Governance, Risk & Compliance

Business Continuity & Operational Resilience

Plans that have been tested, by people who have run real incidents.

The situation

Continuity documents age badly and are usually written by someone who has never lost a data centre.

We build business impact analysis from measured dependencies, set recovery objectives the business will actually fund, write plans that work under stress, and then test them — because an untested plan is a hypothesis. Increasingly this is also a compliance obligation under NIS2 and DORA rather than a prudential nicety.

What the client receives

Schedule of deliverables

01Business impact analysis with RTO / RPO per critical process
02Continuity and disaster recovery plans
03Crisis management structure and communication templates
04Tabletop, walkthrough and full simulation exercises
05Backup and recovery assurance testing
06ISO 22301 management system where certification is sought

Frameworks and standards

Assessment is carried out against named references, so a conclusion can be traced back to the requirement it was measured against.

ISO 22301
ISO/IEC 27031
DORA Art. 11–12
NIS2 Art. 21(2)(c)

Governance, Risk & ComplianceCyber Risk Management & AssessmentRisk assessment that produces decisions, not a spreadsheet nobody opens.Service detail Governance, Risk & ComplianceSecurity Governance & Operating Model DesignDecide who decides. Then make the decisions visible.Service detail

Discuss this engagement

Tell us about the critical processes and the recovery expectations set for them and we will set out the scope, the method and the reporting format.