Continuity · Business continuity

Have the plan ready before anything stops

A Word plan nobody has tested won’t help you on the day the ERP goes down. Almenara guides you through what depends on what, how long each process can be down and who does what, and helps you test the plan before you need it.

Request information See the demo

The ERP stops at 9:00. This is what breaks, and when

That is what a business impact analysis (BIA) answers: what breaks, at what time and how long each process can be down. From it come each process’s maximum downtime (RTO) and how much data you can lose (RPO).

Illustrative example

09:00
It stops
The ERP stops responding.
+1 h
Orders
Online orders stop coming in.
+4 h
Customers
You exceed what you promised customers in their contracts.
+24 h
Obligations
Invoices and legal obligations go past their deadlines.
+7 days
Market
Customers who cannot wait go elsewhere.
+30 days
Business
The damage can no longer be made up with overtime.

What Almenara shows you first

Your ERP backup is daily, but you cannot lose more than an hour of orders. Almenara matches your impact analysis against your backups, shows you that gap and opens an action with an owner.

Follow the gap until it closes

The gap, from start to finish

One gap runs through all your plans. While it is open, it is amber; once the test closes it, it no longer is.

Sample data

Feb
BIA
Orders cannot lose more than 1 h of data.
Mar
DRP
The ERP backup is daily: 24 h at risk.
Mar
Playbook
Manual orders procedure while it lasts.
May
Tabletop exercise
Fails at step 4: the morning’s orders are missing.
Jun
Action
Hourly replication of the database.
AI proposes
Hourly replication of the ERP database, with its cost, against replacing the ERP.
A person decides
The IT lead chooses replication and management approves the spend.
Sep
Restore test
Recovered with 50 min of loss. Closed.
Feb
BIA review
The following year, with replication in place.

Assistants that take you from the impact analysis to the recovery plan

Business impact analysis, the continuity plan, the recovery plan and the playbooks are built with assistants: they ask only what each step needs, explain every concept (what an RTO or RPO is) and save as you go, so you can leave and pick up where you were. And each one starts from what the previous one left: the continuity plan uses the critical processes from the BIA; the recovery plan, their RTO and RPO; the playbooks, the recovery order. If two documents stop matching, the platform flags it. Amber marks the one gap in the case.

Sample data

A 180-person distributor: 8 processes, 12 systems.

Sample data

Process
Asset
Person
Third party
Gap

On mobile, the processes and what holds them up directly. Dependencies are in each point’s profile.

28 items · everything

The continuity map

Your organisation at the centre. Out of it come its processes; out of each process, the assets and people that hold it up; out of those, what they depend on. One system can hold up several processes: the ERP holds up four. Critical processes and their branches are drawn stronger.

Assistant 1 of 5

Impact analysis

How long can each process be down, and how much data can it lose?

Inherits · process and system inventory

8 processes · all

Processes in the impact analysis
Criticality	RTO	RPO	Max. outage
Critical	4 h	1 h	24 h
Critical	8 h	4 h	72 h
Critical	24 h	4 h	72 h
Important	24 h	24 h	72 h
Important	72 h	24 h	1 week
Important	48 h	24 h	1 week
Not critical	72 h	24 h	1 week
Not critical	1 week	24 h	1 week

Outage time · Orders

Financial: Major
Operational: Catastrophic
Legal: Minor
Reputational: Major
People: Minor

AI proposes

Orders · RTO 4 h · RPO 4 h · maximum outage 24 h.

After 8 h down, the impact is already major in at least one dimension.

A person decides

The operations director tightens the RPO to 1 h: phone orders from the last hour cannot be rebuilt.

This is the RPO the ERP does not meet: its backup is daily. The DRP detects it.

Resulting document

Impact analysis · v1

01Processes and criticality (complete)
02Impact by horizon (complete)
03RTO, RPO and maximum outage (complete)
04Minimum resources (complete)
05Third-party dependencies (complete)
06Management approvalpending

The same plan, at three moments

The plan management approves is the one tested in the exercise and the one activated when something stops.

Plan
An approved version, with who approved it and when. The one used on the day something happens, not the one left in an email.
See it from both sides
Test
A tabletop exercise with your team, before you need it. What comes out of it is recorded as evidence.
Run the exercise
Crisis
The plan activated live: each task with its owner. Your supplier confirms its part from a link, with no account.
See it in the demo

The same playbook, two sides

Whoever writes it works on a document with versions and approval. Whoever is on call gets it on their phone as an action list: one step at a time.

Sample data

Playbook · Ransomware on the ERP

Approved by management, with their position, on 18 March

v1 · approved

Sections

01Scope and activation criteria
02Roles and deputies, from the BCP
03First 60 minutes
04Manual orders procedure
05Decision points
06Communications and contacts

Next review: March next year, or earlier if the BIA changes

Versions

v0.1Draft proposed by the AI with the BCP roles and the DRP order
v0.2The head of continuity adds the manual procedure because of the gap
v1Management approves it; it is frozen

A two-minute tabletop exercise

Three situations from the ransomware scenario, one after another. Choose what you would do; there is no score, only what would be recorded.

Sample data

Situation 1 of 3

08:40The ERP won’t start and a ransom note appears on the server screen.

Reboot the server and see if it comes backIsolate the servers and alert the head of continuityWait for the ERP vendor to say something

What sits behind your plans

Versions and approval

Every plan has versions. The approved one is frozen with who approved it and in what role, and only your organisation can approve it.

Yearly review

Each document has its next review date. The reminder arrives beforehand, and also when something it depends on changes.

For the auditor

One report per framework, as PDF or DOCX, with the documents, their versions and the tests.

Third parties, from Third-party risk

Systems a provider delivers bring their profile and their risk with them.

Playbooks and incidents

The classify-and-notify step opens the incident in the Incidents module, with each regulation’s deadlines.

Tests as evidence

Each test report becomes evidence for the continuity controls in Compliance.

See it before you talk to anyone

Demo
Your cloud provider goes down
When your cloud provider goes down, you see which functions stop, how long each one can be down and the activated plan, with its tasks and owners.
Walk through the case

What the platform does and what our team does

With the module, your team does the work and the platform organises it, reminds you and keeps it with its evidence. If you’d rather delegate part of it, our team does it as a fixed-scope service, contracted separately.

Included in the module

What the platform does

Guides you step by step so you can do the impact analysis, the continuity and recovery plans and the procedures for each scenario yourself
Keeps the plans with their versions, at hand when you need them
Records tests and exercises with their results and improvements
Alerts you when the BIA and the plans are due for review

Separate service

What our team does

Business impact analysis (BIA) workshopEvery year
A workshop with the owners of each area to find out which processes cannot stop and for how long they can hold out.
Business continuity exerciseEvery year or every six months
A guided exercise with your management team on a realistic scenario, to test the plan before you need it.
Business continuity and recovery planOnce
We write your business continuity plan and your recovery plan from the BIA.
Incident response playbooksOnce
Five response playbooks for the most likely incidents in your organisation.
Supplier exit planPer supplier
We design how to leave a critical supplier without stopping the processes that depend on it.
Post-incident reviewWhen needed
When a real incident happens, we analyse the causes, the response and what needs to change.

See the full service catalogue

What Continuity connects with

What happens in this module reaches the others without being entered again.

And the same impact analysis and the same plan test work for ISO 22301, ISO 27001, Spain’s National Security Framework (ENS), DORA or NIS2.

See it with your own data

Ask for information or a meeting: in 60 minutes we load a sample of your data and you see it working.

Request information See the demo

Have the plan ready before anything stops

The ERP stops at 9:00. This is what breaks, and when

It stops

Orders

Customers

Obligations

Market

Business

The gap, from start to finish

BIA

DRP

Playbook

Tabletop exercise

Action

Restore test

BIA review

Assistants that take you from the impact analysis to the recovery plan

The continuity map

Impact analysis

The same plan, at three moments

Plan

Test

Crisis

The same playbook, two sides

Sections

Versions

A two-minute tabletop exercise

Situation 1 of 3

What sits behind your plans

Versions and approval

Yearly review

For the auditor

Third parties, from Third-party risk

Playbooks and incidents

Tests as evidence

See it before you talk to anyone

Your cloud provider goes down

What the platform does and what our team does

What the platform does

What our team does

What Continuity connects with

See it with your own data