Business continuity is an organization's ability to keep its essential functions operating during and after a disruption, such as a ransomware attack, natural disaster, or outage. A business continuity plan defines how critical operations carry on when normal systems are unavailable.
What business continuity means
Business continuity is the discipline of making sure an organization can keep doing the things it absolutely must do, even when something goes badly wrong. It starts from a sobering question: if our systems went down right now, how would we keep operating, and for how long could we sustain it. The answer is captured in a business continuity plan, which identifies the essential functions the organization cannot stop, the resources those functions depend on, and the arrangements that let them continue when the normal way of working is unavailable.
Business continuity is closely related to, but broader than, disaster recovery. Disaster recovery focuses specifically on restoring IT systems and data after an incident. Business continuity is the wider concern of keeping the whole organization functioning, which includes IT recovery but also covers people, processes, facilities, and the manual workarounds that bridge the gap while systems are being restored. Both matter, and in a serious incident they operate together.
Why ransomware is a business continuity problem
Ransomware has turned business continuity from a plan for rare disasters into a frontline concern, because a ransomware attack is, in effect, a deliberate and sudden loss of all the systems an organization runs on. Where business continuity planning once focused mainly on fires, floods, and power outages, ransomware now represents one of the most likely causes of a major operational disruption, and one specifically engineered to be as paralyzing as possible.
This reframing matters. An organization that thinks of ransomware purely as a cybersecurity problem may invest only in prevention and detection, and have no real plan for operating once an attack succeeds. An organization that also thinks of it as a business continuity problem asks the harder, more useful questions: which of our functions are so essential they cannot stop even for an hour, how do we carry them out if the systems are gone, and how long can we survive in that degraded mode. Those questions are what separate organizations that weather an attack from those that are paralyzed by one.
Business continuity in a hospital
Nowhere is business continuity more vivid than in a hospital, because the essential function that cannot stop is patient care. When ransomware takes down the electronic health record, imaging, and clinical systems, a hospital's business continuity plan is what determines whether care continues safely. It covers the downtime procedures clinicians fall back on, paper charting, manual processes for ordering tests and medications, alternative ways to access critical patient information, and the decisions about which services can continue, which must divert, and how to prioritize when capacity is reduced.
The hospitals that have come through ransomware attacks least harmed are the ones whose continuity planning was real and rehearsed, so that staff knew how to keep treating patients on paper from the first hour. The ones that suffered most were often those for whom downtime procedures existed only on paper, untested, and fell apart under the reality of a full systems outage lasting days or weeks. In healthcare, business continuity is not a back-office formality; it is directly a matter of patient safety.
How resilience and continuity reinforce each other
Business continuity and technical resilience are two halves of the same goal, and they reinforce each other. Continuity planning defines how the organization operates in degraded mode and for how long it can sustain that, which sets the real target for recovery: systems have to be restored before the continuity workarounds become unsustainable. Resilience, through fast containment and self-healing recovery, shrinks the duration of the disruption, which means the continuity plan has to carry the organization for hours rather than weeks, a far more survivable demand.
The strongest posture treats them as one. An organization that can both keep its essential functions running during an attack, through a tested continuity plan, and restore its systems quickly and cleanly afterward, through resilient technology, has turned what could be an existential crisis into a manageable incident. For a hospital, that combination is what keeps patients safe through an attack and gets the institution back to normal on its own terms, which is the entire point of planning for the worst before it happens.
Key measures a continuity plan defines
A practical business continuity plan turns the abstract goal of keep operating into specific, measurable arrangements. Two concepts are central. The recovery time objective, or RTO, is how quickly a given function or system must be restored before the disruption becomes unacceptable. The recovery point objective, or RPO, is how much data loss is tolerable, measured as the age of the last usable backup. Setting these for each critical function forces an organization to be honest about what it truly needs and shapes everything from how often it backs up to how fast its recovery must be.
Around those objectives, a strong plan documents the essential functions that cannot stop, the manual or alternative procedures that sustain them when systems are down, the resources and personnel each depends on, and clear triggers and authority for activating the plan. In a hospital, this translates into tested clinical downtime procedures, defined RTOs for systems like the electronic health record that reflect patient-safety limits, and backup arrangements whose RPO means minimal loss of recent clinical data. Writing these down is only the start; the plan has to be exercised regularly so that the numbers are realistic and the procedures work under real conditions, because a continuity plan that has never been tested is an assumption, not a capability.
See also
Sources
- CISA: business continuity and #StopRansomware guidance
- NIST: Contingency Planning Guide (SP 800-34)
- U.S. HHS 405(d): Health Industry Cybersecurity Practices
Definitions are drawn from the cited sources and were current as of publication. Content was rephrased for compliance with source licensing.