Continuity planning

Access arrangements are built for ordinary days. Continuity planning asks what happens on an unusual one: a site loses its connection, a key person is unreachable, a supplier stops answering. The plan is short, tested, and written in the language of the people who will use it.

Four scenarios worth planning

• Site failure. A branch cannot reach the services it needs. Who decides, what interim reach is granted, and how the interim grant is retired afterwards.
• Absence. The person who normally approves access is unreachable. Who may stand in, for how long, and what record justifies the substitution.
• Supplier withdrawal. A support relationship ends abruptly. Which arrangements must be taken in house, in what order, and by whom.
• Central outage. The usual route is unavailable for a working day. Which roles may use an agreed alternative, and what evidence is kept of that use.

Interim reach, deliberately bounded

Continuity work usually involves granting more reach than usual, for a short period, under pressure. The discipline is to make the extra reach explicit and temporary: a written emergency brief, a named approver, a stated ceiling of hours or days, and a mandatory retirement step when the incident closes. Emergency routes invented during an incident and forgotten afterwards are the most common cause of standing privilege nobody intended.

Writing the plan

The plan is six pages at most. It names each scenario, the person who decides, the reach that may be granted, the record that must be kept, and the step that ends the arrangement. Every name is a role rather than an individual, with an attached list of current holders that is reviewed quarterly. A plan that has to be amended during an incident because a name changed is a plan that will not be used.

Testing without drama

Continuity plans fail when they are first exercised during a real incident. We therefore run one quiet exercise each year: a short scenario walked through by the people who would perform it, on a normal working day, with a written note of what would have been difficult. Exercises are not scored. Their only output is a list of small improvements, each with an owner and a date.

Continuity and the record

Anything granted under a continuity plan is recorded exactly as ordinary access is: brief, approver, scope, window, retirement. The difference is speed, not rigour. A client who can produce a clear record of last year's emergency reach is in a far stronger position than one who can produce only a memory and a good reputation.

Working with your own plans

Where a client already holds a business continuity plan, our access plan is written to sit inside it, using the same scenario names and the same escalation ladder. Where no such plan exists, ours can stand alone — but we will say plainly that access continuity is only one part of what an organisation needs to survive a bad week.