Recover what matters first.
Continuity and recovery plans are a natural extension of our data governance work. When we inventory and classify your systems and data, we rate availability alongside confidentiality and integrity, in business terms. That tells us which systems the business cannot run without, how long each can be down and how much data it can afford to lose. Your BCP and DR plans are built on those answers, so recovery follows what matters most.
- Built on
- Your data governance and asset inventory
- Availability
- Rated alongside confidentiality and integrity
- Targets
- RTO and RPO agreed with the business
- Tested with
- An optional IR tabletop
What makes it different
Recovery priorities you have already measured.
Most continuity plans start from a blank page and a guess about what matters. Ours start from the asset inventory and classification you already have. The same interviews that rate how sensitive a system is also rate how critical it is to keep running, so confidentiality, integrity and availability stay tightly linked from the first conversation to the recovery plan.
Connected
One source of truth.
Each system's owner, classification, availability rating and recovery objective live in one inventory, and the plans point back to it.
Agreed
Targets the business set.
Recovery time and recovery point objectives come from the business owners we interviewed, not from IT assumptions.
Usable
Clear under pressure.
Roles, call trees, decision points and recovery steps anyone can follow at 2 a.m.
The problem
Why continuity plans fail when they are needed.
Not because the plan was badly written. Because it was written without knowing what matters most.
- Everything is criticalNo agreed order of recovery, so teams argue about it during the outage.
- Targets nobody agreedRecovery times set by IT that the business has never seen or accepted.
- Missing systemsCloud services, vendors and shadow IT the plan never mentions.
- Out of dateWritten once for an audit and never updated as the business changed.
- DisconnectedContinuity, recovery and security work done separately, so nothing lines up.
How it works
From your inventory to a tested plan.
If we have already done your data governance work, most of the input exists. If not, we gather it with you first.
- 01
Start from the inventory
Your systems and data, their owners and their classification, from our data governance process.
- Confidentiality, integrity and availability ratings
- Dependencies between systems
- Vendors and cloud services included
- 02
Rate availability
With each business owner: how long the business can run without a system, and how much data it can afford to lose.
- 03
Agree recovery targets
Recovery time and recovery point objectives set by the business and confirmed with IT against what is achievable.
- 04
Write the plans
Business continuity and disaster recovery plans in recovery order, with roles, call trees and decision points.
- 05
Close the gaps
Where today's backups or architecture cannot meet a target, a ranked list of fixes scored with your risk methodology.
- 06
Test it
Optionally exercised in an incident response tabletop built around a realistic outage.
What you get
BCP / DR Plans deliverables.
Concrete artifacts you keep, not a slide deck that disappears after the readout.
- 01
Business continuity plan
How the business keeps running.
- 02
Disaster recovery plan
What to recover first, and how.
- 03
Recovery targets
RTO and RPO for every critical system, agreed with leadership.
- 04
Recovery order
Systems ranked by availability need and dependency.
- 05
Gap list
Where backups or architecture fall short of a target, ranked by risk.
- 06
Linked inventory
Availability ratings and recovery objectives added to your asset inventory.
Runs on one risk language
Scored with your methodology.
Every finding is scored the same way as the rest of your program. Already have a methodology? We use it. If not, we build it with you first, in a single workshop.
How we build a risk methodology →Connected services