Skip to main content
Governance Authority
Category: Enterprise Risk Management

Continuity Strategy

Also known as: Business Continuity Strategy
Simply put

A continuity strategy is an organization's overall approach for keeping critical operations running, or restoring them quickly, when a disruption occurs. It typically sets out how the organization will prevent, respond to, and recover from events that could interrupt its activities. It is generally developed as part of a broader business continuity management effort rather than existing as a standalone document.

Formal definition

Within the business continuity management (BCM) planning process, a continuity strategy is typically the conceptual phase that summarizes the preventive (mitigation), response, and recovery approaches an organization will adopt to safeguard critical operations, data, and assets against disruption. It is generally informed by a business impact analysis and often involves developing planned responses, defining roles and responsibilities, and aligning with recognized standards and best practices such as ISO 22301 (Societal Security, Business Continuity). The specific content, scope, and rigor of a continuity strategy vary by organization, sector, and jurisdiction, and adoption of any particular framework or standard is generally voluntary unless mandated by applicable law, regulation, or contract.

Why it matters

Disruptions to critical operations can arise from many sources, including natural events, technology failures, supply chain interruptions, and cyber incidents. A continuity strategy matters because it gives an organization a deliberate, pre-considered approach for maintaining or quickly restoring essential activities rather than improvising under pressure. Without a defined strategy, decisions during a disruption tend to be reactive and inconsistent, which can extend downtime and amplify the operational, financial, and reputational consequences of an event.

A continuity strategy also supports the protection of data, intellectual property, and other critical assets, helping to preserve their confidentiality and integrity through a disruption. Because the strategy is typically informed by a business impact analysis, it helps the organization concentrate limited resources on the operations that matter most rather than treating all activities as equally critical. This prioritization is generally what distinguishes a considered continuity approach from a generic emergency response.

For boards and senior management, a continuity strategy is a visible component of operational resilience oversight. While the depth and formality of the strategy vary by organization, sector, and jurisdiction, aligning it with recognized standards such as ISO 22301 can support consistency and comparability. Adoption of any particular standard is generally voluntary unless required by applicable law, regulation, or contract, so organizations should confirm what obligations, if any, apply to their circumstances.

Who it's relevant to

Board and its committees
The board and relevant committees typically hold an oversight role, satisfying themselves that management has developed and maintains a continuity strategy proportionate to the organization's critical operations and risk profile. This is an oversight responsibility rather than an operational one; the board generally reviews and challenges the approach rather than executing the underlying plans.
Management and operational owners
Management is generally accountable for developing the continuity strategy, conducting the business impact analysis that informs it, developing planned responses, and assigning roles and responsibilities. Operational owners of critical activities typically contribute the knowledge needed to prioritize what must be maintained or restored, and how quickly.
Business continuity and resilience professionals
Specialists in operational resilience and business continuity typically design, coordinate, and maintain the continuity strategy within the BCM process. They often draw on recognized standards such as ISO 22301 to structure preventive, response, and recovery approaches, while tailoring scope and rigor to the organization.
Risk and assurance functions
Risk functions may help ensure the continuity strategy is consistent with the organization's broader risk management approach, while internal audit and other assurance providers may independently evaluate whether the strategy is adequately designed and whether related controls operate as intended. These assurance activities are distinct from the management functions that own the strategy itself.

Inside Continuity Strategy

Recovery Objectives
The targets that shape a continuity strategy, typically expressed as the recovery time objective (RTO, how quickly a process must be restored) and recovery point objective (RPO, the acceptable amount of data loss). These are usually derived from a business impact analysis and reflect management's decisions rather than a legal mandate; specific thresholds depend on the entity and its risk profile.
Business Impact Analysis (BIA)
The assessment that generally underpins a continuity strategy by identifying critical processes, their dependencies, and the impact of disruption over time. The BIA informs prioritization but does not by itself constitute the strategy; it is an input owned by management with support from continuity or risk functions.
Strategy Options and Selection
The range of approaches management may consider to maintain or restore operations, such as alternate sites, workforce arrangements, manual workarounds, supplier redundancy, or technology recovery. Selection typically balances cost against the recovery objectives and the organization's risk appetite; the appropriate option depends on facts and jurisdiction.
Resource Requirements
The people, facilities, technology, third-party arrangements, and information a chosen strategy relies upon. A continuity strategy generally specifies what must be available and where accountability for provisioning sits within management.
Governance and Roles
The allocation of responsibilities across the board (which typically provides oversight), management (which owns design and execution), and assurance functions (which may provide independent review). A continuity strategy should make clear which function owns each activity rather than blending oversight and operational duties.
Testing, Maintenance, and Review
The provisions for validating that the strategy works as intended and keeping it current as the business and risk landscape change. This distinguishes strategy design from evidence of operating effectiveness, which is established through exercises and reviews over time.

Common questions

Answers to the questions practitioners most commonly ask about Continuity Strategy.

Is a continuity strategy the same as a business continuity plan?
Not quite. A continuity strategy generally describes the high-level approach an organization chooses for maintaining or recovering prioritized activities, for example, whether to rely on redundancy, alternate sites, manual workarounds, or third-party arrangements. A business continuity plan is typically the more detailed, documented set of procedures that operationalizes that strategy. Treating the two as interchangeable can obscure the fact that a strategy sets direction and options, while a plan sets specific steps, roles, and triggers. The precise terminology and structure vary by framework and by organization, so entries here are educational rather than prescriptive.
Does adopting a recognized continuity framework mean an organization is legally compliant?
Not necessarily. Many continuity-related frameworks and standards are voluntary good-practice references rather than binding law, and adopting one does not by itself satisfy any specific legal or regulatory obligation. Certain sectors and jurisdictions impose statutory or regulatory continuity or operational-resilience requirements on particular entity types, and those requirements, not the framework alone, determine compliance. Whether a given organization is subject to such obligations depends on its jurisdiction, sector, and facts, and should be assessed with qualified legal and compliance input. This entry is not legal, audit, or compliance advice.
Who is accountable for the continuity strategy, and who executes it?
Accountability for oversight of resilience and continuity typically sits with the board or a designated committee, which generally reviews whether an adequate strategy exists and is aligned with the organization's risk appetite, without directing day-to-day execution. Management ordinarily owns the design, resourcing, and implementation of the strategy and the underlying plans. Assurance functions, such as internal audit, may independently evaluate the design and operating effectiveness of continuity arrangements but do not own them. The specific allocation of these roles varies by organization, governance structure, and applicable requirements.
How does an organization decide which activities the continuity strategy should prioritize?
Prioritization is commonly informed by an assessment, often described as a business impact analysis, that helps management identify which activities are most critical and how quickly they need to be restored. Strategy options are then generally matched to those priorities and to the organization's risk appetite and risk tolerance. Because likelihood and impact are distinct considerations, an activity may warrant continuity investment based on the severity of disruption even where the disruption is judged unlikely. The methodology and thresholds are matters of management judgment and vary by organization and sector.
How should a continuity strategy address dependence on third parties?
Where prioritized activities rely on suppliers, service providers, or other external parties, the strategy typically considers whether those dependencies introduce concentration or single-point-of-failure exposures and what alternatives or contractual arrangements exist. Some organizations address this through diversification, contractual resilience obligations, or contingency arrangements. Responsibility for managing third-party risk generally sits with management, with oversight from the board or relevant committee. The appropriate treatment depends on the criticality of the dependency and on any applicable regulatory expectations, which vary by jurisdiction and sector.
How can an organization tell whether its continuity strategy actually works?
Documented intent alone does not demonstrate effectiveness. Organizations commonly distinguish between whether continuity arrangements are appropriately designed and whether they operate effectively when tested. Exercises, simulations, or scenario testing are often used to evaluate operating effectiveness and to surface gaps, and results generally feed back into revisions of the strategy and plans. Independent review by an assurance function can provide additional evidence. The frequency, scope, and rigor of testing depend on the organization's risk profile, resources, and any applicable requirements, and are ultimately matters for professional judgment.

Common misconceptions

A continuity strategy and a business continuity plan are the same thing.
They are generally treated as distinct. The strategy sets the direction and approach for maintaining or recovering operations, while the plan documents the specific procedures to execute it. A strategy can exist without a fully detailed plan, and a plan without a coherent strategy tends to lack a basis for its priorities.
Having a documented continuity strategy means the organization is resilient.
A documented strategy demonstrates design intent, not operating effectiveness. Resilience generally depends on whether the strategy is resourced, tested, maintained, and understood by the people who would execute it. Design and effectiveness are separate considerations that should not be conflated.
Continuity strategy is dictated by a single mandatory standard.
Frameworks and standards may inform continuity practice, but requirements vary by jurisdiction, sector, and entity type. Some sectors face binding regulatory expectations while others rely on voluntary guidance. No single framework is universally mandatory, so the applicable requirements depend on the specific facts.

Best practices

Base the continuity strategy on a current business impact analysis so that recovery objectives reflect the actual criticality and dependencies of key processes rather than assumptions.
Define recovery objectives such as RTO and RPO explicitly, and align the selected strategy options with the organization's stated risk appetite and available resources.
Clarify governance by documenting which activities management owns, where the board or a committee provides oversight, and what independent assurance is expected, avoiding overlap of oversight and operational duties.
Confirm that the resources the strategy depends on, including third-party and technology arrangements, are actually available and provisioned, not merely assumed.
Test the strategy through exercises and update it on a defined cycle and after significant change, treating results as evidence of operating effectiveness rather than relying on design alone.
Confirm which continuity requirements are binding for the entity's jurisdiction and sector versus which reflect voluntary guidance, and seek professional advice where obligations are uncertain.