A business continuity strategy is the set of choices you make, before a disruption, about how your critical work keeps going when you lose people, a building, technology, or a key vendor. Most organizations build theirs backward. They start with a long list of things that could happen and try to write a plan for each one.
Start with what a disruption does to you instead. There are only four things it can take away.
| Old View | New View |
| Write a plan for every scenario on the risk register | Plan for the four consequences every scenario produces |
| Every team says its systems are critical | Every recovery time objective gets challenged and defended |
| Strategy is the BC team’s document | Strategy is a set of executive decisions: fund it or accept the risk |
| Built for a 72-hour outage at headquarters | Built for how and where the work actually gets done today |
| Vendor risk belongs to procurement | Critical vendors are part of your recovery strategy |
What a Business Continuity Strategy Is (and Isn’t)
A strategy is not a plan. The strategy is the choice: if we lose the building, these teams go home, this team moves to the other site, and this work goes to a vendor under an agreement we signed last year. The plan is the procedure that carries out that choice at 2 AM.
ISO 22301:2019, the international standard for business continuity management systems, treats it the same way. Its strategy requirements (clause 8.3) come after the business impact analysis and risk assessment, and they ask you to identify, select, resource, and implement solutions based on what those analyses found. Strategy follows impact. It doesn’t come from a brainstorm.
That order matters. If you choose strategies before you know which processes matter and how fast they need to come back, you will either overspend on things that can wait or underinvest in the things that can’t.
Start With Four Consequences, Not 30 Scenarios
Most continuity conversations drift into what I described on Managing Uncertainty, Episode 7 as “fanciful discussions about here’s the top 30 things that can happen, and we need to have a plan for all of these things.”
There is some validity to the list. But a flood and a fire both cost you the building. A ransomware attack and a cloud outage both cost you technology. The causes are endless. The consequences are not.
Every disruption produces one or more of four consequences:
- Loss of workforce. Your people can’t work, or can’t get to work.
- Loss of workplace. A facility is damaged, closed, or unreachable.
- Loss of technology. Systems, applications, networks, or data are unavailable.
- Loss of a critical third party. A vendor or partner you depend on can’t deliver.
Build your business continuity strategy around those four, and one set of strategies covers hundreds of scenarios. The planning section of our Ultimate Guide to Business Continuity uses the same structure.
Business Continuity Recovery Strategies for Each Consequence
For each consequence, build a short menu of options. For every option, know how long it takes to put in place and how long you can sustain it.
Loss of workforce
People are dealing with their own losses in a disruption, or they’re sick. Your options:
- Reallocate the work to another team or location.
- Cross-train so more than one person can do each critical task.
- Pay overtime, bring in temporary staff, or call back retirees and former employees who know the work.
- Shift the work to a vendor, with the agreement signed in advance. Negotiating during the disruption means paying whatever the vendor asks.
Loss of workplace
For most office roles, the default strategy is already in place: a laptop, VPN access, and a home with power. The harder questions are about the work that can’t go home: a production line, specialized equipment, a lab, a mailroom. That work needs a pre-planned alternate site, a contract for equipment, or another location that can absorb it.
Test your assumptions about the rest. Before founding Bryghtpath, I led crisis management and business continuity at Target. A water leak flooded several floors of our Minneapolis headquarters over a weekend and displaced hundreds of employees. We set up temporary space in another building, and, as I said on the show, “literally one person came.” Everyone else had simply worked remotely. Our plans didn’t call for that.
Alternate workspace planning built on seat counts from years ago is probably wrong for how your organization works today. A return-to-office mandate can quietly turn a building back into a single point of failure.
Loss of technology
This is where you challenge every claim of criticality. Business units have told us, “Well I need to be able to send email within an hour of a disruption.” Our answer: “Why?” Phone, chat, and face-to-face conversation still work. Or, as I put it on Episode 7: “Don’t be afraid, the phone is how people used to communicate.”
Some technology really is the business. In healthcare, electronic medical records “can really not ever go down.” When technology is the product, recovery strategy and IT disaster recovery become the same conversation.
Two numbers anchor this part of the strategy:
| Metric | What it means | Example |
| Recovery Time Objective (RTO) | How long a process or system can be down before the impact becomes unacceptable | Claims intake back within 24 hours |
| Recovery Point Objective (RPO) | The point in time to which data must be recovered, which sets how much data loss you can tolerate | No more than 15 minutes of lost transactions |
The business sets these in the business impact analysis. IT builds recovery capabilities to meet them. When those two don’t match, you have a gap nobody has priced. Our Ultimate Guide to IT Disaster Recovery covers how to close it.
Loss of a critical third party
If a vendor does most of your back-end processing, that vendor’s recovery is your recovery. Know your critical vendors’ business continuity and disaster recovery plans, and know what your contract says about service levels during a disruption.
Before founding Bryghtpath, my team at Target found a critical vendor with no plans at all. The risk was accepted. When that vendor was disrupted, it “turned out to be pretty detrimental to the business because indeed they could not function.” Leadership can accept that kind of risk. They should do it knowingly, in writing, with someone’s name attached.
Hunt for Single Points of Failure
The four consequences tell you what to plan for. Single points of failure tell you where you’re most exposed. The question I asked on Managing Uncertainty, Episode 106 still holds: “Is there a single point of failure in one geography, one facility, one piece of software, one server, or one person?”
One person is the one most organizations miss. The analyst who is the only one who knows how to run month-end close is a continuity risk, whatever the org chart says.
How to Build Your Business Continuity Strategy
When we build a strategy with a client, we follow the same four steps we use for every program: Diagnose. Design. Deliver. Evolve. In practice, that looks like this:
- Start from the business. What does the organization have to deliver to customers, regulators, and its own strategy? Continuity exists to protect that, not to complete a template.
- Run the business impact analysis and challenge the results. Identify your critical processes, their RTOs, and their dependencies on people, facilities, technology, and vendors. Push back on every “we need it in an hour.”
- Build a strategy menu by consequence. For each critical process, list the options for losing its workforce, workplace, technology, and key vendors, with time to implement and how long each can be sustained.
- Price the gaps and get decisions. Compare what the business needs with what you can do today. Take the gaps to your executives with a cost to close each one. They fund it or they accept the risk. Both are legitimate decisions. Leaving it undecided is not.
- Write the strategies into plans the business owns. Business units write and own their plans. The continuity team provides the framework and holds them to it.
- Exercise the strategy, not just the plan. A tabletop exercise should ask whether the alternate site, the vendor agreement, and the recovery time actually hold up. Our business continuity exercises are built to test exactly that.
- Revisit it every year. Your workforce, facilities, systems, and vendors change. The strategy has to change with them. That annual rhythm is the business continuity lifecycle.
Where Business Continuity Strategies Fail
- Built for a short outage. The pandemic taught us that some disruptions are not 72-hour events. As I said in 2020, “It’s here for the long haul.” Know how long each strategy can be sustained, not just how fast it starts.
- Never funded. A strategy that depends on a contract nobody signed or equipment nobody bought is a hope.
- Built on yesterday’s workplace. Alternate sites sized for people who now work from home, and no plan for the work that never could.
- Stopped at IT. Technology recovery without workforce, workplace, and vendor strategies leaves the business with servers and nobody to run the process.
- Vendor risk accepted by no one. The critical vendor without a plan is everyone’s assumption and nobody’s decision.
Your business continuity strategy is the decision you make before the disruption. Everything after that is execution.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity.
- Build your strategy with us. Our Business Continuity services take you from business impact analysis to funded recovery strategies and plans your business units own.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your continuity strategy with us.
