Managed continuity: a programme that does not expire at handover
Business Continuity as a Service provides a consistent owner for the routine work that makes recovery plans dependable: checking personnel and supplier changes, updating business impact analyses, organising exercises, recording lessons and reporting unresolved risks. It fits firms that have an established continuity requirement but do not need a permanent full-time continuity manager.
A managed agreement should specify what is monitored and updated, by whom and how often. It should not imply a permanent emergency response team when the contract covers scheduled programme work only. Where live incident assistance is required, availability, contact points and response times must be agreed separately.
The operational cycle
Monthly: collect change notifications from agreed process owners, update contact and dependency records and review open actions. Quarterly: hold a risk and change workshop, review supplier dependencies and report exceptions to the relevant governance forum. Annually, or sooner following material change: revisit BIA assumptions, agree the exercise plan and update the framework and crisis communications arrangements.
The outputs are version-controlled BCPs; a BIA and recovery-objective register; exercise plans and results; training records; and a transparent list of decisions still requiring the client’s approval. For regulated firms, those records can also support—but do not automatically satisfy—operational resilience obligations.
What is different from managed IT disaster recovery?
Disaster recovery concerns restoring technology, data and infrastructure. Continuity covers the capacity of an organisation to deliver services through people, alternative processes, premises, communications and third parties. For example, an application being online again says little about whether payments have been reconciled or whether people can perform the regulated checks required to resume the service.
Choose the right initial level of support
A firm with no working BIA or exercised plans may need a defined establishment project before a retainer. A firm with current records, clear owners and reasonable controls might start directly with scheduled reviews. Pricing should therefore separate the initial clean-up from the recurring maintenance effort instead of burying unpredictable projects in an apparently low monthly fee.
The evidence you should expect to see
A client should be able to open a current, signed-off plan; see when and why it changed; locate the latest exercise findings; trace a vulnerability to its owner; and understand which key recovery assumptions have not been validated. If the provider cannot produce that trail, the service is an administrative subscription rather than an effective continuity capability.
Frequently asked questions
Is continuity management a monthly service?
It can be. The value is in scheduled maintenance and tested readiness, not simply storing copies of plans.
Can a retainer replace a continuity manager?
It can provide contracted specialist capacity. An internal accountable owner is still needed to make decisions, provide evidence and coordinate teams.
Will an external team lead an actual crisis?
Only if incident-response responsibilities and availability are specifically contracted; routine continuity retainers should not promise 24/7 response by default.