Capability 04
Business Resilience Playbook
A ransomware hit, a vendor outage, a building you can't get into: when something knocks your firm offline, your team still has to keep serving clients. We build a continuity plan around how your firm runs, then walk your people through it so it holds up under pressure instead of sitting in a binder.
When to engage
Your cyber-insurance renewal got harder: they want your recovery time, your last backup test, proof in writing.
An examiner, regulator, or insurer asked to see a continuity or disaster-recovery plan you could actually run.
A vendor outage or a near-miss showed you how much of your operation you don't control.
You have a plan somewhere, but nobody's opened it in a year and no one has ever rehearsed it.
How it works
We start by working out what hurts most when it stops: the functions you can't run without, and how long you can be down before it costs you. From there we set realistic recovery targets, write the steps your team would follow, and run them through a tabletop so the plan gets tested before a real disruption tests it for you. Everything we produce is yours to keep. Your team can pick it up in a crisis, and an examiner can read it and see a real plan.
What you receive
- A short impact analysis: which parts of your operation hurt most when they stop, and how fast you'd need them back.
- Recovery targets and priorities: what comes back first, and the time and data-loss limits you can live with, set with you rather than pulled from a template.
- Role-specific steps your team can follow under pressure: who does what, who they call, and how, even at 2am with the systems down.
- A communications plan and contact tree, so the right people hear the right thing first.
- One tested run-through (a tabletop walkthrough), with a short write-up of what to fix, so 'tested' means something.
Timeframe
A focused continuity plan comes together in weeks. A full program, with a tested run-through, runs longer and is scaled to your size.
Ways to work together
Rapid continuity plan
A few weeks
- Scope
- Your core functions, recovery targets, and a working plan
- What you get
- A plan you can put in front of an examiner or insurer
- Best for
- A deadline: an exam, a renewal, a questionnaire
Full resilience program
Weeks to months
- Scope
- The whole operation, with recovery strategies and a tested plan
- What you get
- A complete, role-specific playbook your team has rehearsed
- Best for
- Most firms that want continuity they can rely on when it counts
Ongoing maintenance and testing
Ongoing
- Scope
- Your plan kept current, with regular exercises
- What you get
- Annual reviews and tabletops so the plan stays ready
- Best for
- Firms that need it kept current, not filed and forgotten
Who does the work
Your plan is built by people who've run operations through real disruptions as CISOs, CTOs, and CIOs, not lifted from a generic template. They know the difference between a plan that reads well and one that holds when the building's dark and the phones are ringing.