Business continuity and resilience

Continuity is a business question wearing technical clothing. The technical restore is covered by it-operations:backup-and-recovery; this is about which processes must keep running, for whom, and how long you can survive without them.

Start with impact, not systems

A business impact analysis asks, per process: what breaks downstream, how fast, and who notices. Work outward from the customer-visible failure, not inward from the asset register — an inventory of systems tells you what you own, never what matters.

For each critical process establish:

• Maximum tolerable outage — the point past which the damage is not recoverable by working harder afterwards. This is a business judgment, made by the process owner, not by IT.
• RTO — how quickly it must be back. Always shorter than someone wants to pay for.
• RPO — how much data you can afford to lose, measured in time. An RPO of zero is a claim about spending, not about intent.