The Ultimate Guide to Business Continuity

Last updated: November 2026

Most organizations have business continuity plans. Far fewer have a business continuity program that would hold up on a bad day.

This guide is about building the second one. It covers what a business continuity program is, how to govern it, how to run the Business Impact Analysis (BIA) and write plans that work, how to exercise them, how to measure progress, and which standards to build on. It’s written for the people who own resilience: business continuity managers, directors of resilience, CISOs, CIOs, and the executives who sponsor them.

It’s long. Use the contents to jump to what you need.

In this guide

1. What is business continuity?
2. The value of business continuity
3. Business continuity within the Resilience Operating Model®
4. Business continuity policy
5. Roles and responsibilities
6. Governance and executive sponsorship
7. The steering committee
8. The business continuity lifecycle
9. The Business Impact Analysis (BIA)
10. Business continuity plans
11. Business continuity and IT disaster recovery
12. Third-party and supply chain resilience
13. Exercising your plans
14. Program metrics
15. Plan-Do-Check-Act
16. Awareness and culture
17. Standards
18. Operational resilience
19. Software
20. Evaluating your program
21. What a program costs
22. Case studies
23. Getting help
24. Certifications
25. Where to learn more
26. Frequently asked questions

What is Business Continuity?

Business continuity is the capability that keeps your organization delivering what matters when something goes wrong. A business continuity program is how you build that capability and keep it current.

It’s easiest to start with what a program is not. A business continuity program is not:

• A business continuity plan on its own
• An IT disaster recovery plan
• A software subscription
• An insurance policy
• A template, a checklist, and a one-hour web training module nobody remembers

Each of those can be part of a program. None of them is the program.

The program is the system that embeds continuity into how your organization runs: you understand what matters most, you plan how to keep it going, you practice, and you improve. It protects your most important assets during a disruption, starting with your people.

ISO 22300 defines business continuity as:

The capability of an organization to continue the delivery of products and services within acceptable time frames at predefined capacity during a disruption.

That definition is the right test. “Acceptable time frames” and “predefined capacity” mean you decided in advance what has to keep working, how fast, and at what level. A program that can’t answer those questions isn’t ready.

The Value of Business Continuity

Every business continuity leader needs a short, practiced answer to “Why do we do this?” Here’s how we help clients make the case:

• It protects your people. A program protects life and safety first, and it lets your team respond and recover faster. Your people are your most important crisis tool.
• It protects your most important assets. A good program identifies what matters most and builds a plan to protect it before you need one.
• It protects your reputation. Reputations take decades to build and minutes to lose. When the heat wave takes down the grid, you don’t want to be the hospital remembered for patients suffering in the heat.
• It meets compliance obligations. Continuity is an explicit requirement in many frameworks, including PCI DSS for payment data, HITRUST for health information, and the FFIEC’s Business Continuity Management booklet for banks.
• It strengthens risk management. Business continuity identifies the risks that matter most to operations. Enterprise risk management and continuity teams that work together create far more value than either does alone.

Go deeper: What’s the Value of Business Continuity: Beyond ROI, Making the Case for Your Business Continuity Program, and Executive Buy-In for Business Continuity.

Business Continuity Within the Resilience Operating Model®

Business continuity matters. It is also one part of something bigger.

ISO 22316 defines organizational resilience as “the ability of an organization to absorb and adapt in a changing environment to enable it to deliver its objectives and to survive and prosper.” That’s accurate, and it leaves a lot unsaid. In practice, resilience is a set of capabilities that work together to protect your people, keep operations running, and solve big problems.

We organize those capabilities in the Resilience Operating Model®. It has eight core domains:

• Business continuity
• Crisis management
• Crisis communications
• IT disaster recovery
• Information security and cyber resilience
• Life safety and emergency procedures
• Physical security
• Enterprise risk management

Six enabling functions hold the domains together: governance, operating cadence, escalation and decision-making, metrics and maturity, training and exercises, and culture and capability building.

The point is integration. One governance structure, one escalation path, coordinated exercises, and unified reporting. Not a binder, not a plan, but a way of operating.

We build and run programs with the same four steps every time: Diagnose. Design. Deliver. Evolve. You’ll see that sequence throughout this guide.

Go deeper: The Resilience Operating Model® whitepaper and Our Proven Process.

Business Continuity Policy

Your policy is the program’s charter. ISO 22301 (clause 5.2.1) requires a business continuity policy that:

• Is appropriate to the purpose of the organization. It fits your size, scope, and strategy.
• Provides a framework for setting business continuity objectives. In practice, that means a governance process, usually a steering committee, that sets objectives and tracks progress.
• Commits to satisfying applicable requirements. That includes the regulations and frameworks that apply to you: HITRUST, FFIEC, PCI DSS, ISO 22301, and others.
• Commits to continual improvement of the business continuity management system.

Clause 5.2.2 adds that the policy must be documented, communicated within the organization, and available to interested parties as appropriate.

We use the policy for more than compliance. A good policy:

• Defines business continuity, IT disaster recovery, and crisis management, and assigns ownership of each
• Delegates authority to the program
• Sets governance and accountability requirements
• Defines the roles of executive sponsors and the steering committee

Go deeper: Crafting a Business Continuity Policy.

Roles and Responsibilities

Business continuity and crisis management usually live in the same program, whatever you call it: business continuity, resilience, or something else. Either way, the program needs clear roles. These are the ones that matter most:

• Board of directors. Strategic oversight of continuity and crisis management, and a culture that values managing risk well.
• Audit or risk committee. Usually holds the board’s delegated oversight, as set in its charter.
• Executive team. Each executive owns continuity and crisis readiness for their area.
• Executive sponsor. One or two executives, often the general counsel, COO, CIO, or CTO, who oversee the program and usually chair the steering committee.
• Steering committee. Six to eight leaders across the business who meet at least quarterly to align the program with strategy and keep it moving.
• Program manager. Runs the program day to day, sets expectations for the year, and reports on progress.

Go deeper: Business Continuity Program Roles and Responsibilities.

Governance and Executive Sponsorship

Governance isn’t bureaucratic box-checking. It’s the answer to the three problems we hear most:

• Executives don’t care about the program
• Other teams won’t participate
• IT won’t build the recovery capabilities the business needs

Good governance means the right people, policies, and practices to direct the program. It builds visibility, surfaces gaps, creates accountability, and supports ISO 22301 conformance. Start with three things: get your policy in place, set clear roles, and build a strong steering committee.

Then find an executive sponsor who will champion the program. The best sponsors:

• Make the case for continuity with their peers, unprompted
• Push your agenda forward without apologizing for it
• Warn you about strategic changes before they land
• Mentor you and your team

Go deeper: Why Good Business Continuity Governance Is Critical to Resilience and How to Champion Your Business Continuity Program as an Executive Sponsor.

The Business Continuity Steering Committee

The steering committee is where governance actually happens. It’s also the best forum you have for sharing strategy, progress, and problems with the leaders who can help.

Typical responsibilities:

• Provide strategic direction so the program meets its objectives
• Promote ownership and accountability in the business units
• Set priorities for execution and risk mitigation
• Make sure the program has the resources it needs
• Review program metrics
• Review gaps, such as the difference between the recovery times the business needs and what IT can deliver, and decide whether to resolve, mitigate, or accept them
• Drive improvement through reviews of policy, objectives, audit results, and After-Action Reports (AARs) from exercises and real events

Your executive sponsor usually leads it, with six to eight leaders from the major business and support functions. Always include a senior IT leader; almost every critical process depends on technology.

Meet at least quarterly. When you’re launching a program, meet monthly until it’s running.

The Business Continuity Lifecycle

Business continuity is a cycle, not a project. The most common mistake we see is treating it as linear: assess the threats, write the plans, run an exercise, check the box. The program goes flat, and the plans drift out of date while the business keeps changing.

The annual lifecycle has four parts:

• Assess. Identify critical processes and the impact of losing them, through the BIA.
• Plan. Write the procedures to recover those processes.
• Exercise. Validate the plans and build muscle memory.
• Mature. Maintain the plans and fix what the exercises found.

Then you do it again, because your business and its risks keep moving. Like fitness, resilience fades if you stop training, and your routine has to change as your body and environment change.

Go deeper: our Business Continuity Lifecycle (the same process we use in Business Continuity as a Service), What (Almost) Everyone Gets Wrong About the Business Continuity Lifecycle, and Managing Uncertainty Episode #102.

The Business Impact Analysis (BIA)

How many days can payroll be down before it hurts the business? What about the systems your customers use, or the VPN your remote staff depend on? An hour? A day? Two weeks?

If you don’t know, you need a Business Impact Analysis.

ISO 22301 defines the BIA as “the process of analyzing the impact over time of a disruption on the organization.” Put simply, a BIA shows what a disruption would do to your revenue, expenses, operations, and reputation, and how that damage grows over time.

Recovery time objectives

Disruptions rarely hit one thing. If a hurricane takes out your data center, customers may be locked out, payroll may be down, and the intranet may be gone, all at once.

The costly mistake is trying to recover everything at the same time. The BIA prevents it by assigning each process and system a recovery time objective (RTO): the longest it can be down before the impact becomes unacceptable. Revenue-generating systems usually come first. Payroll matters, but it can usually wait behind them. With RTOs set, you have a recovery order, and that’s the foundation of your plans.

How we run a BIA

• Scope it. A short criticality survey narrows the BIA to the processes that truly need fast recovery.
• Schedule interviews and send prework. Simple questions about responsibilities and past disruptions, so people arrive prepared.
• Interview. This is where the real findings come from: RTOs and dependencies on technology, vendors, facilities, and other processes.
• Report. Impacts on revenue, expenses, and reputation; recovery priorities; and how operations depend on each other.

Without a BIA, you’re guessing at priorities and may miss critical processes entirely. With one, you protect the most important things first and recover the rest in order.

Go deeper: What Is a Business Impact Analysis (BIA)?

Business Continuity Plans

How long does planning take, and who should be involved? It depends on your size, locations, industry, and starting point. Here’s the process we use with clients.

1. Agree on the fundamentals

Everyone wants the same outcome: keep running through a disruption. Agree up front on the plan’s objectives, who owns writing and activating it, and what resources you have.

2. Assess risks and impacts

A plan is only as good as its assumptions. The BIA gives you accurate ones.

3. Select your response and recovery strategies

Comparing what the BIA says you need with what you can do today will expose gaps. Build a menu of strategies to close them, organized by the four consequences of any disruption: loss of workforce, workplace, technology, or third parties. For each strategy, estimate how long it takes to put in place and how long you can sustain it. Plan for consequences, not scenarios. A flood and a fire both cost you the building.

4. Build your response and recovery roadmap

Turn the strategies into procedures your team can follow: assess the disruption, activate the right strategy, and carry it through.

Roles change, people leave, and technology evolves. Review your plans at least annually and after every activation or exercise.

Go deeper: 4 Steps to Business Continuity Planning Success.

Business Continuity and IT Disaster Recovery

The gap between business continuity and IT disaster recovery is one of the most expensive problems we find, and one of the least discussed.

One client’s business needed several critical systems back within 24 hours. The IT disaster recovery plans for those systems were built for seven days. That six-day gap had never been tested, and it could have become a multimillion-dollar problem.

It happens because business continuity programs rarely give IT the data it needs, in the form and frequency it needs it. So IT guesses at availability requirements, recovery time objectives (RTOs), and recovery point objectives (RPOs).

• RTO is the longest a process or system can be down before the impact becomes unacceptable.
• RPO is the point in time to which data must be recovered, which defines how much data loss you can tolerate.

Three ways to close the gap:

1. Give IT a seat on the steering committee. IT should own disaster recovery, and its input belongs in the program’s decisions.
2. Design the BIA to capture what IT needs. Expecting IT to build the right recovery without the right data is like building a car with no gas tank.
3. Use the standard. ISO 27031 covers technology readiness for business continuity, including IT-led recovery exercises.

Go deeper: The Ultimate Guide to IT Disaster Recovery, Closing the Gap Between Business Continuity and IT Disaster Recovery, and our IT disaster recovery consulting.

Third-Party and Supply Chain Resilience

“Companies routinely exaggerate the attractiveness of foreign markets, and that can lead to expensive mistakes.” Pankaj Ghemawat wrote that in 2001, in his Harvard Business Review article “Distance Still Matters: The Hard Reality of Global Expansion.” The pandemic proved him right.

The lesson for continuity: your business is only as resilient as your third parties. If they’re not in your planning, you’re less resilient than you think. Leaving them out is like locking the front door and leaving the garage open.

Three steps:

1. Manage supply chain risk at the program level, not one contract at a time
2. Identify the vendors whose failure would hurt you most
3. Exercise with your critical vendors, not just about them

Go deeper: Your Supply Chain May Not Be as Resilient as You Think and our third-party exercises.

Exercising Your Business Continuity Plans

Untested plans are assumptions with formatting.

An exercise is where you find out whether your plans, your dependencies, your recovery capabilities, and your people actually work together. It’s also where you find the gaps while they’re cheap to fix.

Choose the right format

• Tabletop exercise. A facilitated, discussion-based session where teams walk through a realistic scenario and make the decisions the plan calls for. The right starting point for most programs. See tabletop exercises.
• Functional exercise. Teams carry out specific procedures, such as relocating a function or running a manual workaround, under time pressure.
• Recovery exercise. IT disaster recovery and business recovery together, proving that systems come back in the order and time the business needs.
• Simulation. A full-scale, multi-team exercise run through real channels with a live control cell. See crisis simulation exercises.

Exercise the seams

Plans rarely fail inside one team. They fail at the handoffs: between business continuity and IT, between your team and a critical vendor, between the crisis team and the executives. Design exercises that test those seams.

How often

Exercise plans for critical functions at least annually, and after any major change to the business or the plan. Mature programs run smaller exercises through the year and a major exercise every one to two years.

Close the loop

Run a hot wash immediately after the exercise and deliver a formal After-Action Report (AAR) within 7 to 10 days. The AAR should be a prioritized work plan, not a summary. If the findings don’t get fixed, the exercise was a meeting.

Go deeper: business continuity exercises, the Bryghtpath Scenario Library, Exercise in a Box® if you want to run it yourself, and How to Choose a Tabletop Exercise Facilitator.

Business Continuity Program Metrics

Should you track metrics? Yes. The real question is which ones.

Do you want to know whether your program works, or whether the boxes are checked? Those aren’t the same thing. Compliance tracking alone won’t tell you whether your organization would recover. You need three kinds of metrics.

1. Operational compliance

The foundation. Track, by business unit or plan:

• BIA completion
• Plan completion or updates
• Exercise completion
• Whether exercise findings were fixed

A spreadsheet works for a small organization. Large, complex ones need something more robust.

2. Plan quality

A program is only as good as its plans. Score each plan, often on a 1 to 10 rubric, against standards and your own requirements: completeness, quality of recovery procedures, whether risks with no workaround have been formally accepted, exercise participation, and ongoing training. Quality scoring tells you whether a plan would work, not just whether it exists.

3. Program maturity

Maturity is the measure that matters most over time. We score programs against ISO 22301 using the ResiliencyPulse maturity model, which shows where the gaps are and what it takes to close them.

Getting metrics right

• Start. Track something now and improve it later.
• Tie metrics to business objectives. That connection is what wins resources.
• Fit the tool to the job. Hundreds of plans across dozens of units may justify business continuity software. A smaller program may not.

Go deeper: 3 Key Metrics for Business Continuity Program Success.

Plan-Do-Check-Act (PDCA)

Ad hoc efforts produce ad hoc results. If your program doesn’t have a system for improving itself, Plan-Do-Check-Act is the place to start.

PDCA, originally the Deming-Shewhart cycle, underpins ISO management system standards, including ISO 22301, along with Lean and Kaizen:

• Plan. Set objectives, processes, and resources.
• Do. Run the program as planned.
• Check. Measure the results.
• Act. Fix what you found and improve.

It never ends, and that’s the point. Applied consistently, it moves a program steadily up the maturity curve.

Go deeper: Plan-Do-Check-Act and Your Business Continuity Program.

Business Continuity Awareness and Culture

In most organizations, people only hear about business continuity when it’s time to update the BIA, or when something has already gone wrong. That’s a missed opportunity.

When I was first asked to take over my employer’s business continuity program, I told my future boss I knew very little about business continuity and would be a bad fit. He laughed. “I don’t need a subject matter expert, Bryan. I need someone who can communicate and can market and promote the program across the company.”

He was right.

Tell your program’s story

Start with why. Why does the program exist? How does it support the company’s strategy? Put that story into what I call a walkaround deck. I printed mine and carried it in my planner so I could tell the story to anyone, any time, usually over coffee with a peer from another part of the business. Keep it current, and get it in front of every team meeting, all-hands, and leadership forum that will have you.

Make communications your best friend

Your internal communications team controls the channels: intranet, newsletters, digital signage, internal social. Learn how to submit content, and commit to one strong piece every month or quarter that reinforces your story.

Make yourself important

Too many continuity professionals stay behind the scenes. Successful programs have leaders who keep telling the story, winning allies, and converting skeptics.

Go deeper: Effective Business Continuity Awareness Campaigns and Building a Resilience Culture in Your Organization.

Business Continuity Standards

There’s no single business continuity standard, but several widely accepted ones give you a proven structure so you don’t reinvent the wheel.

ISO 22301: Business continuity management systems

The International Organization for Standardization (ISO) publishes voluntary standards; it doesn’t enforce them. ISO 22301 sets the requirements for a business continuity management system and works alongside ISO’s standards for risk management, information security, and technology recovery. It’s the basis we most often use for the Resiliency Diagnosis®.

NFPA 1660: Emergency, continuity, and crisis management

NFPA 1660 is the U.S. standard for emergency management, business continuity, and crisis management programs, and it’s used internationally as well. It replaced NFPA 1600 in 2024, when the National Fire Protection Association combined 1600 with its standards on mass evacuation and sheltering (NFPA 1616) and pre-incident planning (NFPA 1620).

NFPA 1600 built the reputation. After 9/11, the Department of Homeland Security adopted it as a voluntary consensus standard for emergency preparedness, and the 9/11 Commission recognized it as the national preparedness standard. NFPA 1660 carries that framework forward. Like its predecessor, it’s voluntary. Use it to test your program’s management, planning, implementation, training, exercises, and continuous improvement.

ASIS Business Continuity Management Guideline

Published by ASIS International, the ASIS guideline is a practical, plain-language outline for building a program. It’s less widely used than ISO 22301, but easy to work from.

ICS and NIMS

The Incident Command System (ICS) is how public agencies manage emergencies, and it sits inside FEMA’s National Incident Management System (NIMS). Utilities and hospitals often use ICS-aligned structures to work alongside public agencies. NIMS doesn’t tell you how to organize a corporate crisis program, but its principles translate well. FEMA’s ICS Resource Center has more.

Hospital Incident Command System (HICS)

HICS adapts incident command to hospitals, for emergencies and planned events alike. The California Emergency Medical Services Authority publishes the HICS guidebook. See our overview of HICS.

Industry requirements

If you’re regulated, your regulator’s expectations sit on top of these standards: the FFIEC Business Continuity Management booklet for U.S. financial institutions, HITRUST and HIPAA in healthcare, and the operational resilience rules covered in the next section.

Go deeper: Business Continuity Standards: How Each Can Help You and Managing Uncertainty Episode #124.

Operational Resilience and Business Continuity

If you work in or near financial services, “operational resilience” has probably replaced “business continuity” in your regulator’s vocabulary. It isn’t a replacement for business continuity. It’s a change in the question.

Business continuity asks: how do we recover this process? Operational resilience asks: can we keep delivering the services our customers depend on, within limits we’ve set in advance, no matter what disrupts them?

The idea came from financial regulators after the 2008 crisis and a run of high-profile banking IT failures:

• United Kingdom. The Bank of England, PRA, and FCA required firms to identify their important business services and set impact tolerances by March 31, 2022, and to be able to stay within those tolerances by March 31, 2025.
• European Union. The Digital Operational Resilience Act (DORA) has applied to financial entities since January 17, 2025.
• United States. The Federal Reserve, OCC, and FDIC published Sound Practices to Strengthen Operational Resilience in October 2020 for the largest banks. It created no new rules, but it set clear expectations.
• Internationally. The Basel Committee issued its Principles for Operational Resilience in March 2021.

What changes in practice: you start from the services that matter to customers, map everything those services depend on, set a tolerance for how much disruption is acceptable, and test against severe but plausible scenarios. Your BIA, plans, IT disaster recovery, third-party management, and crisis management all still matter. Operational resilience is what happens when they’re run as one system, which is exactly what the Resilience Operating Model® is built to do.

Go deeper: Resilience as a Service, where we run business continuity, crisis management, IT disaster recovery, and exercises as one program.

Business Continuity Software

Do you need business continuity software? If you manage a handful of plans, probably not yet. If you manage hundreds of plans and BIAs across many business units and locations, spreadsheets will eventually fail you.

When you evaluate platforms, ask:

• Does it meet your most important needs?
• Does its methodology match yours, or will you bend your program to fit the tool?
• Can the vendor demonstrate every capability it advertises, using your data?

The platforms we see most often:

• Fusion Risk Management. Our usual recommendation, and the platform we implement most. Disclosure: Fusion is a Bryghtpath strategic partner.
• Archer. A long-standing option, often chosen by organizations already using Archer for governance, risk, and compliance.
• ServiceNow. ServiceNow added business continuity management when it acquired Fairchild Resiliency Systems in 2019. It’s a natural fit for organizations already running ServiceNow for IT service management.

Go deeper: How to Choose the Best Business Continuity Software and our business continuity software services.

Evaluating Your Business Continuity Program

When the next significant disruption hits, how will your organization respond? You should know the answer before it happens.

An honest, standards-based evaluation tells you where you stand and what to fix first, whether you have a mature program or no formal program at all. We evaluate programs against ISO 22301, scored with the ResiliencyPulse maturity model on a five-point scale. In our experience, most programs start between 1.5 and 2.5, reach 2.5 to 3.5 within two years, and sustain 3.5 to 4.5 when they’re well run.

That’s the core of our Resiliency Diagnosis®: stakeholder interviews, an assessment against the standards that apply to you, a maturity score, and a prioritized roadmap, typically in about 12 weeks.

Go deeper: What a Business Continuity Maturity Assessment Should Tell You (and What an Audit Won’t).

What a Business Continuity Program Costs

The honest answer depends on your size, regulatory exposure, and starting point. The bigger question is how you staff it.

Most organizations choose one of three models: build an in-house team, outsource the program, or combine the two. In-house teams carry fixed costs and are hard to hire and scale. Outsourced programs trade some control for senior expertise on day one and capacity that flexes when a disruption hits. Hybrid models keep ownership inside and bring in help for the BIA, exercises, or audits.

Before you compare costs, compare what you’re actually buying: who runs the BIA, who exercises the plans, who keeps everything current, and who answers the phone at 2 a.m.

Go deeper: Business Continuity Program Cost: In-House vs Outsourced, With the Real Math.

Business Continuity Case Studies

All of our case studies are anonymized.

• Resilience as a Service for a health insurance leader. A leading Midwest health insurer with no dedicated continuity or crisis staff turned to Bryghtpath to run business continuity, crisis management, and IT disaster recovery as one integrated program. Read the case study.
• Business Continuity as a Service for a major health insurance provider. A faltering program that had lost organizational credibility was rebuilt on an ISO 22301 foundation, with more than 100 business continuity plans and several hundred BIAs now running on a regular lifecycle. Read the case study.
• Program evaluation for a global retailer. Following a major data incident, a U.S.-based global retailer used the Resiliency Diagnosis® to evaluate its business continuity, crisis management, and disaster recovery programs against ISO 22301, with a roadmap presented to executives and the board. Read the case study.
• Business continuity software for a healthcare system. A leading healthcare system replaced spreadsheets and documents with a business continuity platform, with Bryghtpath leading requirements, selection, and implementation. Read the case study.
• Business Continuity as a Service for a major healthcare technology company. Bryghtpath has run the company’s business continuity, crisis management, and disaster recovery program day to day for several years. Read the case study.
• Transforming a major utility’s continuity strategy. A major U.S. electric, natural gas, and nuclear energy company used the Resiliency Diagnosis® to evaluate its program, then retained Bryghtpath for the multi-year build-out. Read the case study.

See all case studies.

Getting Help with Your Business Continuity Program

Building and running a program is a lot of work. There are four ways to get help, depending on what you need.

A trusted advisor

An advisor on retainer gives you an outside view of how your program compares, someone who picks up the phone during a disruption, help with media inquiries and executive or board briefings, and a wider network of information when local sources fall short.

A consultant for a defined project

If you have the people but need expertise for a specific piece, such as a BIA, a plan rebuild, an exercise, or an evaluation, a consultant can do that work alongside your team and leave the capability behind. Ask whether your team has current, broad enough knowledge to do it well, whether training would close the gap, and whether a consultant working with your team would get you there faster.

Coaching

Sometimes the program is in place and you’re working harder than ever, but it isn’t moving. A coach gives you an outside perspective, validates your ideas, helps you get leadership on board, and helps you build your own playbook. See our coaching for resilience leaders, from a single 1-on-1 session to private coaching.

Outsourcing the program

You can hand the program to a partner who runs it day to day. Organizations choose this when hiring is hard, fixed costs are high, or they need capacity that scales during a disruption. Our Business Continuity as a Service runs your business continuity program; Resilience as a Service runs business continuity, crisis management, IT disaster recovery, and exercises as one.

Go deeper: 8 Things to Consider When Choosing a Business Continuity Consultant, 5 Ways Coaching Can Help Your Program, and Business Continuity as a Service: How to Outsource Your Continuity Program.

Business Continuity Certifications

Do you need a certification to work in business continuity? Not always, but get one as soon as you can. Many roles require one, or expect it within a set time. If you already have the experience and haven’t certified, it stands out. If you grew into the role from inside, a certification adds credibility with leadership and connects you to tools and a professional network. I’ve never met anyone who regretted getting certified. Most wish they’d done it sooner.

The two main certifying bodies:

• DRI International (DRII). Based in the U.S. since 1988, and the most common designation in North America.
• The Business Continuity Institute (BCI). Based in the U.K. since 1994, and more widely recognized in Europe, Asia, Africa, and the Middle East, with a growing presence in North America.

Go deeper: Choosing the Right Business Continuity Certification.

Where to Learn More

Many of the best resources are free.

Free training

• FEMA’s Emergency Management Institute: free courses on continuity of operations, emergency management, and crisis management.
• Bryghtpath’s free intro courses: 101-level courses in business continuity, crisis management, and crisis communications.
• Webinars and videos and our YouTube channel.

Business Continuity, Crisis Management, and Resiliency Facebook group

Connect with hundreds of resilience professionals in our free Facebook group: daily articles, discussion, and a welcoming place to ask questions about your program or career.

Join the free Facebook group

Books

Our Professional Reading List has our best recommendations.

Podcasts

Managing Uncertainty is our weekly podcast on business continuity, crisis management, and crisis communications, with more than 330 episodes. For more recommendations, see Top Business Continuity and Crisis Management Podcasts.

Executive education

• Harvard’s National Preparedness Leadership Initiative
• MIT’s Crisis Management and Business Resiliency course
• PECB’s ISO 22301 certifications

See Top Business Continuity and Crisis Management Executive Programs.

Free resources

Start with The Resilience Roadmap, our whitepaper on 250 ways to fortify your business against disruption, and the Weekly Briefing, our weekly email for resilience leaders. More on our Free Resources page.

Frequently Asked Questions

About the Author

This guide was written by Bryan Strawser, founder and CEO of Bryghtpath.

Bryan has more than 30 years of experience in crisis management, business continuity, and intelligence. Before founding Bryghtpath in 2014, he led crisis management, business continuity, and intelligence at Target. He is a Master Business Continuity Professional (MBCP), a Member of the Business Continuity Institute (MBCI), and a Certified Information Systems Security Professional (CISSP).