Unit
- Contingency planning: the structured process of preparing an organization to respond to potential future events that could disrupt normal operations, including natural disasters, technology failures, supply chain interruptions, and workforce disruptions, with the goal of minimizing operational and financial damage.
- Organizational resilience: the capacity of an organization to anticipate, prepare for, respond to, and adapt to incremental change and sudden disruptions in order to survive and prosper, a concept formalized in standards such as
ISO 22316. - Business continuity: a subset of contingency planning focused specifically on maintaining essential business functions during and after a disruption, distinct from disaster recovery which focuses narrowly on restoring technology infrastructure.
- Disaster recovery: the technical component of continuity planning that addresses restoring IT systems, data, and applications after an outage, typically measured through recovery time objectives and recovery point objectives.
- Risk tolerance: the level of variation in outcomes an organization is willing to accept in pursuit of its objectives, which directly shapes how aggressively a contingency plan is scoped and funded.
- Single points of failure: critical nodes in a process, system, or supply chain where a breakdown would halt the entire operation, and identifying these is a foundational step before any contingency plan can be drafted.
- Plan versus capability: a written plan is only a static document; true preparedness requires trained personnel, tested procedures, and available resources that can be activated regardless of whether the exact scenario matches the document.
- Interdependencies: the web of relationships between departments, vendors, technology systems, and personnel that must be mapped so that a disruption in one area is not underestimated in its effect on others.
- Proactive versus reactive posture: organizations with mature contingency programs invest resources before an event occurs, while reactive organizations only build capability after suffering a costly disruption, often at far higher cost and reputational damage.
Strategic Framework
Framework: Resilience Maturity Model
Purpose: to assess how far an organization has progressed from ad hoc reaction toward institutionalized resilience capability.
- Level 1, Reactive: no formal plans exist; response is improvised during each incident.
- Level 2, Documented: plans exist on paper but are rarely tested or updated.
- Level 3, Practiced: plans are tested through simulations and drills on a regular cycle.
- Level 4, Integrated: contingency planning is embedded into strategic decision making, budgeting, and vendor selection.
- Level 5, Adaptive: the organization continuously learns from near misses and actual events, updating plans dynamically.
Quick Revision
- Contingency planning prepares organizations for disruptive events before they occur.
- Business continuity and disaster recovery are related but distinct disciplines within the broader contingency umbrella.
- Single points of failure and interdependencies must be mapped early in the planning process.
- The Resilience Maturity Model provides a five-level lens for assessing organizational preparedness.