PREPARE · ORGANISATIONAL RESILIENCE
Business Continuity, Disaster Recovery and Crisis Management
When something serious goes wrong, the business needs to keep important work moving, restore what has failed and coordinate decisions under pressure.
Three related ideas — three different jobs
Business continuity focuses on keeping priority business activities operating at an acceptable level during disruption.
Disaster recovery commonly focuses on restoring technology, systems, infrastructure and information after significant disruption.
Crisis management focuses on leadership, coordination, communication and decision-making when an event threatens the organisation more broadly.
The boundaries can overlap, but separating the questions helps prevent important responsibilities from being missed.
Start with the business, not the disaster
Ask which products, services and activities matter most, how long the business can tolerate their disruption and what people, technology, information, premises and suppliers they depend on.
This business-impact thinking helps determine where recovery effort should go first.
Technology recovery is only part of recovery
A restored server does not automatically mean the business can serve customers. Staff may lack access, a supplier may still be unavailable, information may need validation or a physical location may be unusable.
Recovery planning therefore needs to connect technology with the business process it supports.
A crisis needs leadership
Major disruption creates uncertainty. Somebody must set priorities, make trade-offs, coordinate communications and decide when normal arrangements are no longer enough.
Roles, contact routes and decision authority should be understood before the pressure arrives.
Exercise the plan
A plan can look excellent on paper and fail when assumptions meet reality. Tabletop exercises and recovery tests help reveal missing contacts, unclear responsibilities, unrealistic recovery expectations and dependencies nobody noticed.
BOI ACTION
Choose one critical business activity and remove one dependency.
Imagine its main system, location or supplier is unavailable tomorrow. Ask: How long can we tolerate the disruption? What would we do first? Who makes the decision? What do we need to recover?
Record the first assumption you discover and check whether it is true.
A boardroom question
What disruption could stop our most important business activity — and when did we last test our response?
Don’t assume. Check.
Resilience is not the existence of a plan. It is the demonstrated ability to adapt, continue and recover when the organisation is under pressure.
BUILD PRACTICAL RESILIENCE
Test the assumptions behind your decisions
The BOI Practical Toolkit connects resilience with governance, risk, culture, improvement and measurement.
Useful guidance
Final publication QA will verify current business-continuity, disaster-recovery and crisis-management references and supporting authoritative guidance before release.
Continue exploring
You have reached the end of the BOI launch guide journey. Return to the Guides page to revisit a specific business question or move into Foundations and the Practical Toolkit.
Explore all Cyber Security Guides →
Found something that may be outdated or incorrect? Let us know.
Better Decisions. Stronger Organisations.
Understand what matters. Take sensible action. Check whether it worked.
