From the BIA to a published plan, with the exercise that proves it works
Impact analysis under ISO 22317, a continuity plan under ISO 22301, and an exercise programme that validates the strategy — backed by 50 continuity controls derived directly from the standard.
Get startedA plan nobody tested
The strategy counted as validated because someone typed a date. No exercise, no participants, no result — and no way to know whether it works.
BIA in a spreadsheet, plan in a word processor
Impact is gathered in one place and the plan written in another. When the critical process changes, only one of the two gets updated.
Nobody knows who activates whom
The plan exists as 40 pages nobody opens at 3am. In the moment, the one page that matters is missing: the one for your role.
BIA by impact across time bands
Estimated financial impact at 1 hour, 4 hours, 24 hours and 1 week of disruption. Criticality is calculated from that rather than argued, and dependencies between processes are part of the sum.
A plan with RTO, RPO and MTPD
Scope by product or service, aligned with the BIA: recovery requirement, measured capacity, resumption sequence, strategies, and the third parties the plan depends on.
A one-pager per role on publication
Each role gets its own activation page — first steps, who activates you, and contacts. The published version does not shift when the source data does.
Exercise programme (§8.5)
A strategy's validity is derived from an exercise that actually happened, with participants, result and findings on record. A strategy with no exercise reads as expired, not as ready.
Find out what stops when the bottleneck bursts
Start with the BIA and reach a published plan in the same flow.
Get started