Business continuity management (BCM), known in Italian as gestione della continuità operativa, is the process by which an organisation identifies threats to its activities, assesses their impact and builds the capability to continue delivering products and services, at an acceptable level, during and after a disruption. The international reference standard is ISO 22301, which sets out its requirements as a business continuity management system, the BCMS (ISO).
What separates governed continuity from continuity on paper is who decides which activities cannot stop, for how long and with what resources. These are all decisions for senior leadership, because they cost money and because whoever gets them wrong pays for it during the disruption. If risk management identifies the risk, operational continuity makes it actionable. In this article we will look at how.
Business continuity management: what it is for
Operational continuity is about deciding in advance what to protect, in what order to restart and who is accountable for the restart. Without this work, priorities are set during the disruption, by whoever happens to be there, with incomplete information.
A stoppage can have many causes: a technical failure, a natural event, human error, a cyber attack, the unavailability of a supplier, the sudden departure of a key person. Business continuity management starts not from the cause but from the effect: which activity stops, for how long the organisation can afford it, what happens to clients in the meantime. That is why the same system holds up against very different events.
The business continuity management cycle
The business continuity management cycle follows the ISO 22301 framework and the logic of management systems: it starts with context and ends with improvement. The table translates the phases into decisions.
Context and scope
Which sites, processes and services fall within the system.
Who is accountableSenior management
Leadership and roles
Policy, budget, business continuity manager.
Who is accountableSenior management
Analysis
Which activities take priority, how much damage downtime causes, and which risks threaten them.
Who is accountableProcess owners, with the business continuity manager
Strategies and plans
How to continue or restart: alternative sites, systems and suppliers, crisis and communication plans.
Who is accountableProcess owners and IT
Exercises
Whether the plans actually work.
Who is accountableContinuity manager, with the people involved
Evaluation and improvement
Audits, corrective actions, updates.
Who is accountableSenior management, with internal audit
The analysis uses two tools. The business impact analysis (BIA) estimates how the effects of a disruption grow over time, in order to decide recovery priorities and resources; the risk assessment, by contrast, looks for concentrations of risk and single points of failure (BCI). The BIA yields the maximum period of disruption the organisation can tolerate, and from this come the two objectives that guide the strategies: the time within which an activity must be restored (RTO) and the amount of data the organisation is willing to lose (RPO) (Wikipedia). They are decisions about tolerance before they are technical values.
Business continuity plan and disaster recovery: the differences
The business continuity plan is the operational document that sets out who does what when the disruption occurs. Business continuity management is the system that decides, produces, tests and updates that plan and the others. Disaster recovery concerns the restoration of IT systems and is one of the plans within the system, not the system itself: a company can have excellent backups and still not know where its people should work or who should notify clients.
Alongside the continuity plan there are specialist plans, for example for crisis management, communication or pandemics (Wikipedia). How to write and structure the plan is the subject of our in-depth piece on the business continuity plan.
Business resilience and operational continuity
Business resilience is often used as a synonym for business continuity. Yet, in our view, it chiefly denotes the broader capacity to absorb shocks and adapt, of which continuity is one component: keeping critical activities running is the part that can be planned, tested and measured. When continuity concerns essential services, the focus shifts to operational resilience, which we cover separately.
When continuity is an obligation
For banks, investment firms, asset managers, payment institutions and other supervised financial entities, the DORA Regulation (EU) 2022/2554 has applied since 17 January 2025 and requires a digital operational resilience strategy, with advanced testing of ICT systems (Banca d’Italia). For other businesses, continuity obligations depend on the sector and on client contracts, and where there are none, continuity remains a choice for the top. Whether an activity falls within a regulated perimeter still needs to be verified case by case.
The Bliss angle: continuity as a tolerance threshold
In our day-to-day work we treat business continuity management as a tolerance threshold that someone has to sign off: how much downtime, how much data loss or how much delay with clients the business is prepared to accept for each activity. The reason it cannot all be delegated to IT or security is that the threshold depends on what the business is worth to its clients, and that is something those who govern it know.
If the threshold is missing, three things happen.
- Priorities are decided during the crisis.
- The plan exists, but nobody has the authority to declare it active.
- Communication with clients, employees and the press is improvised, when it should have its own crisis management plan.
The one accountable, to clients and to the board, is senior leadership.
This is why business continuity management is a governance decision, not a maintenance project.
The Bliss Agency perspective
Domande frequenti
What is business continuity management?
Business continuity management is the process by which an organisation identifies threats to its activities, assesses their impact and builds the capability to continue delivering products and services during and after a disruption. It is implemented through a management system, the BCMS, whose requirements are defined by the ISO 22301 standard (ISO).
What is business continuity management for?
Business continuity management is about deciding in advance which activities to protect, in what order to restart after a stoppage and who takes responsibility for it. It reduces downtime and reliance on improvisation during the event. Its value is measured at the moment something actually stops, not by the documentation produced.
What is the difference between BCM and BCP?
BCM is the management system: policy, roles, analysis, strategies, exercises and improvement. The BCP, or business continuity plan, is the operational document that sets out who does what when a disruption occurs. The plan is one of the outputs of the system, and a system can include several plans.
Are business continuity and disaster recovery the same thing?
No. Disaster recovery concerns the restoration of IT systems and data after a failure or an attack, and is one of the plans provided for by business continuity management, which also covers sites, people, suppliers and communication: a company with excellent backups may not know where its employees should work during a stoppage.
Who is responsible for business continuity?
Senior management is responsible for policy, budget and the definition of roles; a continuity lead, often called a business continuity manager, runs the programme, while each process owner is accountable for the plans and tests in their area (Wikipedia). Ultimate responsibility for the tolerance threshold rests with top leadership.
What is the BIA in business continuity management?
The business impact analysis examines the effects a disruption would have on activities and services and how they grow over time. It is used to set recovery priorities, the resources required and the time and data recovery objectives. It should be repeated every year or whenever processes or the external context change significantly (Wikipedia; BCI).
What is ISO 22301?
It is the international standard that sets out the requirements for a business continuity management system. The current edition is the second, published on 30 October 2019 and supplemented in 2024 by an amendment on climate change; ISO lists it as due for review and a new edition is under development (ISO).
How often should plans be updated and tested?
There is no single cadence: it depends on how critical the activities are and how much processes, sites and systems change. Plans should be reviewed after every substantial change and after every exercise or incident. The BIA is repeated at least once a year, and the internal audit of the system at least every two years (Wikipedia).
What is the difference between business continuity and business resilience?
The two terms overlap and in Italian are often used as synonyms. More precisely, operational continuity concerns the ability to keep priority activities running during a disruption, while resilience is the broader ability to absorb shocks and adapt. It is a distinction of interpretation, not a regulatory definition.