What must keep working?

What must you continue to deliver?

List the activities that protect people, meet critical commitments and keep the organisation viable. Agree a minimum acceptable service, the maximum tolerable interruption and who owns each decision.

Useful output: a short essential-service register with priorities and named owners.

What does each activity rely on?

Map staff, premises, power, cooling, telecommunications, identity services, applications, data, payments and suppliers. Look for shared dependencies that could disable both your main and fallback arrangements.

Useful output: a dependency map and a prioritised list of gaps.

Can you restore a working service?

Agree recovery time and acceptable data loss with business owners. Test whether recovered data and systems are usable with the people, permissions and connections available. A successful backup job is only one part of recovery.

Useful output: a recovery sequence, required inputs and a record of an actual restoration test.

Who decides, and how will people hear?

Define incident authority, deputies, escalation triggers and alternative contact methods. Include staff welfare, accessibility, caring responsibilities and the possibility that transport or premises are unavailable.

Useful output: a leadership action card, contact arrangements and staff instructions that can be accessed offline.

What happens when you test the assumptions?

Start with a tabletop interruption: normal power, cloud access or premises become unavailable. Walk through decisions and handoffs. Record gaps, owners and dates, then retest the changes.

Useful output: an exercise report and an action register that is maintained between reviews.

SPECIALIST EQUIPMENT ASSESSMENT

Before commissioning a Faraday enclosure.

A specified enclosure can reduce particular electromagnetic exposures. Complete functional protection depends on the design basis, connected equipment and installation. A room or cabinet alone does not establish business continuity.

• Define the equipment and business function to preserve.
• Agree exposure assumptions, operating mode and recovery requirements.
• List every power, data, antenna, ventilation and mechanical penetration.
• Assess heat, batteries, fire safety, access and maintenance.
• Use competent specialists to specify design and appropriate acceptance tests.
• Require measured results, drawings, deviations and maintenance instructions.
• Demonstrate useful recovery of the service as well as equipment operation.

A phone losing reception is not evidence that an EMP requirement has been met. A protected device still depends on power, data and usable external services.