Most organizations shopping for business continuity services ask the wrong question. They ask, “Who can write our plans?” The better question is, “Who runs the program after the plans are written?”
That second question is what managed business continuity answers. A senior outside team runs your program day to day: the Business Impact Analysis (BIA), the plans, the exercises, the audit preparation, and the executive reporting. Your people keep the decisions.
A disclosure: Bryghtpath sells this. We run business continuity programs for clients through Business Continuity as a Service (BCaaS), and we run full resilience programs through Resilience as a Service. So this post is specific about what you should outsource, and just as specific about what you should never hand to anyone outside your walls.
| Old View | New View |
| Business continuity services means a consultant writes the plans | Business continuity services means someone runs the program, every week, after the plans exist |
| Outsourcing means losing control | Outsourcing means choosing who does the work while you keep the decisions |
| The provider owns the program | The provider runs the program; your executives own it |
| We outsource because we can’t afford to do it right | We outsource because one person can’t cover the full lifecycle, and the program can’t stop when that person leaves |
What Managed Business Continuity Services Are
On the Managing Uncertainty podcast, I defined it this way: “Business continuity as a service is the practice of contracting with a third-party firm to design, build, execute, and maintain your resiliency program.” I walked through the model in detail in Managing Uncertainty, Episode 109: Business Continuity as a Service.
The key word is execute. Business continuity services come in four forms, and only the last two run the program:
- Project consulting. A firm builds a deliverable, a BIA or a set of plans, and hands it back. The ongoing work stays with you, and that is usually where programs stall.
- Advisory retainer. A firm answers questions and reviews your work. Useful if you have the hands and need judgment. Not useful if hands are the problem.
- Business Continuity as a Service. A senior team runs the business continuity program on your behalf, every day.
- Resilience as a Service. The same managed model across business continuity, crisis management, IT disaster recovery, and exercises, run as one program.
BCaaS or Resilience as a Service?
Pick by what you are carrying.
If your gap is business continuity alone, BCaaS fits: BIA, plans, governance, exercises, and audit readiness. If you are also carrying crisis management, IT disaster recovery, or an exercise program, splitting them across three providers recreates the problem you are trying to solve. Two crisis teams with overlapping responsibilities. A BIA that says one thing and an IT recovery plan that says another. Resilience as a Service runs all of it under one governance structure and one operating rhythm.
Most clients start with one capability and expand once they see the program running. Some start with the BIA alone.
What a Managed Program Should Run
Whatever the scope, a managed business continuity program should deliver the full annual lifecycle, not a document set. At minimum:
- The BIA, on a defined cadence. Not a one-time exercise. A BIA that is three years old is an opinion.
- Plans people can use under pressure, maintained as the business changes, not refreshed once a year for the auditor.
- Governance support. Steering committee preparation, policy, and the program structure that keeps business units accountable for their commitments.
- Exercises on a calendar. Tabletop exercises, microsimulations, and functional exercises, followed by After-Action Reports (AARs) with owners and dates.
- IT disaster recovery alignment. Someone has to show the gap between what the business expects to recover and what IT can actually recover.
- Audit and regulatory readiness against the frameworks that apply to you: ISO 22301, FFIEC, NIST CSF, HITRUST, HIPAA, FINRA.
- Executive reporting in the language your executives use: where the risk sits, what it costs to buy it down, and what the investment returned.
A provider should also work in whatever business continuity software you already own. A platform vendor’s services team knows one tool. You need someone who knows the program.
What to Keep In-House
This is the part most providers skip. You can hand off the work. You cannot hand off ownership.
Keep these inside, no matter who runs the program:
- Executive sponsorship. A named executive who funds the program, clears obstacles, and shows up to the exercise. No outside firm can be your sponsor.
- The risk decisions. Which processes get a four-hour recovery time and which get four days. Which gaps you fix and which you formally accept. Your provider frames the trade-off. Your executives make the call.
- Plan ownership in the business. Business unit leaders own their plans. The managed team facilitates, writes, and maintains. When a plan belongs to the consultant, the business stops reading it.
- Crisis decisions. During a real disruption, your crisis team and your executives decide. A good provider is in the room supporting them, with the plan, the data, and the options. It doesn’t decide for you.
- An internal point of contact. Even in a fully managed program, someone inside must own the relationship, escalate blockers, and carry the program into rooms the provider can’t enter.
That last item is why the hybrid model is so common. A strong internal lead owns governance and relationships. The outside team does the BIA, plan maintenance, and exercises. The lead stops drowning in production work and starts leading the program.
When Outsourcing Business Continuity Makes Sense
Managed engagements rarely start because someone read a brochure. They start because something happened. These are the lines we hear from the people who call us:
- A capacity gap: “I don’t have enough time and hands.”
- A champion exit: “My champion left. I inherited this program and I don’t know what’s real.”
- A compliance deadline: “HITRUST is in eight months. The lifecycle has to be buttoned up.”
- A scattered program: “OneNote is the BC tool. Crap is all over the place.”
- A greenfield build: “I need someone to help me build this from scratch.”
There is also a case for staying in-house. Build your own team when the program is large and stable, when business continuity is tightly bound to daily operations (common in critical infrastructure), and when you can afford two or three trained people. Redundancy solves the single-point-of-failure problem. One person does not.
What Business Continuity Services Cost
Compare the full cost, not one salary against one quote. In our breakdown of business continuity program cost, an experienced business continuity manager runs about $185,000 a year fully loaded, before software, training, and the months it takes to hire and ramp. That buys one person, with no backup.
Our BCaaS engagements start at $150,000 a year and can run into the high six figures, depending on the number of business units, sites, plans, and regulatory frameworks in play. The article shows the math and says plainly when in-house is the better answer.
How to Make a Managed Program Work
Outsourced programs fail for the same reasons internal ones do: vague scope and nobody watching. Five practices keep a managed engagement honest:
- Write the scope in plain English. What the provider delivers, by when, and what “done” means.
- Tie reporting to deliverables and milestones, not hours.
- Hold a weekly or biweekly status review with your internal point of contact.
- Review the program with leadership every quarter. Maturity, exercise findings, open actions, and the risks you accepted.
- Set a clear escalation path for the business unit that won’t schedule its BIA.
Start with a baseline. Most BCaaS engagements we run begin with a Resiliency Diagnosis®, so both sides agree on where the program stands before anyone starts running it. For the mechanics of the transition itself, see how to outsource your continuity program.
What It Looks Like in Practice
A major health insurance provider came to us with a faltering business continuity program that had lost organizational credibility. We started with an ISO 22301-based Resiliency Diagnosis®, simplified the program, and took over day-to-day management: the business continuity lifecycle for more than 100 plans and several hundred BIAs, tabletop exercises for each critical capability, steering committee management, and an annual maturity evaluation. Working with IT, we surfaced the gaps between what the business expected and what IT could recover. The outcome the client cared about most was improved credibility with the C-suite and board.
The insurer’s executives still owned the program. We ran it.
Outsource the work. Keep the decisions. That is managed business continuity done right.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity.
- See how BCaaS works. Business Continuity as a Service puts your program in the hands of senior practitioners who run it day to day.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through who should run your program.
