What Is Business Continuity? Everything You Need to Know

Business continuity brings together people and technology to help organizations prepare for and overcome interruptions to normal business operations. Business continuity planning encompasses disaster recovery—the restoration of IT services following an unexpected outage—but its purpose is broader. The goal of a business continuity strategy is to keep the business up and running regardless of whether operations are impacted by an unplanned catastrophe, such as an earthquake, or a planned event, such as applying a major infrastructure patch.

What Is Business Continuity?

Business leaders use business continuity as a paradigm for maintaining operations, even if in a temporarily limited capacity, in the event of unexpected or planned disruptions to normal business processes. These disruptions can include natural disasters, cyberattacks, armed conflict or other force majeure, global pandemics, power outages due to storms or flooding, infrastructure failures, planned maintenance activities, and even the unexpected departure of a key employee. Cloud computing technologies such as containerization and virtualization can help make business continuity measures more affordable for companies of all sizes.

Key Takeaways

• Business continuity involves developing processes ahead of time to maintain availability during unexpected or planned disruptions to normal operations.
• Business continuity planning is a methodology for ensuring that a business has the processes in place to maintain critical functions.
• Business continuity planning involves assembling a team, assessing risks, identifying priority operations, and ensuring that a disaster recovery plan is in place that can bring critical IT infrastructure and data back online in a timely manner.
• Business continuity isn’t a one-and-done proposition. The plan has to be practiced and tested regularly so people are familiar with their responsibilities and gaps in the plan can be identified and closed.
• A new generation of cloud computing, containerization in particular, has made business continuity and disaster recovery more efficient and cost-effective than even 10 years ago.

Business Continuity Explained

Businesses typically adopt strategies to thwart existential threats such as established competitors, market entrants, sudden changes in customer behavior or tastes, and technological change.

However, another threat that’s more difficult to plan for is an unexpected, usually temporary event that makes it difficult or impossible for the business to continue operating as usual. Natural events such as hurricanes and prolonged heat waves can result in a loss of the electric power used to run facilities or critical IT services. Criminal entities or nation-states can interrupt IT operations or hold data for ransom. Other types of events, such as the unexpected death or departure of key personnel, supply chain disruptions due to war or labor strikes, and consumer boycotts, are equally difficult to plan for.

Successful companies therefore develop business continuity plans to provide a template for how managers and other employees should react should such extraordinary events occur.

On the flip side, companies that don’t have business continuity plans face significant peril. Even accounting for variables such as the industry, company size, and business type, downtime of an organization’s online presence alone can cost it between US$2,300 and US$9,000 per minute—and that doesn’t account for the cost of damage to its reputation and business relationships.

Why Is Business Continuity Important to Businesses?

Most businesses can withstand slowing or halting their business activities for a short period of time, although banks, utilities, healthcare providers, and companies in some other industries aren’t afforded this luxury and must follow statutory requirements and ensure they can resume normal operations almost immediately following a disruption.

In most cases, irrespective of regulatory requirements, businesses can ill afford a prolonged disruption to their activities because even the most patient customers will eventually find alternative vendors. In fact, an extended downtime event at a competitor can present an opportunity for others in the sector to gain market share.

When planning for business continuity, organizations should also consider partners, vendors, and sensitive supply chains, where outages could have irreparable cascading downstream effects.

What Does Business Continuity Include?

In its simplest terms, business continuity is the idea that an organization will continue operations in spite of disasters, events, nefarious acts, or other calamities that temporarily interrupt the ordinary course of business. It includes the following:

• Assessing functions such as production, customer service, sales, and marketing and ranking them by order of priority. In an emergency, your organization may not be able to get all its functions up and running immediately, so knowing which ones are most critical to its success is crucial to surviving the first minutes, hours, and days.
• Assessing key suppliers and service providers for their adaptability and flexibility. Ensure that they have their own business continuity plans, and in the case of IT providers, that they have redundancy, data replication, and other disaster recovery processes in place to ensure your business won’t suffer from disruptions to their operations.
• Ensuring that the business complies with relevant local, national, and international standards; this is most important in the finance, healthcare, and utility sectors.

What Is Included in a Business Continuity Plan (BCP)?

At its most basic, a business continuity plan (BCP) is the simple acknowledgement by leadership that unforeseen disruptive events, often outside the organization’s control, will inevitably occur and that they should take steps to ensure the company will be able to continue doing business, even if in a limited capacity for a short period of time.

A BCP must include the disaster recovery (DR) plan, which, as its name suggests, is a framework for recovering systems and, most importantly, data after an unexpected outage. Events that can cause such an outage include hurricanes or tornadoes that knock out power or make travel to corporate offices impossible, armed conflicts that disrupt supply chains, cyberattacks that render systems inoperable, and global pandemics that force people to work from home. But the most common cause of disaster is human error, such as an employee unwittingly falling for a phishing scam or a database administrator who doesn’t get around to applying a software patch until after the system is compromised.

And while it’s true that future events are impossible to predict, failing to prepare for them would be foolhardy—and against laws and regulations governing many industries. As Dwight D. Eisenhower, the former US president and supreme allied commander in Europe during World War II, noted: “Plans are worthless, but planning is everything.”

In other words, unexpected events can make the details of many plans irrelevant or anachronistic, but the very process of planning helps ready an organization for whatever may come next. Eisenhower also said of planning: “If you haven’t been planning you can’t start to work, intelligently at least.”

Still, DR is integral to but not the only key component of an effective BCP. A comprehensive BCP should include the following elements:

• Business impact analysis. Determine which functions and processes are critical to the organization’s survival, and understand the impact if they were to be disrupted. This analysis should be continuous, but it’s especially important when the business expands into new product markets or geographic areas and when it adds core technologies such as a new data center or new cloud infrastructure. For example, a business with key operations in areas hit frequently by tropical storms should consider building or leasing facilities in areas outside a typical storm’s path.
• Communications plan. Establish clear communication channels for internal and external stakeholders to provide timely and accurate information during a crisis.
• Employee well-being and safety. Plan for remote work capabilities, and prioritize the health and safety of employees and their families over other considerations.
• Risk assessment and management. Assess how key customers, suppliers, or other partners on which the business depends might react to sudden business disruptions, how supply chains might be affected, which legal issues might arise, and what exposure the organization has to natural disasters and other disruptions.
• Supply chain resilience. Develop strategies to manage supply chain risk, including diversifying suppliers and sourcing options wherever possible. Consider a scenario where the business has to relocate to one or more secondary locations.
• Training and awareness. Regularly train employees on their roles in the event of a disaster or other major business disruption so they’re comfortable with the procedures and protocols they should follow.

Building a Business Continuity Plan

Business continuity planning is essential to the survival of an organization in the event of a natural disaster or other disruption to the normal course of business. Indeed, about 25% of businesses don’t reopen after disasters, according to the US Federal Emergency Management Agency. Businesses should take the following steps to build an effective BCP:

1. Identify a business continuity manager (BCM) and make it clear that the BCM has the full support of senior leaders. At large companies, the BCM often reports to the chief financial officer.
2. The BCM should assemble a team representing key business functions, such as manufacturing, sales, customer service, IT, operations, human resources, and marketing.
3. This team then works to identify areas of the business that are critical to ongoing operations, such as IT, telecommunications infrastructure, building management, vendor management, and payroll, as well as customers that generate significant amounts of revenue. Typically, businesses peg their continuity plans to two metrics: a recovery time objective (RTO) and recovery point objective (RPO). The RTO is the maximum length of time it should take to bring critical IT systems back online. The RPO is how much data the business can afford to lose before it’s harmed beyond the determined acceptable limits.
4. Create a list of key stakeholders, including their full contact information and areas of responsibility. The BCM should ensure that physical copies of the list are easily accessible in a number of specified locations. In other words, don’t assume digital versions of the list, or anything else, will be available during a disruption.
5. Determine which business areas have priority in the event of a disruption and whether current deployments allow for recovery within the stated RTO time frame. Does a business unit or line-of-business team require a simple backup, data replication to a secondary site, or real-time data protection and recovery? For example, if it’s determined that the business can’t tolerate the loss of an ecommerce site for more than an hour but the current deployment of that site would require a recovery time of four hours, IT may need to re-architect the site or find a new provider. Additionally, acknowledge which risks the business is willing to accept because hedging them would be too expensive, and offset them in some other way, such as by purchasing an insurance policy.
6. Create communications plans for the business as a whole and for each functional area. Make sure key stakeholders are aware of these plans and can access them in the event of a disruption.
7. Identify locations, including home offices, that could be used as temporary worksites if the main offices are inaccessible for long periods of time. Plan to make critical data and applications available as quickly as possible in those locations.
8. Vet key suppliers and service providers to ensure they have their own BCPs in place that protect your business should they encounter a significant disruption.
9. Practice the plan by walking all stakeholders through the steps that must be taken in the event of a disruption. Set up a schedule to test these plans at least once a year to identify and control for changes among suppliers, personnel, or facilities.

Finally, experts advise making recovery operations as automated as possible, allowing stakeholders and workers to focus on the overall business continuity plan. One example is using failover systems that automatically switch to backup servers or networks if the primary ones fail. Automation increases the chances of a positive, predictable outcome.

Testing a Business Continuity Plan

Business continuity plans are only as good as the habits of the people who use them. While predicting an actual disaster is near impossible, it’s entirely possible to simulate a disruptive event so staff can practice the actions they’ll likely have to perform. Before any testing can occur, stakeholders need to have seen and assimilated the BCP.

Tests should evaluate key elements of the plan, including reaction times to power outages and IT failures, the viability of both internal and external communications systems, and alert and activation procedures for key personnel.

Testing not only familiarizes people with their responsibilities in the event of a disruption, but it also helps identify plan gaps or flaws so they can be addressed before an actual emergency.

Best practices for this type of testing include the following:

• Tabletop testing. This involves bringing key stakeholders into a physical or virtual conference room, describing a disruptive event, and then asking each of them to list the actions they would take in accordance with the BCP they will have already read.
• Walk-through testing. Also known as a mock recovery test, this is a more comprehensive version of the tabletop exercise. In this test, employees physically walk through the steps they would take in the event of a disruption. For example, facilities management staff would demonstrate how they would ensure that backup generators were functioning, and someone in IT would use the contact information document to get in touch with your data center or cloud service provider.
• Third-party testing services. Outside vendors test how prepared your organization’s staff and key stakeholders are to react to simulated disruptions, including ransomware demands and other nefarious acts. Firms that specialize in cybersecurity can test employees to help ensure they don’t fall for phishing or other psychological tricks that can result in breaches to IT systems.

BCMs should conduct tests at least annually and establish a format for stakeholders to share and review the results.

Business Continuity Standards

Business continuity plans in certain industries—notably financial services, utilities, and healthcare—are subject to local, national, and/or international standards. In fact, more than 120 business continuity management regulations apply to a variety of industries, according to DRI International, a nonprofit disaster recovery consultancy. These include Security and Exchange Commission, Financial Industry Regulatory Authority, and Sarbanes-Oxley regulations in the United States as well as the BASEL III international regulatory framework for banks and the International Organization for Standardization’s ISO 22301.

Other business continuity standards include the National Institute of Standards and Technology’s SP 800-34 and 24762 and the US National Fire Protection Association’s NFPA 1600 standard for continuity, emergency, and crisis management. More general business continuity regulations include the EU’s General Data Protection Regulation, which, because it governs the storage and dissemination of data, is also relevant to business continuity.

Business Continuity and Disaster Recovery

Business continuity and disaster recovery are closely related. Both are organizational plans for surviving and quickly recovering from a potentially catastrophic business disruption, and both are also closely linked to IT, given businesses’ reliance on IT infrastructure and applications.

To cite just one example of how dependent all businesses have become on IT, most professional sports venues in the United States no longer accept cash payments, meaning that computerized point-of-sale systems need to be operational for them to sell food, beverages, gear, and other goods.

Business Continuity vs. Disaster Recovery

ISO 22301 defines business continuity as “documented procedures that guide organizations to respond, recover, resume, and restore to a pre-defined level of operations following disruption.” Disaster recovery is a subset of business continuity that involves restoring IT services, incrementally if necessary. A key way that business continuity differs from DR is that business continuity accounts for all business interruptions, including those that are planned.

Technology and Business Continuity

Business continuity is contingent on a wide variety of factors, including the industry in which an organization operates and the nature of the disruption itself. But in the Information Age, almost all business continuity depends on some level of IT functionality. It’s therefore crucial for companies to make certain that they have appropriate levels of redundant infrastructure and data replication in place, not just to support the ordinary course of business but also to ensure the business can operate efficiently enough during a disruptive event.

The shorter the RTOs and RPOs, the better for continuity. However, the cost of achieving any RTO or RPO goes up as each objective becomes shorter. Architectural choices can help. Business leaders should consider using cloud computing and, optimally, containers to further isolate critical data from systems that have been disrupted. They should also look for cloud service providers with geographically disparate failover facilities.

One of the advantages of cloud computing from a business continuity perspective is what’s called “pilot light deployments,” where secondary sites or copies of corporate workloads can be as small as a single virtual machine (VM) or container. In the case of a failover, that single VM or container can, if needed, kick off an automated process that lets your organization spin up the rest of the infrastructure. And by using a pilot light deployment, organizations need only pay for that single resource rather than replicating an entire system.

Another strategy is the so-called “blue-green” architecture, where instead of having four to six redundant environments for development and testing and a separate one for production deployment, an organization deploys only two redundant, distributed environments. Let’s say the “blue” environment is production and the “green” is development and testing. When development is completed, the “green” environment becomes the primary production environment, and the “blue” environment is used for development, testing, and disaster recovery. This cycle then repeats itself.

Simplify Your Business Continuity Strategy with Oracle Cloud Infrastructure

Oracle makes it simpler and more affordable to develop a holistic business continuity plan. Because Oracle Cloud Infrastructure (OCI) was developed later than other hyperscale clouds, it was built for better efficiency and reliability, lower latency, and superior flexibility compared with competing clouds. In addition to containers, OCI has flexible virtual machines, which means businesses can buy only as much compute power as they need. Other providers offer less flexibility, requiring customers to overprovision their instances, costing them more money. OCI has multiple geographically separated cloud regions in many countries, enabling customers to remain compliant with data sovereignty regulations while still having disparate locations for the purposes of business continuity.

Based on decades of development experience and real-world customer feedback, Oracle has developed best practices called Oracle Maximum Availability Architecture (MAA). Oracle MAA provides the blueprint for implementing high availability, scalability, disaster recovery, and data protection solutions in Oracle Database environments.

The Oracle MAA best practices, maintained by a team of Oracle developers, continually validate the integrated use of Oracle Database High Availability features such as Oracle Real Application Clusters and Oracle Data Guard using chaos engineering techniques and other testing methodologies.

Oracle MAA is further extended with the Oracle Cloud Infrastructure Full Stack Disaster Recovery service. OCI Full Stack Disaster Recovery orchestrates the transition of compute, databases, and applications between OCI regions from around the globe with a single click. Customers can automate the steps needed to recover one or more business systems without redesigning or re-architecting existing infrastructure, databases, or applications and without needing specialized management or conversion servers.

Moreover, Oracle Autonomous Database and Oracle Exadata Database Service have redundancy built in, which means customers don’t pay extra for data replication within the same availability zone.

The expectations for business continuity have changed as the technology landscape has evolved. For example, most businesses used to think about RTOs in terms of so-called tier 1 applications, but less expensive cloud computing options, such as pilot lights, mean that organizations can afford to create business continuity plans for all their applications.

Business Continuity FAQs

What are the 4 pillars of business continuity?

At its most basic, business continuity consists of assembling a team focused on business continuity, assessing which areas of the business are most at risk during a disruptive event, creating a plan for maintaining operations at minimally viable levels, and then rehearsing and testing that plan on a regular basis.

What’s the difference between business continuity and disaster recovery?

Business continuity is an organizational approach to ensuring that an organization can continue operating in some capacity through any disruption, planned or not, while disaster recovery focuses on bringing IT systems back up.

Why is having a BCP important?

Organizations that don’t have updated business continuity plans are at greater risk than those that do. At worst, they may permanently go out of business due to a significant unexpected disruption to normal operations that drives customers to competitors, loses data, and proves expensive to fix.