GUIDE · Business Continuity & Resilience Advisory
Keep Critical Services Running When Disruption Arrives.
We design continuity and resilience plans around the services your institution and its customers cannot do without.
- Rehearsed, proven recovery
- Agreed recovery priorities
- Leaders ready to decide under pressure
- 1Scope the Services
- 2Analyze Business Impact
- 3Select Recovery Strategies
- 4Write Usable Plans
- 5Exercise and Maintain
Executive Summary
- 01Continuity planning begins with agreed recovery objectives for each critical service, not with a list of systems.
- 02Cyber events break the usual assumptions, so plans must cover compromised backups, clean rebuilds and fast decisions.
- 03Only rehearsal shows whether a stated recovery time can be met.
The Challenge
Continuity plans are often written once, stored and never rehearsed against a cyber scenario such as ransomware.
When an incident lands, teams discover that recovery priorities, dependencies and decision rights were never agreed.
The DAAKYI Approach
DAAKYI identifies critical services and their dependencies, sets recovery objectives with the business and builds plans that integrate cyber incident response.
Plans are then exercised so leaders have rehearsed their response.
- 01
Business impact analysis
- 02
Recovery objectives and strategies
- 03
Continuity and crisis plans
- 04
Exercises and plan maintenance
In Depth
How the Discipline Works
Recovery Objectives Drive Every Decision
Continuity work starts with a simple question: which services, if interrupted, cause unacceptable harm, and how quickly must each return? The answers become recovery time objectives and recovery point objectives. A recovery time objective states how long a service may be unavailable. A recovery point objective states how much data loss the business can tolerate. These figures are negotiated with service owners, not assumed by IT. They then determine backup design, failover investment, staffing and vendor contracts. Without agreed objectives, every system looks equally urgent, and teams waste the first critical hours arguing over what to restore first.
Dependencies Hide the Real Risk
A service rarely fails on its own. It depends on applications, identity systems, networks, data stores, facilities, suppliers and specific people. Dependency mapping traces each critical service through all of these layers. The map often reveals single points of failure, such as one directory service that every restoration step requires, or one vendor holding the only copy of a configuration. It also exposes circular dependencies, where the tool needed for recovery is itself offline. Mapping these early lets planners sequence recovery in the correct order and decide where redundancy is worth the cost.
Cyber Events Change the Plan
Traditional continuity plans assume a facility is lost or a system fails. Cyber events differ because the damage may be spreading, backups may be compromised and the environment may not be safe to restore into. Plans must therefore include steps for containment, evidence preservation, clean-room rebuilds and verified restoration points. Decision rights matter here: someone must be authorized to isolate systems, shut down services or approve a restore that risks reinfection. Alignment with incident handling guidance such as NIST SP 800-61 keeps the technical response and the business response moving on the same timeline.
A recovery objective nobody has tested is a guess. Rehearsal turns it into evidence leaders can rely on.
Capability Matrix
What the Service Includes
| Capability | Coverage | GUIDE | SECURE | OPERATE | Delivered Through |
|---|---|---|---|---|---|
| Business Impact Analysis | Critical services and dependencies identified. | GUIDE stage | – | – | Advisory Engagements |
| Continuity Strategy | Recovery options matched to objectives. | GUIDE stage | – | – | Advisory Engagements |
| Crisis Management | Decision rights and communications. | GUIDE stage | – | – | Advisory Engagements |
| Exercises | Tabletop and scenario rehearsals. | GUIDE stage | – | – | Advisory Engagements |
Business Impact Analysis
Critical services and dependencies identified.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements
Continuity Strategy
Recovery options matched to objectives.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements
Crisis Management
Decision rights and communications.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements
Exercises
Tabletop and scenario rehearsals.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements
How It Works
How Business Continuity & Resilience Advisory Works
- 01Impact Analysis
- 02Strategy
- 03Plans
- 04Exercise
Methodology
The Method, Step by Step
- 1
Scope the Services
Agree the boundary of the program: which business units, services, sites and suppliers are in scope. Confirm sponsors and obtain access to service owners. A clear scope prevents the analysis from sprawling and sets the basis for later audit evidence.
- 2
Analyze Business Impact
Interview service owners to estimate financial, operational, legal and safety impact over time as an outage lengthens. Identify the maximum tolerable period of disruption for each service. Rank services so that recovery effort and budget follow actual consequences rather than internal politics.
- 3
Select Recovery Strategies
Compare recovery options against each objective: backup and restore, warm standby, active-active, manual workarounds and alternate suppliers. Weigh cost against tolerable downtime. Record accepted residual risks so executives sign off on any gap between the objective and what the chosen strategy delivers.
- 4
Write Usable Plans
Document procedures that a tired, unfamiliar responder can follow. Cover activation criteria, roles, contact trees, communications templates and cyber-specific branches. Keep each plan short, version-controlled and stored where it remains reachable when corporate systems are down, including offline copies.
- 5
Exercise and Maintain
Rehearse plans against realistic scenarios, record gaps and assign fixes. Review plans after every significant change in systems, suppliers or organization, and after every real incident. A scheduled review cycle, with a named owner, keeps the documents aligned with the environment they describe.
Operating Model
Delivered from the GUIDE Pillar
Pillar position
GUIDE
Advisory, Risk & Assurance
Engagement model
Advisory Engagements
Fixed-scope assessments, strategy, compliance and testing.
Best for · Defined questions with a clear deliverable
Threat Scenarios
What It Looks Like in Practice
Ransomware on Core Systems
How It Shows Up
File servers and applications become inaccessible, a ransom note appears, and backup consoles may be locked or deleted.
Response
Activate the crisis team, contain the spread, and restore in tier order from verified clean copies while leadership decides on communications and the extortion question.
Cloud Provider Outage
How It Shows Up
A hosted platform that several services depend on degrades, and the supplier status page offers few details.
Response
Invoke documented workarounds and supplier escalation paths, and use the dependency map to identify exactly which services are affected.
Loss of Identity Services
How It Shows Up
Staff cannot sign in, administrators lose privileged access, and recovery tools that need authentication stop working.
Response
Use break-glass accounts and an isolated recovery path held offline, and restore directory services before everything that depends on them.
Breach with Notification Duties
How It Shows Up
Evidence suggests personal data was taken, and the clocks for regulator and customer notification start running.
Response
The crisis plan names who assesses the breach and who approves notices, so duties such as GDPR's 72-hour notification where feasible, or Ghana incident reporting, are met.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Ransomware on Core Systems | File servers and applications become inaccessible, a ransom note appears, and backup consoles may be locked or deleted. | Activate the crisis team, contain the spread, and restore in tier order from verified clean copies while leadership decides on communications and the extortion question. |
| Cloud Provider Outage | A hosted platform that several services depend on degrades, and the supplier status page offers few details. | Invoke documented workarounds and supplier escalation paths, and use the dependency map to identify exactly which services are affected. |
| Loss of Identity Services | Staff cannot sign in, administrators lose privileged access, and recovery tools that need authentication stop working. | Use break-glass accounts and an isolated recovery path held offline, and restore directory services before everything that depends on them. |
| Breach with Notification Duties | Evidence suggests personal data was taken, and the clocks for regulator and customer notification start running. | The crisis plan names who assesses the breach and who approves notices, so duties such as GDPR's 72-hour notification where feasible, or Ghana incident reporting, are met. |
Outcomes
What Your Institution Gains
- Rehearsed, proven recovery
- Agreed recovery priorities
- Leaders ready to decide under pressure
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| Business Impact Analysis Report | Records critical services, impact over time and the recovery objectives agreed with owners. |
| Dependency Map | Shows the systems, suppliers and people each critical service relies on. |
| Recovery Strategy Options Paper | Compares options by cost and delivered objective so executives can decide. |
| Continuity and Crisis Plans | Give responders tested procedures, decision rights and communication templates. |
| Exercise Report with Action Log | Records observed performance and assigns an owner to every gap. |
| Role | Responsibility |
|---|---|
| Executive Sponsor (Client) | Approves recovery objectives and formally accepts residual risk. |
| Service Owner (Client) | Supplies impact data and validates recovery priorities for the service. |
| Crisis Lead (Client) | Convenes decision makers and directs the organization's response during an event. |
| Exercise Facilitator (Provider) | Designs scenarios, runs sessions and documents observed gaps without steering outcomes. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Ad Hoc
Plans are absent or outdated, and recovery depends on the memory of a few individuals.
Stage 2
Documented
Plans cover major systems, but objectives are unvalidated and cyber scenarios are missing.
Stage 3
Exercised
Objectives are agreed, plans are rehearsed regularly, and each gap becomes a tracked fix.
Stage 4
Managed
Plans change with the business, supplier risk is monitored, and leaders review measured recovery performance.
Frameworks and Regulation
The Standards That Shape This Work
ISO 22301
Specifies requirements for a business continuity management system, including impact analysis, strategies, exercising and continual improvement.
NIST CSF 2.0
Its Recover function, together with Govern, frames recovery planning, communications and accountability alongside cyber risk.
NIST SP 800-61
Gives incident handling guidance that continuity plans should align with for containment, eradication and recovery.
Ghana Cybersecurity Act, 2020 (Act 1038)
Provides for protection of Critical Information Infrastructure and for incident reporting, which shape notification steps in crisis plans.
Buyer Guidance
Choosing the Right Provider
What to look for
- Insist that recovery objectives are agreed with service owners, not set by the provider alone.
- Check that plans include ransomware branches, such as compromised backups and clean rebuilds.
- Expect exercises with measurable objectives and a written action log.
- Confirm that deliverables map to ISO 22301 so auditors can trace the evidence.
Questions to ask a provider
- How do you validate recovery time objectives against real restoration tests?
- How will you map dependencies on suppliers and cloud services?
- Which scenarios will you use in exercises, and how are they tailored to us?
- How do findings reach the teams that will carry out recovery?
Regulatory & Industry Context
The Obligations This Service Supports
Programs align to ISO/IEC 22301 and support regulator expectations for operational resilience in critical sectors.
Frameworks DAAKYI helps clients implement
- ISO/IEC 22301
- NIST CSF
Framework references describe client implementation support, not DAAKYI certifications.
Technical Detail
For Architects and Security Leads
Framework and regulatory alignment
- ISO/IEC 22301
- NIST CSF
Programs align to ISO/IEC 22301 and support regulator expectations for operational resilience in critical sectors.
Architecture reference
How Business Continuity & Resilience Advisory Works: Impact Analysis → Strategy → Plans → Exercise.
DAAKYI identifies critical services and their dependencies, sets recovery objectives with the business and builds plans that integrate cyber incident response.
Restoration Sequencing and Tiering
Recovery tiers group services by objective so restoration follows a defined order. A common pattern places identity, DNS, networking and core security tooling in the first tier, because nearly everything else depends on them. Business-critical applications follow, then supporting systems. Each tier carries tested runbooks with named owners, entry criteria and exit criteria. Technical teams validate backups against the recovery point objective, not merely against job success reports. Immutable or logically isolated copies protect against deletion by an attacker holding administrative credentials. Restores are rehearsed into an isolated segment, scanned, and checked for persistence before reconnection. Measured restoration times from these rehearsals replace estimates and show whether the stated recovery time objective is achievable.
Exercise Design and Measurement
An exercise is built from an injected scenario, a timeline of escalating events and a set of observable objectives. Ransomware scenarios typically inject encrypted file servers, a ransom note, a leaked data sample and a regulator inquiry in sequence. Facilitators record time to declare an incident, time to convene the crisis team, quality of decisions and accuracy of communications. Tabletop formats test judgment. Functional exercises test specific procedures, such as a restore from backup. Full simulations involve live systems and carry more risk. Findings are logged with owners and due dates, and the next exercise checks whether each fix actually worked.
Glossary
Key Terms
- Recovery Time Objective (RTO)
- The target time within which a service must be restored after disruption.
- Recovery Point Objective (RPO)
- The maximum acceptable age of data restored, which sets how often it must be copied.
- Maximum Tolerable Period of Disruption
- The point at which an outage causes harm the organization cannot accept.
- Clean‑Room Recovery
- Rebuilding systems in an isolated environment verified free of attacker presence before reconnecting them.
Related
Explore Connected Capabilities
Related services
Solutions
Platforms
Industries
Proof Points
What We Can Stand Behind
- Every stage of DAAKYI's delivery methodology produces documented, auditable deliverables.
FAQ
Questions Leaders Ask
DAAKYI Intelligence
Ask Kasara About Business Continuity & Resilience Advisory
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step
Discuss Business Continuity & Resilience Advisory with DAAKYI
Tell us about your environment and obligations. A DAAKYI specialist for Business Continuity & Resilience Advisory will respond.
Talk to a Cybersecurity Expert