Domain 03 of six

Operational resilience

Continuity arrangements are usually written once and assumed thereafter. This domain establishes whether yours would hold, and whether anyone has checked.

Request an assessment All six domains

Why it matters

The problem this addresses

Almost every organisation has a continuity document. Far fewer have confirmed how long each critical system can be unavailable before the organisation is genuinely affected, or tested whether recovery works in the time assumed.

An untested arrangement is a statement of intent. It becomes a plan the first time it is exercised, and that is a much better moment to find the gaps than during an actual outage.

Scope

What we examine

Which systems and processes are genuinely critical, established with the business rather than with technology alone
How long each can be unavailable before the impact becomes material
What recovery arrangements exist, and what they actually cover
Whether those arrangements have been tested, when, and what the test found
Whether people know their part without needing to read a document first

Assessed against: A five-level maturity scale, applied against recognised frameworks selected to suit the domain. Framework alignment is a statement of method, not a certification claim.
ISO 22301: Business continuity management, including impact analysis and exercise programmes.
ISO/IEC 27031: Readiness of information and communications technology for business continuity.
NIST Cybersecurity Framework: The Respond and Recover functions.
DORA: Operational resilience expectations, where relevant to your sector.

Assessment

Included in the Assessment

Fixed scope, agreed in writing before work begins. Findings your leadership can act on within ten working days of the final interview.

Maturity rating for this domain on the five-level scale
Business impact analysis, with recovery time and recovery point objectives agreed with the business
Continuity and recovery arrangements written to be usable under pressure
Test schedule, with a first exercise designed and ready to run
Gap list, ranked by consequence rather than by ease of fixing

Price: SCR 20,000 to 40,000 for this domain, VAT exclusive. Where it sits in that band depends on the size and scope of your organisation, not on which domain you choose. Fixed and agreed in writing before work begins. All six domains together are quoted on request, priced as six with a discount for taking the whole position at once.
What that price does not include: Building what the assessment recommends. That is a separate engagement, scoped and quoted against what you need, and it is where most of the work usually sits. See below.
Evidence gathered: Structured interviews across executive, finance, technology and one business function, plus document and systems review.
Turnaround: Ten working days from the final interview.

Implementation

Available as an Implementation Engagement

An assessment that ends at a report has done half the job. Most organisations know roughly what is wrong. What they lack is the time and the specialist capacity to fix it while also running the organisation.

In this domain that means

Write the continuity and recovery documentation
Design and facilitate the first exercise, including the scenario
Work through what the exercise exposes, in priority order

How it is priced: Quoted on request. Fixed scope and fixed fee, agreed in writing before work begins. We do not work on an open-ended basis.
Independence: Assessment and implementation are separately scoped engagements, quoted and agreed in writing before either begins. Keeping them separate is deliberate. It is what allows the assessment to stay independent, and it means you are never presented with findings that happen to recommend more of our own work. Where we have implemented something, any later re-assessment of that work says so plainly.

Where does this sit for you today?

If you are not sure whether this domain is a priority, the Quick Diagnosis takes about two minutes and gives you a position on the page. Nothing is sent anywhere.

Discuss a governance concern Try the Quick Diagnosis