Learning Objectives

By the end of this lesson, learners should be able to:

  • Explain business continuity management (BCM).
  • Identify critical business functions.
  • Develop continuity and recovery strategies.
  • Strengthen operational resilience.
  • Lead cyber-crisis preparedness and response.

Learning Material

Business Continuity Management

Business Continuity Management is the capability that enables an organization to continue delivering critical products and services during and after disruption.

BCM focuses on maintaining essential operations rather than restoring every activity immediately.

Business Continuity vs Disaster Recovery

Business Continuity

Disaster Recovery

Maintains critical operations

Restores technology and infrastructure

Broader organizational focus

Primarily IT focus

Includes people, processes, facilities, suppliers

Includes systems, data, networks

Both are necessary and should be integrated.

Business Impact Analysis (BIA)

The BIA identifies:

  • Critical activities,
  • Maximum tolerable downtime,
  • Financial impact,
  • Customer impact,
  • Regulatory impact,
  • Resource dependencies.

Executives use BIA results to prioritize recovery efforts.

Recovery Objectives

Recovery Time Objective (RTO)

Maximum acceptable downtime.

Recovery Point Objective (RPO)

Maximum acceptable data loss.

Example: An online-payment platform may require an RTO of 1 hour and an RPO of 15 minutes.

Continuity Strategies

People

Cross-training, remote work capability, succession coverage.

Facilities

Alternative sites, hybrid work arrangements.

Technology

Backups, cloud redundancy, failover systems.

Suppliers

Secondary suppliers, inventory buffers.

Processes

Manual workarounds and simplified procedures.

Executives must balance resilience with cost.

Operational Resilience

Operational resilience is the ability to deliver important services despite disruption.

Key capabilities include:

  • Process visibility,
  • Dependency mapping,
  • Redundancy,
  • Real-time monitoring,
  • Rapid escalation,
  • Incident coordination.

Resilience is increasingly a regulatory expectation in many sectors.

Cyber Risk Landscape

Common cyber threats include:

  • Ransomware,
  • Phishing,
  • Credential theft,
  • Insider misuse,
  • Data breaches,
  • Distributed denial-of-service attacks,
  • Supply-chain attacks.

Cyber risk is a business risk, not merely an IT issue.

Executive Cyber Responsibilities

Executives should ensure:

  • Cyber governance,
  • Security investment,
  • Incident-response capability,
  • Employee awareness,
  • Third-party security oversight,
  • Regular testing,
  • Board reporting.

Boards increasingly expect cyber-risk oversight from management.

Cyber Incident Response

Typical phases:

  1. Detect,
  2. Contain,
  3. Investigate,
  4. Eradicate,
  5. Recover,
  6. Communicate,
  7. Learn.

Delayed containment often increases damage.

Ransomware Executive Dilemma

Executives may face questions such as:

  • Should systems be disconnected?
  • Should law enforcement be notified?
  • Should customers be informed immediately?
  • Should ransom be paid?

These decisions require legal, ethical, operational, and reputational assessment.

International Case Study: Maersk Cyberattack (NotPetya)

The cyberattack severely disrupted global shipping operations. Recovery required extensive system rebuilding and demonstrated the importance of backups, segmentation, and crisis coordination.

Executive Lessons

  • Cyber incidents can halt core operations.
  • Recovery may be far more costly than prevention.
  • Executive-level coordination is essential.

African Case Study: Banking-Sector Cyber Resilience Initiatives

Banks across Africa have increased investment in cybersecurity operations centers, fraud monitoring, customer-awareness campaigns, and digital-security controls as cyber threats have intensified.

Executive Continuity Exercise

List your organization’s top five critical services. For each service, identify:

  • Maximum tolerable downtime,
  • Key dependencies,
  • Alternative arrangements,
  • Executive owner,
  • Testing frequency.

Best Practices

  • Conduct annual continuity tests.
  • Maintain offline backups.
  • Train employees on cyber awareness.
  • Map critical dependencies.
  • Review continuity plans after every major disruption.

Lesson Summary

Business continuity and operational resilience enable organizations to maintain critical services during disruption. Cyber resilience requires executive oversight, preparedness, rapid response, and continuous learning.

PreviousNext