Emergency Preparedness and Business Continuity
This domain tests risk assessment, life-safety response planning, business impact analysis, recovery strategy, and exercising.
Risk and emergency response
Risk equals likelihood multiplied by impact; build a register and treat the highest items. The emergency plan puts life safety first: detection, alarm, evacuation or shelter-in-place, assembly and accounting for people, named roles such as incident commander and floor wardens, utility shutdown procedures, and communication with responding agencies.
Business continuity
A business impact analysis identifies critical processes, their dependencies, and the financial, regulatory, and reputational consequence of downtime as it lengthens. From that analysis come the recovery time objective (how long until restoration) and the recovery point objective (acceptable data loss). Recovery strategies include alternate sites, reciprocal agreements, cloud failover, manual workarounds, spare equipment, and alternate suppliers.
Worked example
Two processes are assessed. Payroll can be down five days with no material harm, so its RTO is 120 hours. The customer contact centre loses $40,000 per hour and must be operating within four hours, so its RTO is 4 hours. Investment goes to contact-centre telephony failover and work-from-home capability, not to a mirrored payroll server. The reasoning shown is that the impact curve over time, not the process's visibility, sets the recovery priority and therefore the spend.
Exercising
Progression runs from walkthrough to tabletop to functional drill to full exercise. Each has stated objectives, a scenario, observers, and a written improvement plan with owners and dates.
Traps
- Writing a plan and never exercising it.
- Confusing emergency response (life safety) with continuity (business recovery).
- Setting RTO and RPO without a business impact analysis.
- Overlooking supplier dependencies and single points of failure.