Business continuity plans and procedures
Maintain a response structure, warning and communication, plans for prioritized activities and recovery procedures, derived from the solutions and available where responders are.
01What applies
Maintain a response structure and a set of plans and procedures that let the organization warn and communicate, respond in a structured way, continue prioritized activities and return to normal operation. The clause covers the response structure, warning and communication, the plans and recovery. It expects the plan set to derive from the selected strategies and solutions, and it expects the plans to be available where the responders are. A plan that documents response and stops before return to normal operation leaves the organization in a managed emergency with no route out.
02Why it matters
A plan is read under pressure by someone who did not write it. The clause asks for a structure that tells that person who is in charge, how to warn people, what to continue first and how to get back to normal. The link to the selected solutions matters: a plan that assumes capability the organization never built is worse than no plan, because it creates false confidence.
03What good looks like
Write the plan set from the strategy, not from the last plan. Give every plan a named owner, a trigger, a first hour, a first day and a recovery path. Put the first-hour page on one side of A4. Place copies where responders work and test retrieval in an exercise. Review the plan whenever a solution, a supplier or a critical system changes.
04Evidence an auditor asks for
Ask a responder to open the plan for the service they own on the device they would have in a disruption. If it is only on the intranet, the plan is not available.
| Evidence | The record |
|---|---|
| Plan set | Current plans covering response structure, warning and communication, continuity and recovery |
| Derivation | Traceability from each plan to the selected strategies and solutions |
| Availability | Distribution evidence showing plans are where responders are |
| Recovery | Recovery procedures and a record that proves return to normal operation |
05Where it commonly fails
- Plan set documents response but stops short of return to normal operation
- Plans assume capability that was never built
- Plans available only in one location or one format
06What to do before the estimate
Take the two most critical services and rewrite their first-hour page. Put a copy wherever their responders work.