Business Continuity & Operational Resilience Checklist

1.1 Have all critical business functions and their dependencies (people, processes, technology, and third parties) been clearly identified and documented?

1.2 Is there a regular process for identifying and assessing potential threats (cyberattacks, natural disasters, utility failures) and vulnerabilities to your critical business functions?

1.3 Has a comprehensive Business Impact Analysis (BIA) been conducted to determine the financial and operational impacts of disruptions, establishing Recovery Time and Recovery Point Objectives?

2.1 Is there a documented, approved, and accessible Business Continuity Plan (BCP) that outlines procedures for responding to and recovering from disruptive events?

2.2 Have specific recovery strategies been defined and resourced for each critical business function to meet their established RTOs and RPOs?

2.3 Is there a clear crisis management and communication plan in place for internal and external stakeholders during a disruptive event?

3.1 Is there a separate, documented, and regularly updated Disaster Recovery (DR) plan for critical IT systems, applications, and data?

3.2 Are comprehensive data backup and restoration strategies in place, with regular testing to verify successful data recovery?

3.3 Are critical IT systems and infrastructure designed with redundancy and failover capabilities to minimize single points of failure?

4.1 Is there a regular program of testing and exercises (tabletop, simulation, live drills) for business continuity and disaster recovery plans?

4.2 Are all relevant employees regularly trained on their roles and responsibilities in business continuity and disaster recovery procedures?

4.3 Are the BCP and DR plans regularly reviewed and updated (at least annually) to reflect organizational changes, lessons learned, and evolving threats?

5.1 Is there a process for assessing the business continuity and disaster recovery capabilities of critical suppliers and third-party service providers?

5.2 Do your contracts with critical third parties include specific requirements for their business continuity, disaster recovery, and data protection capabilities?

5.3 Is there ongoing monitoring of third-party risks, including their financial stability, security posture, and compliance status?