What is Business Continuity?
Business Continuity is the ability of an organisation to continue delivering its critical products, services and processes at a predefined minimum level during and after a disruption, and to recover fully within an acceptable time. The disruption may be a cyber attack, but also a fire, a power failure, a pandemic, the loss of a supplier or a flood. Business continuity management (BCM), often shortened to continuity management, is the management process that builds, tests and maintains this capability. BCM cannot rule out outages, but it keeps their consequences limited and predictable.
🎯 Why does Business Continuity matter?
An organisation without a continuity approach only starts improvising once things go wrong, and then loses exactly the hours that make the difference. BCM has five goals:
- Preventing prolonged outages - knowing in advance which processes must come back first and what they need
- Limiting damage - financial, operational and to the safety of people and plant
- Protecting people, assets, data and reputation - including commitments to customers and supply chain partners, so that uncertainty and loss of trust are avoided
- Complying with legislation and standards - such as NIS2, the Dutch Cybersecurity Act, the BIO and ISO 27001
- Being prepared for cyber incidents - such as ransomware and OT outages
Recent incidents show how large the difference is. After NotPetya (2017), Maersk had to reinstall around 4,000 servers and tens of thousands of PCs; its Active Directory could only be restored thanks to a single domain controller in Ghana that had been offline because of a power cut. Maersk put the damage at 250 to 300 million US dollars. In the cyber attack on Jaguar Land Rover in 2025, car production stood still for about five weeks, while there is no public evidence that the factory control systems themselves were hit.
🧱 What are the building blocks of Business Continuity Management?
| Element | What it does | Output |
|---|---|---|
| Business Impact Analysis (BIA) | Determines which processes are critical and how damage grows over time | Priorities, MTPD, RTO and RPO per process |
| Risk assessment | Maps threats and vulnerabilities affecting IT and OT systems | Risks that threaten continuity |
| Policy and ownership | Uses governance to set who decides, who acts and who communicates | Mandate, budget and a fixed annual cycle |
| Continuity strategy | Selects solutions: redundancy, alternate sites, spare stock, manual operation | Justified investments |
| Business continuity plan (BCP) | Playbooks per scenario, with roles and decision authority | Clear actions from the first hour |
| Disaster Recovery plan (DRP) | Technical recovery of IT or SCADA/PLC systems | Recovery procedures and backups |
| Crisis communication plan | Agreements on internal and external communication | One message to staff, customers and regulator |
| Exercises and testing | Tabletop exercises, restore tests, failover tests and crisis simulations | Evidence that the plans work |
Under ISO 22301, a business continuity plan describes, among other things, the activation criteria, the roles and contact details, the steps to get back to the minimum service level and the resources needed to do so. The plan only becomes active when an incident crosses the agreed threshold; a minor fault stays with the normal operational processes.
🔄 How does Business Continuity relate to other plans and policies?
Continuity management does not stand on its own. It connects to a number of other documents and processes, each with its own role:
| Plan or process | Relationship to Business Continuity |
|---|---|
| Risk Management | Provides the broad risk picture; BCM focuses on the risks with the greatest impact on availability |
| Information Security Policy | Embeds BCM principles, recovery objectives, roles and responsibilities |
| Incident Response Plan | Contains and investigates the incident itself; a serious IT or OT incident can trigger the continuity plan |
| Crisis Communication Plan | Part of BCM: who tells what to staff, customers, the media and the regulator |
| Disaster Recovery | The technical recovery of systems and data within the wider continuity plan |
| Cyber Insurance | Covers part of the financial damage and recovery costs, but does not replace preparation |
The distinction from incident response matters most in practice. The incident response team isolates systems and looks for the cause; meanwhile the continuity team makes sure customers still get their deliveries, even if that means paper work orders or production at another site.
🔢 Which recovery objectives does Business Continuity use?
The BIA produces four key figures. The MTPD comes first; every other objective has to fit inside it.
| Term | Meaning | Example question |
|---|---|---|
| MTPD (Maximum Tolerable Period of Disruption) | Time after which the consequences of an outage become unacceptable | How long can the plant stand still before customers leave or permit conditions are breached? |
| RTO (Recovery Time Objective) | Target time to restore a process or system | Within how many hours must the SCADA server be running again? |
| RPO (Recovery Point Objective) | Maximum acceptable data loss, expressed in time | How many hours of batch data may be lost? |
| MBCO (Minimum Business Continuity Objective) | Minimum acceptable service level during the disruption | Is 60% output on a single line acceptable? |
In OT these objectives look different from office IT, because availability and safety come before confidentiality. A safety function is not “recovered”; it is designed to keep working during a fault or to bring the process to a safe state: redundant and fail-safe. A historian can often wait a day, provided the controllers keep buffering locally. Indicative recovery objectives look like this:
| OT system | Typical RTO | Typical RPO | Common solution |
|---|---|---|---|
| Safety instrumentation | Always available or fails safe | n/a | Redundant and fail-safe design |
| SCADA server / HMI | Minutes to a few hours | Minutes | High Availability pair, local operation |
| PLC programs | Hours | Last approved version | Offline backup, spare hardware |
| MES | Hours to a day | Minutes to hours | Manual work orders, paper batch records |
| Historian | One to several days | Hours, given local buffering | Store-and-forward, backup |
🏭 Why is Business Continuity different in OT?
In production environments an outage hits the physical process directly:
- An outage of SCADA, MES or Historian can halt production immediately or remove visibility of the process
- Failures of PLCs or network connections create process risks and sometimes force a shutdown
- Loss of sensor or batch data affects quality, product release and compliance
- Long service life - spare parts for a twenty-year-old controller may no longer be available
- Dependence on IT - even when the OT is healthy, a plant stops without ERP, planning and logistics
That last point is the lesson of Colonial Pipeline (May 2021): only the IT network was hit, yet the pipeline was shut down as a precaution for six days. Norsk Hydro took the other route during the LockerGoga attack in 2019: parts of its production kept running under manual operation. That only works if manual procedures exist and have been practised.
Typical OT situations and the matching continuity measure:
| OT situation | Continuity measure |
|---|---|
| SCADA system outage | Redundancy, local operation at the panel or manual procedures |
| Sabotage or cyber attack on PLCs | Recovery from a verified backup, segmentation, restricted access |
| Loss of power or water supply | Emergency provisions, fail-safe design, detection and alarming |
| Supplier outage | Second source, SLAs with supply chain partners, local stock of spare parts |
Technical measures that increase resilience include an air gap or strict separation between IT and OT, network segmentation following the Purdue Model and the zones and conduits model from IEC 62443, defence in depth, immutable backups and a UPS for critical controllers. NIST SP 800-82 (revision 3, September 2023) covers continuity and recovery specifically for OT.
🔐 Which standards and laws require Business Continuity?
Business Continuity is a standard part of an ISMS and of security policy, but it also has its own standard:
- ISO 22301 - the certifiable standard for a Business Continuity Management System; current edition 2019, extended in 2024 with an amendment on climate change. Clause 8 covers the BIA and risk assessment, strategies, plans, the exercise programme and evaluation. ISO 22313:2020 provides guidance on the standard and ISO/TS 22317:2021 is the guideline for the BIA
- ISO 27001:2022 - controls A.5.29 (information security during disruption) and A.5.30 (ICT readiness for business continuity); in the 2013 edition this was Annex A.17
- NIS2 - Article 21(2)(c) requires business continuity, such as backup management and disaster recovery, and crisis management
- Cybersecurity Act and Cybersecurity Decree - the Dutch transposition of NIS2 (Cyberbeveiligingswet), in force since 15 August 2026 and successor to the Wbni; Article 9 of the decree requires recovery procedures, periodically verified backups and a continuity, recovery and crisis plan
- Wwke - the Dutch Critical Entities Resilience Act (CER Directive), also in force since 15 August 2026, requires resilience against all hazards, including business continuity measures
- BIO - BIO2, adopted on 23 September 2025, applies the continuity requirements of ISO 27001/27002 to every layer of Dutch government, including its OT such as pumping stations and locks
🛠️ How do you set up Business Continuity in an industrial environment?
- Define the scope - which sites, production lines and services are covered, and who owns them
- Carry out a BIA - record the MTPD, RTO, RPO and MBCO per process, together with production, quality and safety
- Map dependencies - controllers, servers, networks, licences, suppliers and key people; an up-to-date asset inventory is essential here
- Choose strategies - redundancy, spare hardware in stock, manual operation, relocation to another site or a second supplier
- Write plans and playbooks - with escalation criteria, decision authority and contact details that remain available without the network
- Protect the backups - offline or immutable, including PLC programs, HMI projects and the configuration of the engineering station
- Exercise and test - at least one tabletop exercise and one real restore test on spare hardware per year, often more in vital sectors
- Evaluate and improve - after every exercise and every incident, following the PDCA cycle
Also embed continuity management in the annual cycle and in procurement. Include continuity requirements in tenders and contracts, and analyse which suppliers you need to keep running and which customers depend on you. Let IT and OT exercise together: a plan that lives in only one of the two silos misses exactly the dependencies that bite first in a real disruption.
❓ Frequently asked questions
What is the difference between business continuity and continuity management?
Business continuity is the capability itself: keeping critical processes going during a disruption. Continuity management, or business continuity management (BCM), is the management process that builds that capability through a BIA, plans, exercises and review. ISO 22301 calls the whole a Business Continuity Management System (BCMS).
What is the difference between Business Continuity and Disaster Recovery?
Business Continuity is about keeping the whole operation going during a disruption, including people, processes, suppliers and communication. Disaster Recovery is the technical part of it: restoring systems, networks and data. A Disaster Recovery plan is therefore one component of a Business Continuity plan.
Is Business Continuity mandatory?
For organisations within the scope of the Dutch Cybersecurity Act, business continuity has been a legal obligation since 15 August 2026, worked out in Article 9 of the Cybersecurity Decree. Dutch government bodies must take continuity measures through BIO2, and critical entities through the Wwke. For other organisations continuity management is not a legal requirement, but ISO 22301 certification requires a full BCMS and ISO 27001 contains controls for it (A.5.29 and A.5.30).
How often should you test a business continuity plan?
Common practice is at least one tabletop exercise and one technical restore test per year, plus a test after every major change to the plant. ISO 22301 does not prescribe a fixed frequency, but it does require an exercise programme at planned intervals. A business continuity plan that has never been tested often turns out to be incomplete in a real incident.
Who is responsible for Business Continuity?
Senior management is ultimately responsible for Business Continuity; under NIS2 and the Dutch Cybersecurity Act, management bodies must approve the measures and oversee their implementation. Day-to-day coordination of BCM often lies with a BCM coordinator or the CISO. In industry, the production manager and the OT administrator are also indispensable, because they know the process risks and the manual fallback options.
How does a plant keep production running during a cyber attack?
A plant can keep running during a cyber attack if the process network is separated from the office network and the lines can work for a while without central IT. That requires network segmentation, local buffering, manual work orders and practised procedures. Without that preparation, shutting everything down is often the only safe choice.
📌 In summary
Business Continuity is the ability to keep critical processes going at an agreed minimum level during a disruption and to recover them within an acceptable time, underpinned by a BIA, recovery objectives such as RTO and RPO, and exercised plans. Continuity management (BCM) turns that capability into a standing management process. In OT environments this calls for segmentation, offline backups and manual fallback options, and since 15 August 2026 it is also a legal obligation for many organisations under the Dutch Cybersecurity Act.