Cloud services · Business continuity
Business continuity plan: impact analysis, ISO 22301 and the IT part, for Saudi organisations
A business continuity plan says how your organisation keeps its most important activities running, or brings them back, after a serious disruption: a lost building, a failed data centre, a cyberattack, a supplier that stops. It starts with a business impact analysis, sets a recovery target for each activity, then asks the technology to meet those targets. This guide covers how the plan is built, ISO 22301, what NCA ECC asks for in general terms, and where Interkey delivers the IT part in Saudi Arabia.
Published 9 min read
Orientation
At a glance
The guide in one table, for the reader with five minutes.
- What it is
- A documented way to keep critical activities running, or restore them, after a serious disruption
- Where it starts
- A business impact analysis: which activities matter, and how long each can stop
- What it sets
- A recovery time and a tolerable data loss for each activity, then for the systems behind it
- Standard
- ISO 22301, the international standard for business continuity management systems
- In Saudi Arabia
- NCA ECC includes a cybersecurity resilience domain; sector regulators and contracts can add more
- What Interkey does
- The IT part: backup, a recovery site, in-Kingdom failover and the tests, from Riyadh
In short, for executives
- A business continuity plan belongs to the business, not to IT, with a named owner for each activity.
- The impact analysis comes first. Without it, recovery budgets go to whichever system shouts loudest.
- Technology answers to the targets. Backup, a recovery site and failover are chosen to meet the recovery times the business set.
- A plan nobody has rehearsed is a draft. Exercises with written results make it one an assessor accepts.
What a business continuity plan covers, and what it leaves to others
A business continuity plan answers four questions for each critical activity: what must keep running, how soon it must be back, what it needs (people, premises, suppliers, systems, data), and who decides and acts when it stops. It also sets how the organisation communicates during a disruption.
It is broader than technology. A payroll run needs the HR system, but also the two people who approve it and a place they can work from. A plan that lists only servers misses most of what stops an organisation.
How each system is technically recovered belongs to the IT recovery plan, covered on our disaster recovery page. The business continuity plan sets the targets; the disaster recovery design meets them.
Relateddisaster recovery
BCP vs DRP: how the two plans divide the work
The two are often confused because they share vocabulary. This is how they divide the work in most organisations.
| Business continuity plan (BCP) | Disaster recovery plan (DRP) | |
|---|---|---|
| Scope | Critical activities: people, premises, suppliers, systems, communication | IT systems and the data they hold |
| Owner | A senior business manager, with an owner per activity | IT, against the targets the business set |
| Starts from | The business impact analysis | The recovery targets that come out of it |
| Contains | Priorities, workarounds, roles, who declares a disruption, communication | Recovery site, backups, replication, runbooks, failover steps |
| Proof | Exercises with the people who would act, and a written result | Restore and failover tests, timed against the targets |
Business impact analysis: where the plan starts, and what to record
A business impact analysis (BIA) asks each part of the organisation what it does, what would happen if it stopped, and how long it could stop before the harm became unacceptable. Record one row per critical activity; IT fills in the systems row.
| Field | What it means | Usually supplied by |
|---|---|---|
| Activity and owner | What the activity is, and the person accountable for it | Department head |
| Impact over time | What happens after an hour, a day, a week without it | Activity owner, finance, compliance |
| Maximum tolerable downtime | The point at which the harm is no longer acceptable | Activity owner, approved by management |
| Recovery target | How soon the activity must be back, at a minimum level | Activity owner |
| Systems and data | The applications behind the activity, with RTO and RPO for each | IT, with the activity owner |
| People, premises, suppliers | Key staff and their deputies, workplaces, third parties the activity depends on | Activity owner, procurement |
| Workaround | How the activity can continue, at reduced level, while systems are down | Activity owner |
Harm is more than money: penalties, regulatory exposure, safety and the trust of customers and government clients. The analysis produces a ranked list of activities, each with a maximum tolerable downtime and a recovery target. For the systems behind each activity these become a recovery time objective and a recovery point objective; our glossary entry on RTO and RPO explains both. A risk assessment runs alongside it, and the two together decide where continuity money is spent.
ISO 22301 and business continuity management, topic by topic
ISO 22301 is the international standard for business continuity management systems, built on the structure ISO's management system standards share. Topics in plain words; read the clauses in the current edition.
| Topic | What it asks the organisation to have | Evidence it usually produces |
|---|---|---|
| Context | An understanding of the organisation, interested parties, legal and regulatory requirements, and the scope of the system | A scope statement and a list of requirements |
| Leadership | Commitment from top management, a business continuity policy, defined roles | An approved policy and named roles |
| Planning | Actions on risks and opportunities, and business continuity objectives | Objectives with owners and dates |
| Support | Resources, competence, awareness, communication and documented information | Training records, a communication plan |
| Operation | Business impact analysis and risk assessment, continuity strategies, plans and procedures, an exercise programme | The BIA, the plans, exercise reports |
| Performance evaluation | Monitoring and measurement, internal audit, management review | Audit reports, review minutes |
| Improvement | Handling nonconformities and corrective action, continual improvement | A corrective action log |
The standard is published by ISO. Certificates are granted by certification bodies, not by whoever helped build the system, and many organisations use the standard as a structure without certifying.
NCA ECC business continuity: what it asks for, in general terms
The National Cybersecurity Authority (NCA) issues the Essential Cybersecurity Controls; the current edition on its site is ECC-2:2024. Among its main domains is cybersecurity resilience, which concerns keeping cybersecurity requirements inside the organisation's business continuity management: a continuity plan that also works when the disruption is a cyberattack, and recovery that does not reopen the door the attacker used. NCA's implementation guide names government organisations and their affiliated entities as its scope; other organisations should read the scope with their compliance owner.
Read more
We do not quote control numbers here. What an assessor usually asks to see is the chain: an approved plan, the impact analysis behind it, recovery targets, a design that meets them and the last exercise result. Our NCA ECC guide covers scope and evidence. A sector regulator or a government contract can add terms of its own.
The IT part of business continuity management: backup, recovery site and in-Kingdom failover
Once the targets exist, the technology has three jobs.
- Copies that restore. Backups for every system in the plan, at least one copy that production credentials cannot change, restored on a schedule to prove it works. See cloud backup in Saudi Arabia.
- A place to recover to. A second zone, an in-Kingdom cloud region, a local provider or a second site of your own, chosen by the recovery time each tier needs.
- Failover that respects residency. A recovery copy is still your data, so it follows the same classification rules as production. Google Cloud runs a region in Dammam; AWS says its Saudi Region is on track for December 2026. Our guide to data residency in Saudi Arabia covers which data may live where.
Each tier in the impact analysis should map to one recovery pattern, written down where the business owner can read it.
Relatedcloud backup in Saudi Arabiadata residency in Saudi Arabia
What the plan document contains, and how to exercise it
Whatever template you use, check that the items opposite are in it and current. Then exercise it. Exercises range from a tabletop session, where the people who would act walk through a scenario, to a full rehearsal where an activity actually moves to its workaround or recovery site.
Start with tabletops: they are cheap and find the missing deputy, the phone list on the server that just failed, the supplier nobody called. Then add technical tests for the top tier. Each exercise ends with a dated result and an owner for each fix; repeat on your policy's schedule and after significant changes.
Where Interkey fits, and where it does not
Interkey delivers the IT side of business continuity. We help gather the systems data for the impact analysis, agree RTO and RPO with each business owner, design and build the backup and recovery environment on partner clouds or your own infrastructure, run the first tests and operate it afterwards under a written scope. Interkey is a partner of Google Cloud and of AWS.
Read more
We do not write your whole business continuity management system, set your risk appetite or certify you against ISO 22301; a full programme, premises and people included, belongs with your continuity or risk team, and we work alongside them on the technology. If your recovery is already tested against targets the business has signed, there is little for us to add.
Interkey has worked in Saudi enterprise IT since 1999. Our engineers work from Riyadh, write runbooks and test reports in Arabic and English, and join your exercises. Support after go-live comes from the same team.
What drives the cost and the timeline
There is no list price. The cost of the IT part follows the number of systems in the plan, how tight their targets are, the recovery pattern each tier needs, the data volume copied and kept, and how often recovery is tested. The timeline depends on the same things, and on whether an impact analysis already exists. We give both as an estimated range after a first review, with the reasons.
How the IT part of a continuity plan runs with Interkey
-
Read the plan and the impact analysis.
Or, where they do not exist yet, gather the systems behind each critical activity with its owner.
-
Agree targets per tier.
An RTO and RPO for each system, signed by its business owner.
-
Check today against the targets.
Current backups, their last restore, where copies live, and the gaps.
-
Design and build.
Backup, the recovery location your classification allows, and the pattern each tier needs.
-
Test and operate.
A first recovery test with a written result, then scheduled tests and reports.
Questions Saudi organisations ask about business continuity
What should a business continuity plan include for a company in Saudi Arabia?
Its scope and owner, the ranked activities from the impact analysis with recovery targets, who declares a disruption, roles and deputies, workarounds, the link to the IT recovery plan for each system, communication in Arabic and English, and an exercise schedule.
What is the difference between a BCP and a DRP?
The business continuity plan covers critical activities as a whole: people, premises, suppliers and systems. The disaster recovery plan covers the technical recovery of IT systems, against the targets the business continuity plan set.
Does our organisation need ISO 22301 certification?
Not in general. Many organisations use ISO 22301 as a structure without certifying. Whether you need the certificate depends on your contracts, your clients and your sector regulator. Certification is granted by certification bodies.
What does NCA ECC ask for on business continuity?
ECC-2:2024 includes a cybersecurity resilience domain, which concerns cybersecurity requirements within business continuity management. Read the current text with your compliance owner; an assessor usually asks for the plan, the targets, the design and the last test result.
How long does a business impact analysis take, and what drives its cost?
It depends on how many departments and systems are in scope and how available their owners are. We estimate the IT part after a first review, and quote it with any build or licences in one proposal.
Who in the organisation should own the business continuity plan?
A senior business manager, with an owner for each critical activity. IT owns the recovery of systems against the agreed targets, but not the plan itself.
Next
Related pages
Next step
Get a cloud plan for your workloads
Tell us which activities and systems your continuity plan covers, whether an impact analysis exists, and whether recovery has been tested. We will reply with the first step we would take on the IT part.
Or directly
+966-11-2180999 [email protected]Tawuniya Towers, North Tower, 7th Floor, King Fahad Highway, Olaya, P.O. Box 56835, Riyadh 11564, Saudi Arabia