A recovery plan is a theory until you restore from it
We help you work out what must keep running, write the plans to keep it running, and test them before a real outage does it for you.
Overview
What business continuity and disaster recovery cover
Business continuity is about keeping critical activities going during a disruption: an outage, a ransomware incident, a lost site or a failed supplier. Disaster recovery is the technical part: restoring systems and data within the time the business can tolerate.
Both start with a business impact analysis. Which activities matter most, how long can each be down, and how much data can you afford to lose. Those answers become recovery time and recovery point objectives, and the plans are built to meet them. Then comes the part most plans skip: restoring from backup for real, and walking the people through a scenario at a table.
ISO 22301 is the certifiable standard for business continuity management, and certification comes from an accredited certification body. Continuity also appears in ISO/IEC 27001, NIS2 and DORA. Black Fox helps you build and test the plans; we do not issue the certificate, but we work with long-standing certification partners and coordinate the audit when you go for it.
Who it is for
Organisations whose clients, insurers or regulators ask for tested continuity plans, companies in scope of NIS2 or DORA, teams preparing for ISO 22301 or ISO/IEC 27001, and anyone whose backups have never been restored on purpose.
The work, from scoping to evidence.
What we do
Business impact analysis
The critical activities, their dependencies on people, systems and suppliers, and how long and how much loss each can tolerate.
Business continuity plan
Roles, decision points, communication and workarounds that keep critical activities going while systems are down.
Disaster recovery plan
The technical steps, order and responsibilities to restore systems and data within the agreed objectives.
Backup and restore testing
A review of backup design, including isolation from the systems it protects, and restores performed and timed against your objectives.
Tabletop exercises
A realistic scenario walked through with management and technical teams, to find the gaps in the plan before an incident does.
Alignment with standards
Plans structured so they can support ISO 22301, ISO/IEC 27001, NIS2 or DORA work where those apply.
How the engagement runs
Kickoff
We agree the scope, the scenarios that concern you and the people involved, and sign an NDA first if you need one.
Proposal
A business proposal with the method, the scope and the contract type that suits you.
Impact analysis
Interviews with business and IT owners, ending in agreed recovery objectives and a list of dependencies.
Plans
Continuity and recovery plans drafted with your teams and checked against the objectives.
Testing
Restore tests and a tabletop exercise, each with a written record of what worked and what did not.
Results handover and closing
The plans, the test reports and a list of improvements, followed by project close with your feedback.
What you receive
- Business impact analysis with recovery objectives
- Business continuity plan
- Disaster recovery plan for the systems in scope
- Backup and restore test report
- Tabletop exercise report with lessons learned
- Improvement plan with owners
Questions
What is the difference between a BCP and a DRP?
A business continuity plan keeps the business running during a disruption: people, decisions, communication and workarounds. A disaster recovery plan restores the technology. You need both, and they need to agree on the same recovery objectives.
Do you certify us to ISO 22301?
No. ISO 22301 certificates are issued by accredited certification bodies. We help you build the business continuity management system and the plans behind it, prepare you for the audit and coordinate it with one of our long-standing certification partners or a body of your choice.
Will you actually restore our systems?
Yes, if you want us to, in a controlled way and agreed in advance. A restore test can run in an isolated environment so production is not touched. A backup you have never restored is a hope, not a control.
Does this cover ransomware?
Ransomware is one of the scenarios we plan and exercise for, including backups the attacker cannot reach. Responding to an actual incident is covered by our forensics and incident response service.
Related services
- Compliance and certificationISO 22301ISO 22301 support from Black Fox Security: BCMS scoping, business impact analysis, continuity strategies, plans, exercises and certification audit preparation.
- Advisory and responseDigital forensics and incident responseDFIR from Black Fox Security: incident post-mortems, network and storage forensics, reverse engineering, data recovery, response plans and tabletop exercises.
- Compliance and certificationDORADORA support from Black Fox Security: ICT risk management gap assessment, incident reporting, digital operational resilience testing and ICT third-party risk.
- Governance and riskSecurity risk assessmentInfrastructure, network and application risk assessment by Black Fox Security: probability versus severity, a risk register your owners use and treatment options.
Start with what must keep running
Tell us which activities you cannot do without. We will help you plan for their loss and test the plan.