BIA · BCP · DR testing · ISO 22301
A business continuity plan proven by a restore test, not by a review
Many continuity plans have never been run. Everyone knows the backups are taken, but nobody has timed how long it takes to bring back the system that stops sales when it goes down. We agree target times with the process owners, write the plan and prove it with a test result an auditor will accept.
// In short
Business continuity management in practice
Business continuity management (BCM) decides which processes must keep running during an outage, how fast each one comes back and how much data it can lose, and then proves it with a test. It is for companies under NIS2, DORA or customer requirements that have to show a working plan, not just a document.
A plan nobody has exercised is an assumption. A timed test result is evidence.
// What we do
From impact analysis to a timed test
Each part can be ordered on its own. The analysis and the test work best together: the test quickly shows which assumptions in the analysis were too optimistic.
01BIA
Business impact analysis
Processes, systems, data and the suppliers they depend on. For each process a recovery time objective (RTO) and a recovery point objective (RPO), agreed with the process owner rather than filled in by IT.
02Plan
Business continuity plan and recovery runbooks
Who declares the incident, who decides, who restores, in what order and from which backups. The runbooks are stored where people can reach them when email and the intranet are down.
03Tabletop
Tabletop exercise with management and the crisis team
A scenario such as ransomware in the office network, a cloud region outage or losing a key supplier. We test decisions, roles and communication without touching any system.
04Technical test
Restore or failover test
We restore a system from backup or fail it over to a standby environment and time every step. The result is compared with the RTO and RPO from the impact analysis.
05Backups
Backups you can actually restore
Scope, frequency and retention, a copy isolated from the production network and regular restore trials. A backup nobody has restored from is not yet a control.
06Communication
Crisis communication
Who informs the board, staff, customers and the authorities, over which channels and within which deadlines. Under the Polish KSC Act an early warning is due within 24 hours.
// Regulations
Business continuity in DORA, NIS2 and the Polish KSC Act
None of these laws prescribes a tool. They ask for a plan, tests and documentation you can show to a regulator or an auditor. NIS2 Article 21(2)(c) names business continuity, backup management, disaster recovery and crisis management.
DORA
ICT continuity plans tested at least yearly
Financial entities test their ICT business continuity plans and ICT response and recovery plans at least once a year and after substantive changes (DORA Article 11(6)). Article 12 covers backups, restoration and recovery.
Regulation (EU) 2022/2554 (opens in a new tab)NIS2 in Poland (KSC)
Continuity plans as part of the ISMS
KSC Article 8(1)(2)(f): implementing, documenting, testing and maintaining business continuity and recovery plans. Documentation of the business continuity management system is part of the required security documentation (Article 10(3)(3)).
Dz.U. 2026 item 252 (opens in a new tab)NIS2 in Poland (KSC)
First audit of essential entities
For entities that were essential on 3 April 2026 (Article 33(2) of the amending act). The auditor will ask for the plan and for the result of its last test.
Formal KSC audit rules
As of . Sources: DORA, NIS2 Directive, Dz.U. 2026 item 252. In Germany the same duty sits in § 30(2) no. 3 BSIG.
First step: one critical process and one restore test in 5 weeks
Impact analysis for one process
We pick the process whose outage hurts most, for example order intake or shipping, agree its RTO and RPO with the owner and list the systems and suppliers it depends on.
Plan and backup review
We check whether the plan and the runbooks match what actually runs, and whether the backups cover everything the process needs.
Restore test in an agreed window
We restore one critical system from backup or fail it over to a standby. Every step is timed and the logs from the test go into the test record.
Gap report and 90-day plan
What missed the RTO or RPO, why, who fixes it and by when.
You end up with: a test record for one critical system, with measured times compared against its RTO and RPO
Scope and date are fixed in writing before we start. Book a continuity plan test
// Scope
What we do and what we don't
Scope and test windows are agreed in writing before we start, together with a rollback plan.
We do
- A business impact analysis with RTO and RPO agreed with the process owners
- A business continuity plan, recovery plans and runbooks for the teams
- Tabletop exercises with management and the crisis team
- Technical restore and failover tests, with a record and measured times
- Preparation for an ISO 22301 certification audit and a retest after fixes
We don't
- ISO 22301 certification: certificates come from accredited certification bodies
- A plan copied from a template and never tested
- Tests that stop production without an agreed window and a rollback plan
- Reselling backup software or hardware
- Formal KSC audits: we don't perform them
If all you need is a document for the file, we will say so on the first call. The rules for formal audits are on our NIS2 compliance in Poland page.
// Read more
Related topics and services
More on technology risk and resilience on our blog:
// FAQ
Questions about business continuity
What is the difference between a business continuity plan and a disaster recovery plan?
A business continuity plan says how the company keeps its key processes going during an outage, sometimes manually or at reduced capacity. A disaster recovery (DR) plan is the technical procedure for bringing specific systems and data back. You need both, and the RTO and RPO from the impact analysis tie them together.
Is business continuity a legal requirement under NIS2?
Yes. NIS2 Article 21(2)(c) lists business continuity, backup management, disaster recovery and crisis management. In Poland, KSC Article 8(1)(2)(f) requires continuity and recovery plans to be implemented, documented, tested and maintained from 3 April 2027. In Germany the basis is § 30(2) no. 3 BSIG. As of 24 September 2026.
How often should we test the plan?
Financial entities under DORA test their ICT continuity plans at least once a year and after substantive changes to their systems (Article 11(6)). The Polish KSC Act requires testing but sets no frequency. We recommend at least one technical test a year for every critical system and a tabletop exercise whenever the crisis team changes.
Tabletop exercise or technical test?
Both, because they test different things. A tabletop exercise shows whether people know who decides and whom to notify. A technical test shows whether the system comes back within the promised time. We usually start with the tabletop, because it is cheaper and quickly exposes gaps in roles.
Is a restore test safe for production?
Yes, if it is planned properly. Where possible we restore into an isolated environment. We only fail over production in an agreed window, with a rollback plan and a person on your side who can stop the test.
Can you help us get ISO 22301 certified?
We prepare the business continuity management system for the certification audit: scope, impact analysis, plans, tests, internal audit and management review. The certificate itself comes from an accredited certification body, not from us. The current edition is ISO 22301:2019 with its 2024 amendment.
Let's find out whether your plan works
Tell us which process hurts most when it stops. We will propose a test, a window and how we measure it. We reply within one business day.
Book a continuity plan testPrefer to talk first?
30 minutes on what you have today: the plan, the backups, the last test and its result.
Book a 30-minute call