-17). The plan is reviewed at least every [[12]] months, after it is used or tried, and after a significant change, and a copy can be reached without the main systems (RR-16).”
Field | Your plan | EXAMPLE: Warehouse 2 (SU-02) |
|---|---|---|
Site or unit name, ID and kind | [[name]] ([[ID]]), [[site / business unit]] | Warehouse 2 (SU-02), a site |
Where it is or where its people work | [[address, or how the unit works]] | [[address of the site]] |
Site or unit continuity lead and deputy | [[role]]; [[role]] | Warehouse 2 Manager; Warehouse 2 Shift Supervisor |
Critical services it carries a part of | [[names and IDs, as in the objectives matrix]] | Warehouse dispatch (CS-02) |
Agreed reduced level what it keeps going, and how late the rest may be | [[in words the site can act on]] | Perishable orders dispatched on time; other orders up to a day later |
Reduced level agreed by | [[the business owner of each service]] | Head of Logistics, the business owner of warehouse dispatch |
Plan approved by RA-21 | [[role]]; [[YYYY-MM-DD]] | Chief Operating Officer, the policy owner; [[approval date]] |
The services it carries
Copy each row from the Critical Service Recovery Objectives Matrix (RTO, RPO, MTD); this plan never changes an objective. The workaround is the service's own (RR-06), and the service's recovery plan is named so that nobody looks for recovery steps here.
Service | Business owner | Maximum tolerable downtime | Recovery time objective | Workaround | Recovery plan |
|---|---|---|---|---|---|
EXAMPLE Warehouse dispatch (CS-02) | Head of Logistics | 24 hours | 8 hours | Dispatch from printed pick lists of the next day's orders, printed each evening, for up to [[24]] hours Untried | Cyber Recovery Plan Template: Warehouse dispatch |
[[service and ID]] | [[role]] | [[hours]] | [[hours]] | [[the service's workaround]] [[Tried / Untried]] | [[document ID]] |
EXAMPLE. Warehouse 2 carries a part of one critical service, warehouse dispatch, with Warehouse 1 and Warehouse 3. Its workaround has never been tried, so it is recorded as untried (RR-06) until the trial in CP-9.
What the site or unit does, process by process
The Business Impact Analysis Questionnaire rates each process of a service at 4, 8, 24, 48, 72, 120 and 168 hours (RR-21). Copy the processes this site or unit runs, with the point at which each one's harm first reaches Severe. They show what the reduced level must keep going first.
Process | Busiest | Harm reaches Severe at | The least it needs |
|---|---|---|---|
EXAMPLE PR-01 Picking | November and December; the early shift on weekdays | 24 hours | [[12]] pickers a shift across the working warehouses; hand-held scanners, or the printed pick lists |
EXAMPLE PR-02 Packing and labelling | As picking | 48 hours | [[6]] packers a shift; label printers, or handwritten labels |
EXAMPLE PR-03 Loading and carrier hand-over | The afternoon collections | 24 hours | [[2]] loaders and a supervisor a shift; forklifts and pallet trucks |
EXAMPLE PR-04 Goods receiving | Monday and Thursday mornings | 120 hours | [[3]] a shift; pallet trucks |
EXAMPLE PR-05 Returns | January | Not within 168 hours | [[1]] a shift; none beyond the bench |
[[PR-xx]] [[process]] | [[when it is busiest]] | [[hours]] | [[people; equipment]] |
EXAMPLE. The analysis of warehouse dispatch was gathered by the Head of Risk with the Head of Logistics on 17 Sep 2026, for every warehouse. Harm reaches Severe at 24 hours for picking and for loading and carrier hand-over, at 48 hours for packing and labelling, at 120 hours for goods receiving and not within 168 hours for returns. Warehouse 2's reduced level follows from it: “Perishable orders dispatched on time; other orders up to a day later”, while goods receiving and returns can wait longer.
When this plan starts and stops
CP-2 · The first steps the lead takes at once, the conditions on which the crisis lead invokes the rest, and the stand-down · Rules RR-22, RR-17
Two things happen at different speeds. The lead takes the first steps at once, without waiting for anyone: RR-22 names people safe, the call tree started and the crisis lead called, and the card at the front adds the rest. The response to the loss starts when the crisis lead invokes it. A lead who must wait for permission to get people out is too slow; a site that moves its work to another site on its own leaves the crisis lead blind.
Guidance — delete before approval
What good looks like. The lead knows which steps are theirs alone and takes them in minutes. Each condition for invoking the rest can be checked at 3 a.m. without judgement. The crisis lead has a deputy who can be reached, and stands the plan down against a fixed list.
The rule behind it. RR-17: “The crisis lead invokes a service's continuity plan, sets the recovery order, and declares the end of recovery on the plan's criteria. Every other decision right during an incident is P09's: the incident manager isolates and decides restore or rebuild; the executive incident lead stops customer-facing services; only the board or its equivalent decides on a ransom.”
When the crisis lead invokes the rest
The crisis lead invokes the plan when any one of these holds (RA-04). Adjust them to the site or unit, but keep each one checkable:
- The building cannot be used, or will not be usable, for longer than [[a set time, e.g. 2 hours]].
- More than [[a set number of people, e.g. a third]] of the site's or unit's people are absent at once, or will be on the next shift.
- A supplier the site or unit relies on cannot deliver, and the alternative in CP-4 is needed.
- A system a service needs is down for the site or unit and will not be back within the time left of the service's recovery time objective. For a failed network line, the IT Disaster Recovery Procedure sets this test (DS-03).
- The incident manager cuts the site or unit off from the network, or a cyberattack is suspected (P09).
If the crisis lead cannot be reached within 30 minutes, P09's time for reaching the executive incident lead in a Severity 1 incident, the deputy decides (RR-19).
When the plan stops
The crisis lead stands the plan down when the steps of CP-8 are done, and declares the end of recovery for the services on their own plans' criteria (RA-17). If the plan was invoked and the trigger turns out not to hold, the crisis lead stands it down early and records why.
EXAMPLE. The Chief Operating Officer invokes Warehouse 2's plan, or the Chief Financial Officer as deputy, on any of the four losses as CP-4 describes them, and stands it down when the paper dispatches are entered and the affected aisles counted.
Who does what, and the call tree
CP-3 · Roles with deputies, the call tree, and the copies of the plan and contacts reached without the main systems · Rules RR-19, RR-16
Roles, not people, carry the plan, because people change and most disruptions start at night, at a weekend or in the holidays. Each role has a deputy with the same authority while acting. The contacts must work when email, the sign-in directory and the phone system are down.
Guidance — delete before approval
What good looks like. The lead and the deputy each have a number answered outside working hours, and both have taken part in an exercise. The call tree reaches every person, the next shift included, and records who could not be reached. The roles beyond the site are copied from the Crisis & Recovery Responsibility Matrix, with their deputies.
The rule behind it. RR-19: “Every crisis and recovery role has a named deputy, and no one is the first holder of two roles that must act in the same hour. Role holders and deputies take part in an exercise at least as often as P10 EX-07 sets.” P10's EX-07: “Every role holder in the incident response plan, and every deputy, must take part in an exercise at least every [[24]] months.”
The site or unit continuity lead owns the site's or unit's continuity plan, takes its first steps at once, runs it when the crisis lead invokes it, and accounts for its people. The other roles this plan names are the Crisis & Recovery Responsibility Matrix's, which says what each does:
Role | Holder and deputy, with 24/7 numbers | EXAMPLE: Warehouse 2 (SU-02) |
|---|---|---|
Site or unit continuity lead | [[role, number]] [[deputy, number]] | Warehouse 2 Manager; deputy Warehouse 2 Shift Supervisor |
Crisis lead | [[role, number]] [[deputy, number]] | Chief Operating Officer; deputy Chief Financial Officer |
Business owner | [[role, number]] [[deputy, number]] | Head of Logistics; deputy [[deputy for the service]] |
Incident manager | [[role, number]] [[deputy, number]] | Information Security Manager; deputy Head of Information Security |
Communications lead | [[role, number]] [[deputy, number]] | Head of Marketing and Communications; deputy none named (RRM-07) |
Supplier liaison | [[role, number]] [[deputy, number]] | Procurement Manager; deputy Finance Manager |
Resilience coordinator | [[role, number]] [[deputy, number]] | Head of Risk; deputy Quality and Compliance Manager |
EXAMPLE. The communications lead has no deputy, which the readiness dashboard names (RRM-07). Warehouse 2's plan cannot fix that, so it names [[whom to ask when the communications lead cannot be reached]] in CP-7.
The call tree
The call tree is how the lead reaches everyone without the main systems. Keep it on paper and on the lead's and the deputy's phones, and give every person the number they will be called from.
Who calls | Whom | What they say and ask |
|---|---|---|
Site or unit continuity lead | The deputy, then the crisis lead (the first steps) | What has happened, which loss it is, what still works |
Deputy | [[each supervisor or team leader]] | Where to go, what to do, whether to come in for the next shift |
Each supervisor or team leader | [[each person in their team, the next shift included]] | Are you safe? Can you work the next shift? Where? |
Anyone not reached | [[tried again within 30 minutes; then by text message]] | The same; record who is still not reached |
The call tree also accounts for the people: the lead knows who is safe, who can work the next shift, and who has not been reached. EXAMPLE: the worked example does not give Warehouse 2's call tree, so its names stay as placeholders.
Keeping this plan reachable without the main systems
RR-16 asks that “a copy of every plan and of the contact lists can be reached when the main systems are down”, and RR-22 asks the same of this plan. The mistake to avoid: keeping the only copy of the plan on the systems it recovers. Keep a copy and the contacts where they can be reached in an outage (RR-16).
Copy | Where it is kept | Who holds it | Last checked |
|---|---|---|---|
Printed copy at the site | [[e.g. the site office, in the grab bag by the exit]] | [[site or unit continuity lead]] | [[YYYY-MM-DD]] |
Copies held at home | [[e.g. sealed folder at the lead's and the deputy's homes]] | [[lead and deputy]] | [[YYYY-MM-DD]] |
Copy outside your own systems | [[e.g. a document store whose sign-in does not use the production directory]] | [[resilience coordinator]] | [[YYYY-MM-DD]] |
Each copy holds the whole plan, the first-steps card and the call tree, at the current version. Check every copy [[every quarter]] and after every review. EXAMPLE: Warehouse 2 keeps this plan and the call tree printed in the site office, and held at home by the manager and the deputy; the Warehouse 2 Manager keeps them current.
The four losses
CP-4 · For the building, people, a supplier and the systems: what counts as the loss, the response, its target and what it needs · Rules RR-22, RR-06
Plan for the loss, not its cause. A fire, a flood and a long power cut call for the same response, because each takes the building away. RR-22 names four losses, and every plan answers all four, in this order: the building, a large part of its people at once, a supplier it relies on, and its systems. For the loss of systems the site or unit runs each service's own workaround (RR-06); it does not invent another.
Guidance — delete before approval
What good looks like. Each loss has a response the site can start within minutes of the crisis lead's call, a target it can measure, who leads it, and what it needs. Each target is compared with the recovery time objective of every service the site carries; where it is longer, the plan says what keeps the service within its objective meanwhile. Where one loss brings another, such as a flood that takes the building and its network line, the response to the larger loss applies.
The rule behind it. RR-06: “Where a service cannot be back within its recovery time, its business owner records a workaround that keeps the harm below Severe until the service returns, and who starts it. A workaround that has never been tried is recorded as untried.”
Financial entities under DORA: Delegated Regulation Article 26(2) lists scenarios their response and recovery plans take into account, among them the partial or total failure of premises, the non-availability of a critical number of staff, and the failure of an ICT third-party service provider. Article 26(3) asks them to consider alternative options where the primary measures may not be feasible in the short term.
Losing the building
The building is lost when people cannot work in it: fire, flood, a long power cut, a gas leak, or the police closing the road. Decide now where the work goes, how much it can take, and how the people and the vital records get there. The place that takes the work writes it into its own plan, with the space and the people it needs (CP-5). Utilities count as well: a building with no power, heating or cooling for a day may lose what it holds. The IT Disaster Recovery Procedure hands a lost site to this plan (DS-05): “The site's continuity plan (RR-22); recover its systems elsewhere only if they run there.”
Field | Your plan | EXAMPLE: Warehouse 2 (SU-02) |
|---|---|---|
What counts as the loss | [[the events that cause it, and the threshold]] | Fire, flood, a long power cut, or no access to the site |
Response what the site or unit does | [[the response, started when the crisis lead invokes the plan]] | Warehouses 1 and 3 take Warehouse 2's dispatch at [[reduced volume]], perishable orders first; staff who can travel move to them |
Target by when | [[a time or a level the site can measure]] | First dispatches from Warehouses 1 and 3 within [[12]] hours |
Led by | [[role]] | Warehouse 2 Manager, with the Warehouse 1 Manager and Warehouse 3 Manager |
Alternative place where the work goes | [[another site, a recovery site, or working from home, with the volume it can take]] | The other two warehouses take a site's dispatch at [[reduced volume]] |
Getting in during an emergency when the access control system is down | [[who may enter the site or the alternative place to run the workaround or restore data, and how they get in]] | [[who may enter Warehouse 1 and Warehouse 3 out of hours, and how]] |
Utilities the site needs and what keeps them going | [[power, water, heating or cooling; e.g. a generator and how long it runs]] | [[power, and what else the site needs to keep its stock]] |
EXAMPLE. Warehouse 1 and Warehouse 3 take Warehouse 2's work. Their own plans are earlier plans, due for review by 30 Oct 2026: that review is the moment to write in the work they take from Warehouse 2, and the space and people it needs. The [[12]]-hour target is longer than warehouse dispatch's recovery time objective of 8 hours; [[say what keeps perishable orders on time until the first dispatches, or shorten the target with the Head of Logistics]].
Losing people
People are lost when a large part of the team is absent at once: illness, a transport strike, severe weather, or a disruption that reaches their homes. The answer is the minimum crew (CP-5), with cover from elsewhere and the work cut to the reduced level. Count skills as well as heads.
Field | Your plan | EXAMPLE: Warehouse 2 (SU-02) |
|---|---|---|
What counts as the loss | [[the events that cause it, and the threshold]] | More than [[a third]] of the site's staff absent at once: illness, a transport strike, severe weather |
Response what the site or unit does | [[the response, started when the crisis lead invokes the plan]] | Run the minimum crew below, with pickers from Warehouses 1 and 3 and [[an agency]]; hold non-perishable orders for a day |
Target by when | [[a time or a level the site can measure]] | The minimum crew on every shift |
Led by | [[role]] | Warehouse 2 Manager |
Cover from where extra people come from | [[other sites, an agency, staff trained in a second role]] | Pickers from Warehouse 1 and Warehouse 3 and [[an agency]], as the response says |
Skills few people hold and who else has them | [[e.g. forklift licences, first aid, the only person who knows a process]] | [[forklift drivers and first-aiders: who else holds the licence or certificate]] |
Losing a supplier
A supplier is lost when it cannot deliver what the site or unit relies on: a carrier that cannot collect, a provider that cannot support a system, a delivery that does not arrive. The Third-Party Security Risk Management pack's rule TP-10 asks: “Critical suppliers must be part of incident response and continuity plans, with named contacts and notification duties.” The site's part is the day-to-day switch; the supplier liaison calls on the supplier's continuity commitments (RA-14).
List each supplier the site's processes rely on, from the Resilience Dependency Register. Rows marked EXAMPLE are those of Warehouse 2's processes:
Supplier | Processes that need it | Contracted recovery time | Alternative |
|---|---|---|---|
EXAMPLE Warehouse management system provider P06 SUP-010 | PR-01 Picking | Not known | None |
EXAMPLE ERP software provider (hosted) P07 SYS-01; P06 SUP-004 | PR-04 Goods receiving PR-05 Returns | 8 hours | None |
EXAMPLE Network connectivity provider P06 SUP-014 | PR-03 Loading and carrier hand-over | 12 hours | None: a second line from another provider is not in place |
EXAMPLE National parcel carrier, express courier, pallet network P06 SUP-007, SUP-008, SUP-009 | PR-03 Loading and carrier hand-over | Not applicable | The other two carriers |
[[supplier and reference]] | [[processes]] | [[hours, Not known, or Not applicable]] | [[alternative, or None]] |
Field | Your plan | EXAMPLE: Warehouse 2 (SU-02) |
|---|---|---|
What counts as the loss | [[the events that cause it, and the threshold]] | A carrier cannot collect, or the warehouse management system's provider cannot support the system |
Response what the site or unit does | [[the response, started when the crisis lead invokes the plan]] | The other two carriers take the work; for the system provider, follow the systems loss below |
Target by when | [[a time or a level the site can measure]] | No collection missed |
Led by | [[role]] | Warehouse 2 Manager |
Who calls the supplier day to day, and for its continuity commitments | [[site lead for collections and deliveries]]; [[supplier liaison (RA-14)]] | Warehouse 2 Manager for collections; the Procurement Manager, the supplier liaison, for continuity commitments |
EXAMPLE. Only the carriers have an alternative: each of the three can take another's work. The warehouse management system's provider has no alternative and no recovery time in its contract (gap OG-06), so its loss is met as a loss of systems, below.
Losing systems
Systems are lost when a system a service needs is down for the site or unit: a failed server, a failed network line, a faulty update, or the site cut off in a cyber incident. The site does not plan its own way round each system. It runs the workaround of each service it carries (CP-1), as that service's business owner wrote and accepted it (RR-06), and leaves the systems' recovery to the IT Disaster Recovery Procedure and each service's plan.
Field | Your plan | EXAMPLE: Warehouse 2 (SU-02) |
|---|---|---|
What counts as the loss | [[the events that cause it, and the threshold]] | The warehouse management system or the network line is down, or the site is cut off in a cyber incident |
Response what the site or unit does | [[the response, started when the crisis lead invokes the plan]] | Dispatch from the printed pick lists for up to [[24]] hours (the workaround); after an attack, P09 runs the incident and the site reconnects only when the incident manager allows it |
Target by when | [[a time or a level the site can measure]] | Perishable orders out on time |
Led by | [[role]] | Warehouse 2 Manager, with the business owner of the service, once the crisis lead invokes the workaround (RA-04) |
EXAMPLE. A failed network line is the likeliest loss of systems at Warehouse 2: the provider's contract gives 12 hours to restore it, against warehouse dispatch's 8 hours, and there is no second line (gap OG-03).
When the cause is a cyberattack
P09 runs the incident, and P09 gives the decision to “isolate a system, site or account” to the incident manager. Nothing fails over or is restored until the incident manager confirms that the copy or site to be used can be trusted (RR-23). Meanwhile the site works on the workaround, touches no device the incident manager has not cleared, and reconnects one part at a time when the incident manager allows it (RR-18; CG-21).
EXAMPLE. INC-2026-014 (P09), “Ransomware on 14 office PCs at Warehouse 2”: the site's office network was cut off, and office work resumed on rebuilt PCs on 13 Aug 2026, 14:00. Ordering and dispatch were not affected. Warehouse 2's plan was rewritten in the review that followed.
Minimum resources
CP-5 · The least people, space, equipment, systems, suppliers and records the reduced level needs, and where each comes from · Rules RR-22, RR-21
Minimum resources are the least people, space, equipment, systems, suppliers and records a process or site needs to keep a critical service running at its agreed reduced level (RR-21, RR-22). Count them for the reduced level, not for a normal day. The count tells the receiving site how much space to clear, the agency how many people to send, and the lead when the loss of people has begun.
Guidance — delete before approval
What good looks like. Each resource is counted for the reduced level, from the least each process needs in the Business Impact Analysis Questionnaire. Skills are counted as well as heads: a crew with no forklift driver or no first-aider cannot work. Each line says where the resource comes from if the site loses its own.
For the providers the NIS2 Implementing Regulation's Article 1 names, its Annex point 4.2.4 lists resources to plan for: facilities, equipment and supplies, personnel with the necessary responsibility, authority and competence, and appropriate communication channels.
Resource | Your plan: at the reduced level | Your plan: where it comes from if the site loses its own | EXAMPLE: Warehouse 2 (SU-02) |
|---|---|---|---|
People | [[people needed]] | [[source]] | [[14]] a shift: [[10]] pickers and packers, [[2]] loaders, a supervisor and a first-aider |
Space | [[space needed]] | [[source]] | A loading bay and [[a third]] of the racking at Warehouse 1 or 3, if Warehouse 2 is lost |
Equipment | [[equipment needed]] | [[source]] | [[2]] forklifts or pallet trucks; label printers, or handwritten labels |
Systems | [[systems needed]] | [[source]] | None for up to [[24]] hours: the printed pick lists carry dispatch |
Suppliers | [[suppliers needed]] | [[source]] | Any one of the three carriers |
Records | [[records needed]] | [[source]] | The vital records below |
Communication | [[phones, radios, the call tree]] | [[source]] | [[phones the site uses when the network line is down]] |
EXAMPLE. The analysis counts people across the working warehouses, for the whole service; this table counts them for Warehouse 2 alone.
Vital records
CP-6 · The records the processes cannot run without, where they are kept, who keeps them current and how they are protected · Rule RR-22
Vital records are records a process cannot run without, on paper or in a system, such as the next day's pick lists or the delivery note pads. A vital record that is out of date is not vital: a pick list printed last week dispatches last week's orders. So each record has a keeper and a way of being kept current.
Guidance — delete before approval
What good looks like. Every record each process needs at the reduced level is listed, from the Business Impact Analysis Questionnaire. Each is kept where it can be reached when the systems and the building are down, and refreshed on a set rhythm. Paper copies that hold personal data are locked away, counted back and shredded after use.
Record | Where it is kept | Keeper | Kept current | Protected |
|---|---|---|---|---|
EXAMPLE The next day's pick lists | Printed each evening and kept in the dispatch office | Warehouse 2 Shift Supervisor | [[how often it is refreshed]] | [[how it is protected]] |
EXAMPLE Delivery note pads and carrier manifest forms | The dispatch office cupboard | Warehouse 2 Shift Supervisor | [[how often it is refreshed]] | [[how it is protected]] |
EXAMPLE This plan and the call tree | Printed in the site office, and held at home by the manager and the deputy | Warehouse 2 Manager | [[how often it is refreshed]] | [[how it is protected]] |
[[record]] | [[where, reachable without the systems]] | [[role]] | [[how often]] | [[how]] |
EXAMPLE. Warehouse 2's list holds the records of picking, packing and loading. The analysis also names copies of the open purchase orders and returns forms for goods receiving and returns, which can wait longer than the others (CP-1), and the list leaves them out. [[Add them if goods receiving or returns must go on through a long loss.]]
Telling people
CP-7 · Who tells the site's own people, staff, customers and suppliers what, and by when · Rules RR-27, RR-22
People who are not told make their own arrangements: staff go home or turn up at the wrong site, customers go elsewhere, carriers wait at a closed gate. This section says who tells whom, what and by when. The site or unit tells its own people what to do; the communications lead tells everyone else.
Guidance — delete before approval
What good looks like. The site's own people hear from the lead within minutes, through the call tree. Every message outside the site comes from the communications lead, from an approved template, at the times RR-27 sets. The lead gives the communications lead the facts a message needs: what still works, which orders or customers are affected, and when the next update can be given.
The rule behind it. RR-27: “During a disruption of a critical service, the communications lead tells staff within [[1]] hour and affected customers within [[2]] hours of the crisis lead declaring it: what has happened, what still works, what to do, and when the next update will come. Updates follow at least every [[4]] hours, and at each change, until the end of recovery, all from the approved outage templates. In a cyber incident P09's templates and its rule IM-09 apply instead, and notices to authorities stay with P09 and P18.”
In a cyber incident, P09's IM-09 applies: “Only the communications lead may speak for the organisation about an incident outside it, using the approved templates; nobody else may talk to the media or post about an incident.”
Who | What they are told | By when | Sent by | From |
|---|---|---|---|---|
The site's or unit's own people | Where to go, what to do, and whether to come in for the next shift | At once, through the call tree | Site or unit continuity lead | The call tree (CP-3) |
All staff | What has happened, what still works, what to do, when the next update comes | Within 1 hour of the crisis lead declaring the disruption | Communications lead | Outage templates; cyber: P09 CT-03 |
Affected customers | The same, and how to keep ordering meanwhile | Within 2 hours | Communications lead | Outage templates; cyber: P09 CT-04 |
Suppliers it relies on | What has happened and what you need from them | When the crisis lead invokes the plan | The lead, day to day; the supplier liaison for continuity commitments (RA-14) | Outage templates; cyber: P09 CT-05 |
Everyone told earlier | Updates, then the end of the disruption | At least every 4 hours and at each change, to the end of recovery | Communications lead | Outage templates; cyber: P09's times, ending with CT-10 |
The outage templates are the Outage Communications Template Set. Notices to authorities are never sent from the site or unit (RR-27). If the communications lead cannot be reached, the lead asks [[the communications lead's deputy, or the person the crisis lead names]].
EXAMPLE. When Warehouse 2's systems are lost, the call tree tells its own people at once, and the Warehouse 2 Manager tells the communications lead which orders will be late, so that the customer message can say so. For the messages and their times, see the illustration of a failed line at Warehouse 2 in the Outage Communications Template Set.
Returning to normal
CP-8 · Switching back, reconciling what was done on paper, the records collected, and the end of recovery · Rules RR-17, RR-25
The loss usually ends before the plan does. The building reopens, the line comes back, the people return; then the work done on paper has to be put back into the systems, the stock counted, and the paper collected. A plan that stops when the systems come back leaves the reconciling to chance.
Guidance — delete before approval
What good looks like. The switch back happens at a set time, agreed with the business owner and approved by the crisis lead, never in the middle of a busy shift. Everything the workaround did is entered and reconciled, and every difference explained. After an attack nothing reconnects until the incident manager allows it.
The rule behind it. RR-25: “Failing back to the normal set-up is planned like a change: the data written while failed over is copied back and reconciled, the business owner agrees the time, it avoids the service's busiest periods, and the crisis lead approves it. Recovery ends (RR-17) when the service runs on its normal set-up, or on an alternate set-up the business owner and the crisis lead have accepted for a set time.”
Back to normal, in this order:
- Confirm the loss is over: the building is cleared for use, the people are back, the supplier delivers again, or the systems run. After a cyberattack, reconnect only when the incident manager allows it, one part at a time (RR-18; CG-21).
- Agree the time to switch back with the business owner of each service, away from its busiest periods, and have the crisis lead approve it, as for a failback (RR-25).
- Freeze the workaround at that time. Enter what it recorded on paper into the systems, and reconcile it with the systems' own records, explaining every difference (RR-25).
- Find again the data lost since the last backup, by the means the service's plan names (RR-04).
- Collect every paper record the workaround used. File what must be kept, and shred the rest: pick lists, forms and notes hold names and addresses (RR-22).
- Tell the crisis lead that the site or unit is back to normal. The crisis lead declares the end of recovery for the services (RR-17; RA-17).
- Close the site log, and note what to change in this plan for its review (RR-22).
Field | Your plan | EXAMPLE: Warehouse 2 (SU-02) |
|---|---|---|
Switch-back time agreed by and approved by | [[business owner]]; [[crisis lead]] | Head of Logistics; Chief Operating Officer |
Paper records entered by and collected, filed or shredded by | [[role]]; [[role]] | [[role]]; [[role]] |
Data lost since the last backup found again by | [[the means the service's plan names]] | Stock movements after the recovery point are found again by a count of the affected aisles |
EXAMPLE. The warehouse management system's failback in the IT Disaster Recovery Procedure is “moved back to the usual servers in a planned evening window, after a count of the affected aisles”: the site plan says who counts, and when.
Testing and review
CP-9 · How each loss is tried, the next workaround trial, and the plan's reviews · Rules RR-26, RR-22
A plan that has never been tried is a hypothesis. This section says how each loss is tried without causing it, when the next trial is, and when the plan is reviewed.
Guidance — delete before approval
What good looks like. Each untried workaround the site runs has a trial booked, with a written plan the business owner approved first. The other losses are rehearsed in a walk-through or an exercise. The plan is reviewed after every use and every trial, and the lessons are written in.
The rule behind it. RR-26: “Every recovery test (RR-14), failover test and workaround trial has a written plan, approved by the service's business owner before it runs: what it tests, how success is judged against the objectives, how it is kept from causing the outage it rehearses (a copy or a quiet period, a point at which it stops, and a way back), and who may stop it. Its report, written within [[10]] working days, records the time achieved, the data lost and every finding; a finding that misses an objective is an objective gap (RR-15). A workaround tried in a trial is no longer untried (RR-06).”
A workaround trial tries the workaround; it does not test recovery. An exercise under P10, a tabletop or a drill, is not a recovery test either (RR-14).
Trying each loss
Loss | How it is tried | Last tried; next | EXAMPLE: Warehouse 2 (SU-02) |
|---|---|---|---|
Building | [[e.g. a walk-through of the move with the receiving site's lead, or a tabletop exercise under P10]] | [[YYYY-MM-DD, or Untried]]; [[ID and date]] | [[how and when]] |
People | [[e.g. a quiet shift run with the minimum crew and cover from another site]] | [[YYYY-MM-DD, or Untried]]; [[ID and date]] | [[how and when]] |
Supplier | [[e.g. one day's collections switched to another carrier]] | [[YYYY-MM-DD, or Untried]]; [[ID and date]] | [[how and when]] |
Systems | A workaround trial under RR-26 | [[YYYY-MM-DD, or Untried]]; [[ID and date]] | Never tried. Next: WT-2026-01, 24 Oct 2026, planned: dispatch from the printed pick lists for the first two hours of the Saturday early shift, with the warehouse management system running alongside to compare |
For the building and supplier losses, a tabletop exercise under P10 rehearses the decisions; P10's “Tabletop Scenario — Critical Supplier Outage” is one scenario to start from.
The next workaround trial
Every trial has a written plan, approved by the business owner of the service before it runs (RA-24), in the Continuity & Disaster Recovery Test Plan and Report. The site plan records its essentials:
Field | Your plan | EXAMPLE: Warehouse 2 (SU-02) |
|---|---|---|
Trial ID, kind and date | [[ID]]; [[workaround trial]]; [[YYYY-MM-DD]] | WT-2026-01; workaround trial; Saturday 24 Oct 2026 |
What it tries | [[the workaround, for how long]] | Dispatch from the printed pick lists for the first two hours of the Saturday early shift, with the warehouse management system running alongside to compare |
Approved by before it runs (RA-24) | [[business owner]] | Head of Logistics, the business owner of warehouse dispatch |
How it is kept from causing the outage a quiet time, a stop point and a way back | [[when; the point at which it stops; the way back]] | The first two hours of the Saturday early shift, with the warehouse management system running alongside, so dispatch can go back to it at once; [[the point at which it stops]] |
Who may stop it | [[role]] | [[role]] |
How success is judged | [[against the reduced level]] | [[e.g. every perishable order of the two hours picked and packed from the printed lists, and the differences from the system's pick lists counted]] |
Report due within 10 working days (RR-26) | [[YYYY-MM-DD]] | 6 Nov 2026 |
What changes after it | [[the plan, the workaround, the record]] | The workaround is no longer untried (RR-26), and this plan is reviewed (RR-22) |
EXAMPLE. As at 30 Sep 2026, 1 of the 5 critical services with a workaround had had it tried (RRM-09). Once WT-2026-01 is held, warehouse dispatch is the second.
Reviewing the plan
The plan is reviewed at least every [[12]] months, after it is used or tried, and after a significant change (RR-22). A significant change alters the response to a loss: [[e.g. a new site, a new carrier, a new system, a new lead, or a change in the services the site carries]]. Each new version replaces every copy (CP-3).
Record the last review and its trigger, the next review due, and the lessons written in: [[YYYY-MM-DD; trigger]]; [[YYYY-MM-DD]]; [[what changed]]. EXAMPLE: Warehouse 2's plan was last reviewed on 25 Sep 2026, in the review after INC-2026-014; its next review is due by 25 Sep 2027, or sooner, after WT-2026-01.
The readiness dashboard counts the site and unit plans that are current (RRM-08) and the workarounds that have been tried (RRM-09), with every gap named. EXAMPLE, as at 30 Sep 2026: site and unit plans current, 5 of 5; 4 due by 30 Oct 2026; workarounds tried, 1 of 5.
Annex: the distributor's sites and units
EXAMPLE. The distributor's critical services need five sites and business units, each with a continuity plan (RR-22). Warehouse 2's is the one rewritten in this template; the others are the plans of 30 Oct 2025.
Site or unit | Lead | Critical services it carries | Plan | Last reviewed | Next review due |
|---|---|---|---|---|---|
Warehouse 1 (SU-01) Site | Warehouse 1 Manager | Warehouse dispatch (CS-02) | Earlier plan | 30 Oct 2025 | 30 Oct 2026 |
Warehouse 2 (SU-02) Site | Warehouse 2 Manager | Warehouse dispatch (CS-02) | P22 template | 25 Sep 2026 | 25 Sep 2027 |
Warehouse 3 (SU-03) Site | Warehouse 3 Manager | Warehouse dispatch (CS-02) | Earlier plan | 30 Oct 2025 | 30 Oct 2026 |
Finance team (SU-04) Business unit | Finance Manager | Payments (CS-03) Finance and payroll (CS-04) | Earlier plan | 30 Oct 2025 | 30 Oct 2026 |
Customer contact team (SU-05) Business unit | Customer Contact Manager | Online ordering (CS-01) Customer contact (CS-05) | Earlier plan | 30 Oct 2025 | 30 Oct 2026 |
EXAMPLE. Site and unit plans current (RRM-08): 5 of 5; 4 due by 30 Oct 2026. Rewrite each earlier plan in this template at its review. The finance team carries two services, so its plan lists both workarounds under the loss of systems: for payments, “business customers are invoiced on account; card customers are called back” and for finance and payroll, “the payroll bureau repeats last month's payroll, corrected the next month”.
Adapting this template
Guidance — delete before approval
Small organisation: one site may be the whole organisation. Write one plan, keep the four losses and the first-steps card, and keep each section short. The lead and the deputy must still be two people.
Business unit with no building of its own: for a team that works from several offices or from home, the building loss is the loss of the place its equipment and records are, and the loss of people is often the likeliest. Name where the team works if its usual place is lost.
Guidance — delete before approval
Site or work run by a service provider: where an outsourced provider runs the site or the unit's work, such as a contact centre or a third-party warehouse, its own continuity plan does this job. Ask for it and for its last trial, compare its reduced level and targets with yours, and name its contact and the notice it must give in CP-4 (TP-10).
Guidance — delete before approval
Regulated entity, NIS2: an essential or important entity's measures include business continuity and crisis management (Article 21(2)(c)); a plan like this for each site or unit a critical service needs is one way to write down the continuity part of them. A provider named in the NIS2 Implementing Regulation's Article 1 also checks each plan against its Annex points 4.1.2 (what a plan includes, among them activation and deactivation conditions, roles, contacts and required resources) and 4.2.4 (resources), with counsel.
Regulated entity, DORA: a financial entity checks its site and unit plans against the scenarios of Delegated Regulation Article 26(2) and the alternative options of Article 26(3), and tests them periodically, notably where an ICT third-party service provider runs a critical or important function (Article 11(4)). An entity of Article 16(1) follows the simplified framework instead.
Service organisation whose customers receive a report on the Trust Services Criteria: the criteria are named in the references by number and series title only (CC9.1, Risk Mitigation). The auditor decides what evidence it asks for; keep each approved version of this plan, its review record and its trial reports, which are records an auditor can ask to see.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; ISO 22301:2019 incl. Amd 1:2024 (clause numbers and titles only); NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774; Regulation (EU) 2016/679 (GDPR); 45 CFR Part 164 (HIPAA Security Rule, eCFR current to 6 October 2026); AICPA Trust Services Criteria (number and series title only).
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Annex A 5.29 — Information security during disruption | CP-4: losing systems after a cyberattack, with P09 running the incident; CP-6: records on paper protected |
ISO/IEC 27001:2022 | Annex A 7.11 — Supporting utilities | CP-4: losing the building, with the utilities it needs |
NIST CSF 2.0 | ID.IM-04 — “Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved” | The whole template: established, communicated, and improved after use and trials (CP-9) |
NIST CSF 2.0 | GV.SC-08 — “Relevant suppliers and other third parties are included in incident planning, response, and recovery activities” | CP-4: losing a supplier; CP-7: suppliers told |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(c) — “business continuity, such as backup management and disaster recovery, and crisis management” | The whole template: continuity for each site or unit, and its part in crisis management |
NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Legal note: who the Implementing Regulation binds |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 4.1.1 — “For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant entities shall lay down and maintain a business continuity and disaster recovery plan to apply in the case of incidents.” | The whole template, as part of the organisation's continuity plans |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 4.1.2 — “The relevant entities’ operations shall be restored according to the business continuity and disaster recovery plan.” The plan is based on the risk assessment (point 2.1) and includes, where appropriate: purpose, scope and audience; roles and responsibilities; key contacts and communication channels; conditions for plan activation and deactivation; order of recovery for operations; recovery plans for specific operations, including recovery objectives; required resources, including backups and redundancies; restoring and resuming activities from temporary measures | CP-1 to CP-3: scope, roles, contacts, activation and deactivation; CP-5: resources; CP-8: resuming from temporary measures |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 4.2.4 — based on the risk assessment (point 2.1) and the business continuity plan, “sufficient availability of resources by at least partial redundancy” of network and information systems; assets, including facilities, equipment and supplies; personnel with the necessary responsibility, authority and competence; and appropriate communication channels | CP-5: people, space, equipment, suppliers and communication channels at the reduced level |
DORA — Regulation (EU) 2022/2554 | Article 11(2) — the ICT business continuity policy is implemented “through dedicated, appropriate and documented arrangements, plans, procedures and mechanisms” aiming to ensure the continuity of critical or important functions; respond to and resolve all ICT-related incidents in a way that limits damage and prioritises the resumption of activities and recovery actions; activate without delay dedicated plans enabling containment and tailored response and recovery procedures (Article 12); estimate preliminary impacts, damages and losses; and set out communication and crisis management actions (Article 14) and reporting to competent authorities (Article 19) | CP-2: the first steps and the invocation; CP-7: telling people |
DORA — Regulation (EU) 2022/2554 | Article 11(4) — “Financial entities shall put in place, maintain and periodically test appropriate ICT business continuity plans, notably with regard to critical or important functions outsourced or contracted through arrangements with ICT third-party service providers.” | CP-4: losing a supplier; CP-9: trials |
DORA — Delegated Regulation (EU) 2024/1774 | Article 26(2) — the plans identify relevant scenarios, including severe business disruptions, and take into account at least: cyber-attacks and switchovers to redundant capacity, backups and redundant facilities; failure of a critical or important function, including insolvency or other failure of an ICT third-party service provider; partial or total failure of premises and data centres; substantial failure of ICT assets or communication infrastructure; non-availability of a critical number of staff; climate and environment-related events, natural disasters, pandemics and physical attacks; insider attacks; political and social instability; and widespread power outages | CP-4: losing premises, staff, a supplier and systems |
DORA — Delegated Regulation (EU) 2024/1774 | Article 26(3) — “Where the primary recovery measures may not be feasible in the short term because of costs, risks, logistics, or unforeseen circumstances, the ICT response and recovery plans referred to in paragraph 1 shall consider alternative options.” | CP-4: the alternative place, people and suppliers |
GDPR — Regulation (EU) 2016/679 | Article 32(1)(b) — the security measures include, as appropriate, “the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services” | CP-4: losing systems; CP-6: vital records, and personal data on paper |
HIPAA — 45 CFR Parts 160 and 164 | § 164.308(a)(7)(ii)(C) — emergency mode operation plan (required): “Establish (and implement as needed) procedures to enable continuation of critical business processes for protection of the security of electronic protected health information while operating in emergency mode.” | Legal note; CP-4: losing systems; CP-6 |
HIPAA — 45 CFR Parts 160 and 164 | § 164.310(a)(2)(i) — contingency operations (addressable): “Establish (and implement as needed) procedures that allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency.” | Legal note; CP-4: getting into the site in an emergency |
HIPAA — 45 CFR Parts 160 and 164 | § 164.312(a)(2)(ii) — emergency access procedure (required): “Establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency.” | Legal note; CP-6: records needed in an emergency |
AICPA Trust Services Criteria | SOC 2 CC9.1, Risk Mitigation | CP-4: the response to each loss; CP-9: trials and reviews |
ISO 22301:2019 incl. Amd 1:2024 | Clause 8.4.4 — Business continuity plans (clause number and title only) | The whole template |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 4.1.4 — “The business continuity plan and disaster recovery plan shall be tested, reviewed and, where appropriate, updated at planned intervals and following significant incidents or significant changes to operations or risks. The relevant entities shall ensure that the plans incorporate lessons learnt from such tests.” | CP-9: reviews at planned intervals and after use, with lessons from trials; the example rewritten after a significant incident |
ISO/IEC 27001 references name the clause or control this document relates to; ISO 22301 is named by clause number and title only, and its text is not reproduced. Neither says that meeting one meets any other framework's requirement.
HIPAA binds covered entities and business associates that create, receive, maintain or transmit electronic protected health information; others may read it as a reference. An addressable specification is not optional: it is put in place where reasonable and appropriate, or the reason is documented and an equivalent measure used where one is (§ 164.306(d)(3)). Using this document is not a statement that you comply with the Security Rule.
Trust Services Criteria are named by number and series title only; their statements are not reproduced. A report on them is an independent auditor's opinion on your controls, and nothing in this document says that a criterion is met.
Definitions
Term | Meaning in this plan |
|---|---|
Business impact analysis | for each critical service, how the harm grows over time on the risk register's impact areas, and the point at which it becomes Severe (RR-03). |
Business owner | The manager accountable for a critical service. Sets and agrees its objectives, accepts its workaround, and confirms it works before it returns to users (RR-02). |
Continuity plan | A site's or business unit's plan for keeping its part of the critical services running when it loses its building, a large part of its people, a supplier it relies on, or its systems (RR-22). |
Critical service | A service the organisation delivers whose disruption beyond its maximum tolerable downtime would cause Severe harm on the risk register's impact scale (RR-01). It is a business service, such as online ordering, not a system. |
End of recovery | The point at which the crisis lead declares every affected critical service back in normal operation, on the criteria the plan sets, and the records are complete (RR-17). |
Failback | Returning a system from its failover set-up to its normal one, with the data written meanwhile copied back and reconciled (RR-25). |
Maximum tolerable downtime | the longest a critical service can be unavailable before the harm reaches Severe on the impact scale. Found by the business impact analysis (RR-03). |
Minimum resources | The least people, space, equipment, systems, suppliers and records a process or site needs to keep a critical service running at its agreed reduced level (RR-21, RR-22). |
Process | One activity a critical service is made of, such as picking or loading for dispatch. The business impact analysis rates each process, and the service takes the worst rating at each time point (RR-21). |
Recovery test | A technical test that recovers a critical service, or the systems behind it, and measures the time achieved and the data lost against its objectives; for a service a supplier runs, the supplier's own recovery test with its results shared. A tabletop or a drill under P10 tests decisions and communication. Only a timed recovery proves a recovery time, so under this rule it is not a recovery test (RR-14). |
Recovery time objective | the time within which the service must be back, counted from the decision to recover it. Always shorter than the MTD (RR-04). |
Vital records | Records a process cannot run without, on paper or in a system, such as the next day's pick lists or the delivery note pads. Kept where they can be reached when the systems are down (RR-22). |
Workaround | A way of running the service, or its most important part, without its systems for a set time, such as dispatch from printed pick lists. Owned and accepted by the business owner (RR-06). |
Workaround trial | Running a service's workaround for real, for a set time and with a way back, to show it works. It tries the workaround; it does not test recovery (RR-14, RR-26). |