C5.6 Continuity

Ready.gov [16]; NIST IR 8286D [9]

The sixth component requires a business impact analysis per process, recording the maximum tolerable outage, the recovery time objective and the recovery point objective; that the declared recovery targets be confronted with the real capacity of the IT estate and the backup regime rather than accepted as declared; and that exercises produce corrective actions tracked to closure. The form comes from the public continuity guidance, which hands the practitioner a table with a row per function and the impact by duration band [16]; the extension of the analysis from availability to any kind of loss comes from the continuity volume of the register series [9].

The component reconciles two numbers that almost never agree: the recovery time the business says it needs and the recovery time IT can deliver. The guidance's two rules are written in as tests. The recovery time of an IT resource is that of the most demanding function depending on it, not a number the IT department chose; and the recovery point dictates backup frequency, so a four-hour recovery point with a nightly backup is a contradiction to be resolved on paper, not in the crisis. A continuity plan that fails either test is flagged in the register rather than filed. The component sits in Monitor rather than Respond because its substance is confrontation: the plan is a response, the exercise is the measurement.