Business continuity and backups
Continuity is more than a backup copy. We help identify critical activities, outage scenarios, backups that actually restore, and plans to maintain or recover service.
What we see too often
Many SMBs believe they are “backed up” because a copier runs to the cloud. Nobody has restored, nobody has measured the delay, and the continuity plan fits on a forgotten page.
- copies that were never restored, so never proven
- no RTO / RPO, or figures copied from a vendor
- a plan that talks only about IT, not about critical activities
- nobody knows who decides to activate the plan
- backups and continuity live in two files that do not speak
What this module is
Business continuity for ISO 27001 means knowing which activities must not stop, how fast you return, and how you prove you can restore. It is not a duty to be ISO 22301 certified.
We fold backups into this module: what is copied, where, how often, who can restore, and the test calendar. A backup with no restore test is not evidence.
Where this sits in ISO 27001
The module covers continuity and backups expected by ISO 27001, in a proportionate way. ISO 22301 and ISO 27031 are useful references, not prerequisites.
Backups
A backup that has never been restored is not evidence. We document what is copied, where, how often, who can restore, and we schedule tests. This is the piece SMBs most often miss.
What this module includes
- Proportionate business impact analysis (BIA)
- Outage scenarios and recovery objectives (RTO/RPO)
- Backup policy and procedures
- Restore tests, not copy tests only
- Emergency roles and communications
How we work
Critical activities and impacts
A simple BIA: what stops revenue or a client duty, not a catalogue of 200 processes.
Strategies and roles
Workarounds, sites, people, communications. Who activates the plan, who speaks to clients.
Backups and restore
Copy scope, retention, access, restore procedure. We write the gesture, not only the policy.
Tests and records
Test calendar (including a real restore), lessons, adjustments. That is what the audit wants to see.
What you receive
- Business impact analysis (BIA)
- Continuity plans for critical activities
- Backup and restore procedure
- Restore-test calendar and records
Who it is for
SMBs whose client, insurer or ISO 27001 file asks for recovery evidence, not only a nightly copy.
Who it is not for
This module is not a full enterprise IT DRP, nor a replacement for day-to-day incident management. It also does not buy a second data centre.
Typical duration
3 to 6 weeks, depending on the number of critical systems.
What you need to provide
You provide the list of critical systems, backup / cloud contracts, and a business owner who knows what cannot wait 48 hours.
What this module does not cover
This module covers continuity and backups. It does not replace a full IT DRP or day-to-day incident handling.
Frequently asked questions
- Does ISO 27001 require ISO 22301?
- No. ISO 27001 asks for continuity proportionate to risk. ISO 22301 is a broader framework, useful later, not a prerequisite.
- Is a cloud copy enough?
- Not by itself. You must know how to restore, in what time, and who decides. The deliverable includes the procedure and a test.
- Must every system be tested?
- Start with critical activities identified in the BIA. The rest follows according to risk.
- Can we buy only this module?
- Yes. Each module is sold separately. You do not have to buy the full programme. The pre-assessment remains the most efficient entry point if you do not yet know where to start.
- Do we have to start with the pre-assessment?
- No, it is not mandatory. The pre-assessment speeds up scoping if you do not yet have a full picture. If you already know what is missing, we can start this module directly.