By role · Business Continuity Manager
A plan you tested. Not a plan you wrote.
Process owners who never log in still have to answer the impact questionnaire. Scope the BIA as a campaign, author the plans behind it, then test them on a schedule with findings attached to every run.
What this replaces
- Half the process owners stop answering after the second email chase.
- Two years since the last approval; no one has opened it since.
- The last test was a tabletop that produced no written findings.
What you do here
- 1Scope a BIA as a campaign.Pick the processes, name the owners, send it, then chase non-responders with reminders instead of a fourth email.BIA campaigns
- 2Collect answers from owners with no account.Each process owner opens a tokenized link and answers one questionnaire: no account, no password, nothing for IT to provision.BIA questionnaire
- 3Author the continuity and recovery plans.Cloud DR, cyber recovery, data integrity, network recovery and failback each get their own section inside the plan record.Recovery plans
- 4Fold the escalation matrix into the plan.Activation criteria, deactivation criteria and severity-response rules live inside the plan record, not in a side document gone stale.Continuity plans
- 5Run a test and raise findings against it.Schedule it, start it, complete it, then duplicate the run for next quarter. Every finding stays attached to the test.Plan tests
- 6Activate a plan for a real event.Every declaration writes an activation record with its own event log, beside the dependency graph and the readiness score.Command Center
What changes
- A BIA campaign tracks distribution, reminders and a response trend as the answers land.
- Five recovery domains: cloud DR, cyber recovery, data integrity, network recovery, failback.
- Every test run keeps its findings and its date. The plan becomes an exercise record.
BIA campaignsPublic BIA formContinuity plansDisaster recovery plansRecovery teamsPlan testsCommand Center
Where the role stops
Assets and incidents open for reading only. Plans, tests and recovery teams are yours; the risk register you will go looking for sits on somebody else's desk.
Works with
- Risk ManagerSpreadsheet registers miss the connections. Set the scoring methodology once, then let every entry hold the controls, processes, incidents, KRIs and vulnerabilities it actually touches, with treatment plans and formal acceptances on the record.RISK
- IT ManagerAn inventory is accurate on the day it was exported. Here the register stays live, exceptions are written decisions and each system is scanned against its baseline with the hardening add-on.ASSETS
- SOC ManagerContinuity is the SOC's hardest problem; it dies at seven in the morning. Rota, escalation, workload and a signed handover keep it alive. Cases and incident records are yours to close — or to delete.SOC
Ready to move
beyond legacy GRC?
14-day free trial. No credit card. Cloud or on-premises.