Company A has been operating for a few years on a small scale providing services to other businesses. They have recently started to grow their operations, hiring 10 additional employees to meet growing demand and are also expanding their working locations.

They are starting to get information requests from potential customers asking for copies of their Resilience Policy and Business Continuity Plan, to confirm they can continue service delivery during disruption. They haven’t considered any formal continuity and resilience requirements before, and don’t have any inhouse experience in these processes.

Company A requests an initial discussion to understand more about continuity and resilience and what ‘good’ would look like for their business and customers.

After discussing their corporate strategy, objectives and business model, Rule28 recommends an initial programme of work to implement continuity and resilience activities within the organisation and a maturity plan over time. This includes:-

• The development of a Resilience and Continuity Policy and Standard, to be approved and endorsed by the Leadership Team.
• A Business Impact Analysis (BIA) template and initial training to responsible leaders on how to define Important Business Services and Key Business Processes, identify recovery timeframes and assess dependencies, risks and threats.
• A Business Continuity Plan (BCP) template and initial training to responsible leaders on how to identify contingency strategies and develop plans to effectively assess, respond and recover services during disruptive events.
• Design an introductory exercise to enable the company to validate the business continuity plans that have been created.
• A programme maturity report, based on their company objectives, outlining the ongoing activities required to maintain and mature their resilience capabilities over time.