Business continuity
BCMAlso called business continuity management, business continuity planning, BCP
Business continuity is a firm's ability to keep critical operations running, or restore them quickly, after a disruption such as a power cut, cyber attack, pandemic or supplier failure. Business continuity management covers the plans, recovery targets, backup sites and tests that make this possible. Financial regulators expect it to be documented and tested.
How it works
A firm starts with a business impact analysis that ranks processes by how much harm an outage would cause. Each critical process gets a recovery time objective and a recovery point objective for data. Plans set out alternate sites, staff, systems and suppliers. The firm tests the plans through exercises and failovers, records gaps and updates the plans after each test or real event.
For banks and insurers, a failed recovery can harm customers and markets as well as the firm. DORA requires an ICT business continuity policy with tested response and recovery plans. In the UK, business continuity supports the operational resilience regime and its impact tolerances. US examiners use the FFIEC handbook to assess whether continuity planning covers the whole enterprise.
The rules
Financial entities must put in place an ICT business continuity policy with response and recovery plans that are tested at least yearly.
EU financial entitiesSets requirements to plan, implement, test, review and improve a business continuity management system.
Any organisation seeking a certifiable continuity management systemExplains how examiners assess enterprise-wide business continuity management, including impact analysis, planning, testing and third-party dependencies.
US banks and credit unions examined by FFIEC member agenciesCommon questions
What is the difference between business continuity and disaster recovery?
Disaster recovery focuses on restoring IT systems and data after a failure. Business continuity is wider. It covers people, premises, suppliers and processes as well as technology, so the firm can keep delivering critical services while systems are restored.
What are RTO and RPO?
The recovery time objective is the maximum time a process or system can be down before harm becomes unacceptable. The recovery point objective is the maximum amount of data, measured in time, the firm can afford to lose. Both drive backup and failover design.
How does business continuity relate to operational resilience?
Business continuity plans recovery for individual processes and systems. Operational resilience, as applied by UK regulators, looks at end-to-end important business services and whether the firm can stay within set impact tolerances. Continuity planning is one of the tools firms use to meet those tolerances.
