What is business continuity? The concept within ISO 22301
Business continuity means your company keeps delivering what customers need, even when there is a failure, fire, cyberattack or supplier problem. It is not about restoring everything. It is about the processes that matter most, within a time you have set in advance. In ISO 22301, this is the starting point of the entire management system. The concept is the foundation of every BCMS, and you work it out in a business impact analysis (BIA).
Business continuity is about keeping operations running during a disruption. Recovery is only the last part of the story.
What does business continuity mean in plain language?
Imagine an online shop that goes down at 2:00 pm because of a power outage in the data centre. Business continuity then answers three questions:
- Which parts of the online shop must come back as quickly as possible? Think of the order page and payments.
- What do we do until the systems are back? Think of taking orders by email or phone.
- How long can the shop be closed before customers leave or contracts are broken?
The answers to those three questions form your continuity plan. It is not a thick manual. It is a set of agreements that someone can carry out on a bad day.
Business continuity in one definition
Business continuity is the ability of an organisation to keep delivering products and services during a disruption, within an acceptable time and at a predefined level. The word “predefined” matters. You set the level and the time before the crisis, not after it.
Note: this is our own wording of the definition in ISO 22301:2019 , not a literal quote. The official text is not freely available. Terms such as MTPD and RPO are defined in ISO 22300, the ISO vocabulary standard for security and resilience. MTPD stands for maximum tolerable period of disruption.
The difference from disaster recovery
Disaster recovery (DR) is the technical restoration of IT systems and data. It is a part of business continuity, not the whole.
| Concept | Focus | Example |
|---|---|---|
| Disaster recovery | Restoring systems and data | Restoring a server from backup |
| Business continuity | Keeping business processes running | Orders keep coming in, even without the server |
| Crisis management | Leadership and decision-making during the crisis | The crisis team meets and decides on communication |
For IT companies, this distinction is often blurred. We discuss it in detail in ISO 22301 for IT companies.
The difference from an emergency plan
An emergency plan describes what you do in an emergency, such as evacuating or calling the emergency services. Business continuity goes further. It looks at what must happen next to let the work carry on as normal.
An evacuation plan is therefore necessary, but it is not enough. If the office is closed for two weeks, you also need a plan to keep serving customers. That plan belongs in the business continuity plan.
Why the concept is so often misunderstood
Many companies think business continuity is about one big scenario, such as a fire or a hack. In practice, it is more often about small disruptions that last a long time: a supplier that does not deliver, an employee who is unavailable, or a system that is down for a day.
| Misconception | What is actually going on |
|---|---|
| ”We have a backup, so we are covered” | The backup exists, but nobody knows how quickly you can restore it |
| ”Continuity is for large companies” | A small company with one customer who depends on its work needs it too |
| ”It is only about IT” | People, locations and suppliers are just as much a part of it |
A worked example: an accounting firm
A fictional accounting firm with twelve employees processes payroll for its clients. The firm classes the payroll process as critical, because clients must be able to pay their staff by the 25th of the month.
The continuity question then becomes concrete:
- The payroll system fails on the 20th.
- The firm has until the 24th to restore the process. That is the recovery time management chooses.
- There is an alternative: an offline export of the latest data, and an agreement with the payroll software supplier for urgent support.
- Employees know who makes the decision to activate the alternative.
This is how business continuity works. You choose in advance what matters, you think of an alternative, and you practise that alternative.
Business continuity at a large and a small organisation
The principle is the same, but the way it is applied differs greatly by size:
| Aspect | Small company (10 to 50 employees) | Large company (250 employees or more) |
|---|---|---|
| Critical processes | Often 3 to 5 | Often dozens, grouped per department |
| Owner | Director or owner | A dedicated role or department, with a mandate from the board |
| Plan | One short set of documents | Plans per location and per process |
| Exercises | Once a year, at a table | Several times a year, partly live |
| Suppliers | A few critical suppliers | An extensive chain, with contracts per supplier |
At a small company, the biggest gain is often a clear owner and one well-tested alternative. At a large company, the focus is more on the links between departments and keeping those links up to date.
What you should do about it
Start with three steps. They form the basis of every BCMS:
- Make a list of your most important products and services.
- For each service, determine how long a disruption can last, and how much damage that would cause.
- For each service, think of a temporary alternative, and check that someone can carry it out.
You can find more on the order of these steps in the step-by-step plan. To see what auditors expect here, read the requirements of the standard.
Frequently asked questions about the concept
Is business continuity the same as ISO 22301? No. Business continuity is the goal. ISO 22301 is the standard that describes how you organise that goal and make it demonstrable.
Do I need business continuity if I have no customers with SLAs? A disruption can still cost a lot of money. You set the level yourself, but you do need to set it.
What is the difference from business continuity management? Business continuity management (BCM) is the approach used to organise business continuity. See also what is a BCMS.
You will find more general answers on the frequently asked questions about ISO 22301.
Sources
- EUR-Lex: Directive (EU) 2022/2555 (NIS2) , which names business continuity as a measure
- ISO 22301:2019 at ISO
- ISO 22301 overview