Continuity, resilience, recovery: three words, three jobs
Three words everybody conflates
In most organisations three words circulate as if they were interchangeable: continuity, recovery, resilience. They are not, and the confusion is expensive — because it hands a technical team a problem that belongs to the executive.
Business continuity
ISO 22300 defines continuity as the capability of an organisation to continue delivering products and services at an acceptable predefined level following a disruption.
Three words in that definition deserve a second reading:
- Capability. Not a document, not a binder, not a tool. An organisation holding three hundred pages of plans and nobody able to apply them on a Sunday night has no continuity capability.
- Acceptable predefined level. Continuity does not promise a return to normal. It promises a degraded level, known and accepted in advance. That level has a name: the MBCO.
- Products and services. The starting point is not the internal process but what the organisation delivers outward.
IT recovery
IT recovery — the DR plan — describes restoring information systems on a recovery infrastructure. It is a component, often the costliest, never the whole.
An organisation whose servers restart in four hours but whose teams have no premises, no access and no degraded procedure has not resumed its business. It is watching its servers run.
Resilience
Resilience subsumes continuity and adds two dimensions: adaptation — the ability to operate durably in an environment that has changed — and learning — the ability to come out of a shock stronger than you went in.
An organisation has continuity when it survives the outage. It is resilient when the next outage hurts less.
Why the distinction is operational
The distinction is not academic: it determines accountability.
| Object | Question asked | Natural owner |
|---|---|---|
| IT recovery | How long until systems restart? | Infrastructure / operations |
| Business continuity | What must we absolutely keep doing, and how? | Executive, through the business lines |
| Resilience | Are we still viable in six months? | Board and executive committee |
Handing continuity to IT means asking a function to answer a question it has no mandate to settle. It is the most frequent governance error, and it shows up immediately in an audit: the RTOs were set by the people who had to meet them, not by the people who had to live with them.
Key takeaways
- Continuity is a capability; the plan is only its written trace
- IT recovery is a subset, never the equivalent
- Resilience adds adaptation and learning to continuity