Business continuity and crisis management

Business continuity is about one question: what do you do when a system fails or the organisation ends up in a crisis? Without a plan, you improvise at the worst possible moment.

What this means in practice

You record a business continuity policy, make backups and regularly verify you can actually restore them, draw up a business continuity plan that you test periodically, and work out a recovery plan for systems after an incident, including a crisis plan with roles, communication and emergency facilities.

Why this is in the law

A plan that's never been tested often doesn't work in practice. That's why the law asks not just for a plan, but for periodically testing it.