Business continuity management and exercise
What happens if a critical service is down for three days? We map your business-critical processes, set recovery targets with the business and test the plans in an exercise, so that continuity is something you can demonstrate rather than describe.
Who it is for and when
Suits organisations that face continuity requirements from law, standard or customer, and businesses that depend on a small number of systems or suppliers.
- The Swedish Cybersecurity Act, DORA or ISO 27001 requires you to manage continuity systematically.
- You have backups but do not know how long an actual restore would take.
- The business depends on suppliers and cloud services that you do not control yourselves.
- Management has never had a complete picture of what a longer outage would cost.
What we do
- Business impact analysis. We identify your critical processes, which systems and suppliers they depend on and what an outage means for the business over time.
- Recovery targets. We set RTO and RPO per process together with the business, that is how quickly something must be back and how much data may be lost.
- Plans and fallback routines. We produce continuity plans and manual fallback routines for the processes that cannot stop, plus the order in which systems are recovered.
- The exercise. We exercise an outage scenario with the business and IT, and test whether the targets are realistic with the technology and contracts you have.
- Report and follow-up. We document the gaps between target and reality, propose measures and set a plan for recurring tests.
You get
- A business impact analysis with critical processes and dependencies
- RTO and RPO per critical process, decided by the business
- Continuity plans with fallback routines and a recovery order
- A completed exercise with documented attendance
- A report on the gap between target and reality, with an action plan
Scope and price
From a few days for a defined operation to about a week when many processes and suppliers are involved. The testing can then recur annually.
The price varies from engagement to engagement and depends on the number of processes, how many suppliers are involved and whether plans already exist. You get a clear proposal after the first conversation.
How it works
- A first conversation. We listen to your situation and explain how we usually set the work up. You get our assessment straight away, at no cost.
- A proposal with scope and price. A short written proposal with what is included, what you get, who does the work and what it costs.
- Delivery and handover. We work alongside your organisation, report as we go and hand over so that you can manage the result yourselves.
Frequently asked questions
How is this different from incident preparedness?
Incident preparedness is about detecting, deciding and reporting when something happens. Continuity management is about keeping the business running during the outage and recovering in the right order. They belong together and are best exercised together.
What do RTO and RPO mean?
RTO is how long a process or system may be down before it becomes a real problem. RPO is how much data you can afford to lose, that is how far back you may end up. Both should be decided by the business, not by IT.
Is having backups enough?
No. Backups are a prerequisite, but continuity is about dependencies, the order between systems, manual fallback routines and having the targets tested in practice.
What does it cost?
It varies from engagement to engagement and depends on how many processes and suppliers are in scope. We give a clear proposal after the first conversation.
Would you like to know how long your business can withstand an outage?
Contact us