← Back to catalogue
Published

Business Continuity / Recovery

vr.wm-act-043 · wm-act-043-business-continuity-recovery

Represent a governed continuity capability that identifies critical delivery, analyzes disruption impacts, releases strategies and plans, proves readiness through exercises, records activation and verifies recovery and reconstitution without absorbing the systems it coordinates.

World Models Activities and processes ACT.RESIL
Bundle → Layer → Finding → QuestionsClassifiersWhat it isWhy it existsDistinguishing featuresWhat robots and AI may and may not doMoral aspectsOwnersLinks to other meta-modelsIdentity and identifiersDirect propertiesRecognitionCapabilities and actionsHazards and failure modesStandards and interfacesContext of useSources

Bundle → Layer → Finding → Questions Filled

6 bundles · 12 layers · 24 findings · 72 questions

Capability identity, governance and authority Groups governed context for capability identity, governance and authority.

Capability scope, profile, identity and lineage

Groups continuity context for capability scope, profile, identity and lineage.

Continuity capability type, boundary, owner and distinguishing criteria

Records continuity capability type, boundary, owner and distinguishing criteria as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish continuity capability type, boundary, owner and distinguishing criteria? classification
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support continuity capability type, boundary, owner and distinguishing criteria? state
  3. How may continuity capability type, boundary, owner and distinguishing criteria be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? process

Capability identifier, definition release, status, predecessor, successor and lineage

Records capability identifier, definition release, status, predecessor, successor and lineage as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish capability identifier, definition release, status, predecessor, successor and lineage? identity
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support capability identifier, definition release, status, predecessor, successor and lineage? ownership
  3. How may capability identifier, definition release, status, predecessor, successor and lineage be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? interoperability

Policy, mandate, obligations, roles and decision rights

Groups continuity context for policy, mandate, obligations, roles and decision rights.

Policy, context, jurisdiction, interested parties, obligations and assurance basis

Records policy, context, jurisdiction, interested parties, obligations and assurance basis as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish policy, context, jurisdiction, interested parties, obligations and assurance basis? authority
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support policy, context, jurisdiction, interested parties, obligations and assurance basis? event
  3. How may policy, context, jurisdiction, interested parties, obligations and assurance basis be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? spatial

Governance owner, succession, delegation, escalation, approval and contestability

Records governance owner, succession, delegation, escalation, approval and contestability as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish governance owner, succession, delegation, escalation, approval and contestability? ownership
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support governance owner, succession, delegation, escalation, approval and contestability? security
  3. How may governance owner, succession, delegation, escalation, approval and contestability be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? validation
Impact analysis, priorities, objectives and dependencies Groups governed context for impact analysis, priorities, objectives and dependencies.

Products, services, activities, impacts and tolerances

Groups continuity context for products, services, activities, impacts and tolerances.

Critical product, service and prioritized activity reference

Records critical product, service and prioritized activity reference as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish critical product, service and prioritized activity reference? relationship
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support critical product, service and prioritized activity reference? interoperability
  3. How may critical product, service and prioritized activity reference be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? classification

Impact category, severity over time, maximum tolerable disruption and justification

Records impact category, severity over time, maximum tolerable disruption and justification as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish impact category, severity over time, maximum tolerable disruption and justification? measurement
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support impact category, severity over time, maximum tolerable disruption and justification? classification
  3. How may impact category, severity over time, maximum tolerable disruption and justification be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? constraint

Recovery objectives, resources and interdependencies

Groups continuity context for recovery objectives, resources and interdependencies.

Recovery time, data-loss, capacity and service-level objective assertion

Records recovery time, data-loss, capacity and service-level objective assertion as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish recovery time, data-loss, capacity and service-level objective assertion? requirement
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support recovery time, data-loss, capacity and service-level objective assertion? temporal
  3. How may recovery time, data-loss, capacity and service-level objective assertion be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? exception

People, facility, technology, information, supplier, resource dependency and single-point risk

Records people, facility, technology, information, supplier, resource dependency and single-point risk as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish people, facility, technology, information, supplier, resource dependency and single-point risk? composition
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support people, facility, technology, information, supplier, resource dependency and single-point risk? requirement
  3. How may people, facility, technology, information, supplier, resource dependency and single-point risk be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? temporal
Strategy, solutions, plans and procedures Groups governed context for strategy, solutions, plans and procedures.

Strategy options, selection and solution design

Groups continuity context for strategy options, selection and solution design.

Continuity strategy option, feasibility, cost, risk, capacity and selection rationale

Records continuity strategy option, feasibility, cost, risk, capacity and selection rationale as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish continuity strategy option, feasibility, cost, risk, capacity and selection rationale? decision
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support continuity strategy option, feasibility, cost, risk, capacity and selection rationale? evidence
  3. How may continuity strategy option, feasibility, cost, risk, capacity and selection rationale be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? quality

Alternate site, manual workaround, redundancy, backup, substitution and supplier solution

Records alternate site, manual workaround, redundancy, backup, substitution and supplier solution as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish alternate site, manual workaround, redundancy, backup, substitution and supplier solution? composition
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support alternate site, manual workaround, redundancy, backup, substitution and supplier solution? retention
  3. How may alternate site, manual workaround, redundancy, backup, substitution and supplier solution be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? identity

Plan release, activation, tasks, coordination and communications

Groups continuity context for plan release, activation, tasks, coordination and communications.

Plan profile, release, applicability, trigger, threshold, authority and deactivation criteria

Records plan profile, release, applicability, trigger, threshold, authority and deactivation criteria as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish plan profile, release, applicability, trigger, threshold, authority and deactivation criteria? lifecycle
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support plan profile, release, applicability, trigger, threshold, authority and deactivation criteria? other
  3. How may plan profile, release, applicability, trigger, threshold, authority and deactivation criteria be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? requirement

Procedure step, role, dependency, resource, contact, message, channel and escalation

Records procedure step, role, dependency, resource, contact, message, channel and escalation as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish procedure step, role, dependency, resource, contact, message, channel and escalation? process
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support procedure step, role, dependency, resource, contact, message, channel and escalation? relationship
  3. How may procedure step, role, dependency, resource, contact, message, channel and escalation be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? access
People, resources, supply chain and operational readiness Groups governed context for people, resources, supply chain and operational readiness.

People, competence, facilities, systems, records and recovery assets

Groups continuity context for people, competence, facilities, systems, records and recovery assets.

Role, team, contact, succession, delegation, training, awareness and welfare readiness

Records role, team, contact, succession, delegation, training, awareness and welfare readiness as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish role, team, contact, succession, delegation, training, awareness and welfare readiness? quality
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support role, team, contact, succession, delegation, training, awareness and welfare readiness? provenance
  3. How may role, team, contact, succession, delegation, training, awareness and welfare readiness be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? lifecycle

Facility, system, data, record, backup, tool, stock and minimum-resource readiness

Records facility, system, data, record, backup, tool, stock and minimum-resource readiness as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish facility, system, data, record, backup, tool, stock and minimum-resource readiness? validation
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support facility, system, data, record, backup, tool, stock and minimum-resource readiness? process
  3. How may facility, system, data, record, backup, tool, stock and minimum-resource readiness be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? evidence

Supplier, contract, reciprocal and external-dependency readiness

Groups continuity context for supplier, contract, reciprocal and external-dependency readiness.

Supplier, service, contract, obligation, contact, capacity, location and concentration binding

Records supplier, service, contract, obligation, contact, capacity, location and concentration binding as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish supplier, service, contract, obligation, contact, capacity, location and concentration binding? relationship
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support supplier, service, contract, obligation, contact, capacity, location and concentration binding? validation
  3. How may supplier, service, contract, obligation, contact, capacity, location and concentration binding be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? definition

Alternate source, reciprocal agreement, failover test, assurance, exception and escalation

Records alternate source, reciprocal agreement, failover test, assurance, exception and escalation as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish alternate source, reciprocal agreement, failover test, assurance, exception and escalation? exception
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support alternate source, reciprocal agreement, failover test, assurance, exception and escalation? interoperability
  3. How may alternate source, reciprocal agreement, failover test, assurance, exception and escalation be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? authority
Exercises, assurance, corrective action and improvement Groups governed context for exercises, assurance, corrective action and improvement.

Exercise programme, scenario, objectives, participants and controls

Groups continuity context for exercise programme, scenario, objectives, participants and controls.

Exercise type, scope, objective, scenario, assumption, inject and success criterion

Records exercise type, scope, objective, scenario, assumption, inject and success criterion as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish exercise type, scope, objective, scenario, assumption, inject and success criterion? definition
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support exercise type, scope, objective, scenario, assumption, inject and success criterion? identity
  3. How may exercise type, scope, objective, scenario, assumption, inject and success criterion be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? retention

Participant, role, observer, safety control, environment, schedule and conduct event

Records participant, role, observer, safety control, environment, schedule and conduct event as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish participant, role, observer, safety control, environment, schedule and conduct event? event
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support participant, role, observer, safety control, environment, schedule and conduct event? lifecycle
  3. How may participant, role, observer, safety control, environment, schedule and conduct event be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? state

Evaluation, findings, actions, verification and learning

Groups continuity context for evaluation, findings, actions, verification and learning.

Observation, evidence, criterion, result, gap, strength, limit and confidence

Records observation, evidence, criterion, result, gap, strength, limit and confidence as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish observation, evidence, criterion, result, gap, strength, limit and confidence? evidence
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support observation, evidence, criterion, result, gap, strength, limit and confidence? authority
  3. How may observation, evidence, criterion, result, gap, strength, limit and confidence be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? measurement

Corrective action, owner, priority, deadline, verification, effectiveness and plan revision

Records corrective action, owner, priority, deadline, verification, effectiveness and plan revision as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish corrective action, owner, priority, deadline, verification, effectiveness and plan revision? quality
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support corrective action, owner, priority, deadline, verification, effectiveness and plan revision? measurement
  3. How may corrective action, owner, priority, deadline, verification, effectiveness and plan revision be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? other
Activation, continuity, recovery, reconstitution and lifecycle Groups governed context for activation, continuity, recovery, reconstitution and lifecycle.

Disruption, activation, continuity mode and service delivery

Groups continuity context for disruption, activation, continuity mode and service delivery.

Incident or disruption reference, activation decision, parameters, scope and acknowledgement

Records incident or disruption reference, activation decision, parameters, scope and acknowledgement as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish incident or disruption reference, activation decision, parameters, scope and acknowledgement? event
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support incident or disruption reference, activation decision, parameters, scope and acknowledgement? privacy
  3. How may incident or disruption reference, activation decision, parameters, scope and acknowledgement be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? ownership

Continuity task, workaround, resource consumption, capacity, service level, issue and communication

Records continuity task, workaround, resource consumption, capacity, service level, issue and communication as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish continuity task, workaround, resource consumption, capacity, service level, issue and communication? state
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support continuity task, workaround, resource consumption, capacity, service level, issue and communication? decision
  3. How may continuity task, workaround, resource consumption, capacity, service level, issue and communication be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? privacy

Restoration, recovery, reconstitution, closure and record lifecycle

Groups continuity context for restoration, recovery, reconstitution, closure and record lifecycle.

Recovery action, backup integrity, restored asset, service verification and residual risk

Records recovery action, backup integrity, restored asset, service verification and residual risk as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish recovery action, backup integrity, restored asset, service verification and residual risk? validation
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support recovery action, backup integrity, restored asset, service verification and residual risk? composition
  3. How may recovery action, backup integrity, restored asset, service verification and residual risk be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? relationship

Reconstitution, return to normal, recovery end, outcome metric, correction, retention and disposition

Records reconstitution, return to normal, recovery end, outcome metric, correction, retention and disposition as source-qualified continuity context while preserving external master ownership and distinguishing target, request, execution and verification.

  1. What continuity-capability identities, classes, roles, versions, values and explicit unknowns establish reconstitution, return to normal, recovery end, outcome metric, correction, retention and disposition? retention
  2. Which authority, source, method, evidence, event time, knowledge time, confidence and limits support reconstitution, return to normal, recovery end, outcome metric, correction, retention and disposition? spatial
  3. How may reconstitution, return to normal, recovery end, outcome metric, correction, retention and disposition be validated, exercised, activated, challenged, corrected, related, retained or disposed without losing history? event

Classifiers Filled

Family
World Models
Category
Activities and processes
Entry kind
aggregate
Navigation path
NAV.ACT.RESIL
Domain
ACT.RESIL
Industry
Cross-industry
Tags
businesscontinuityrecoveryact.resil

What it is Filled

Owns continuity-capability identity and lineage, scope profile, mandate and governance, BIA releases, priority and objective assertions, dependency views, strategy decisions, plan and procedure releases, readiness assertions, exercise design and evidence, activation decisions, continuity-mode observations, recovery verification, reconstitution, improvement, access, retention and interoperability. Organization, Product, Service, Activity, Incident, Incident Response, Risk, Person, Role, Facility, Asset, Information System, Dataset, Supplier, Contract, Communication and Audit masters remain external.

In scope

  • Capability identity, governance, BIA, critical delivery, priorities, impact tolerances, recovery objectives, dependencies and strategy
  • Versioned plans and procedures, people and resource readiness, supply-chain continuity, exercises, assurance and corrective action
  • Activation, continuity mode, restoration, recovery verification, reconstitution, lifecycle, metrics, provenance, protected access and safe agents

Out of scope

  • Independent organization, service, activity, incident, response, risk, resource, supplier, contract, communication or audit master lifecycles
  • Treating targets as outcomes, plans as activations, invocations as execution, backups as verified recovery or exercises as proof of real-event success
  • Executing emergency actions, operating infrastructure, interpreting all sector law, certifying ISO conformance or guaranteeing uninterrupted service

Why it exists Filled

Represent a governed continuity capability that identifies critical delivery, analyzes disruption impacts, releases strategies and plans, proves readiness through exercises, records activation and verifies recovery and reconstitution without absorbing the systems it coordinates.

Distinguishing features Filled

  • Models the continuity capability across BIA, plans, exercises and activations, not the incident itself.
  • Keeps impact tolerance, objectives, plan, invocation, restoration and return to normal as separate.
  • Treats readiness as evidenced by exercises rather than by having a plan.
  • References people, sites, systems and suppliers held in their own masters.

What robots and AI may and may not do Filled

Must not

  • Activate or stand down a continuity plan without authority.
  • Accept residual risk on behalf of the organisation.
  • Disclose protected continuity details such as site layouts or key personnel.
  • Report recovery objectives as met without test evidence.
  • Start failover actions in production during an exercise without approval.

Only with a human decision

  • Plan activation and return to normal operations.
  • Setting recovery objectives and impact tolerances.
  • Accepting gaps found in exercises.

May

  • Compile business impact analysis inputs from dependency data.
  • Check plans for stale contacts, owners and dependencies.
  • Run tabletop exercise scripts and record findings.
  • Track recovery tasks during an activation and report status.

Moral aspects Filled

  • Continuity plans protect people's safety and essential services, not only revenue.
  • Plans must consider staff wellbeing during disruptions, not only availability.
  • Prioritisation of services decides who is served first in a crisis.

Who is affected

  • Staff and their families
  • Customers and communities depending on services
  • Suppliers and partners

Owners Filled

Steward

Dimension owner and continuity mandate

Roles

Continuity capability owner
Own scope, mandate, resources and lifecycle.
Business impact and strategy steward
Own analysis method, priorities, objectives and strategy evidence.
Plan and procedure steward
Own plan releases, contacts, tasks and dependencies.
Service and activity owner
Own referenced service priorities, requirements and restoration acceptance.
Resource and supplier steward
Own readiness assertions and external master references.
Exercise and assurance lead
Own scenarios, observations, evaluation and corrective actions.
Activation and recovery authority
Authorize invocation, continuity mode, recovery and reconstitution decisions.
Records, privacy and security steward
Own protected views, holds, retention, disclosure and auditability.

Links to other meta-models Filled

child

  • WM-ACT-008 Plan / Schedule - Candidate inheritance of generic plan identity, release and schedule scaffolding; no approved edge exists.

references

  • WM-ACT-042 Incident Response - Candidate incoming reference for invoking a released continuity or recovery plan without lifecycle cascade.
  • Organization, Product, Service, Activity, Person, Role, Facility, Asset, System, Dataset, Supplier and Contract models - Bind critical delivery, resources and dependencies while authoritative masters retain identity and lifecycle.
  • Incident, Incident Response, Risk, Crisis, Communication, Record and Audit models - Bind disruption, risk, command, communications and evidence without absorbing their records.

aligned

  • ISO 22301 family, NIST contingency and recovery guidance, FEMA Continuity Guidance Circular and DORA - Project version-pinned continuity, technology-recovery, public-sector and financial-sector views with declared loss and scope.

neighbor

  • WM-ACT-008 Plan / Schedule candidate parent - Generic plan identity and scheduling scaffolding may be inherited, while continuity-specific BIA, strategy, readiness, exercise, activation and recovery semantics remain here; the registry parent is not an approved relation row.
  • WM-ACT-042 Incident Response candidate incoming reference - Incident Response may request plan invocation and retain its response case; this model owns plan releases, activation evidence, continuity mode, recovery verification and reconstitution without owning incident facts.
  • Incident, Crisis Management and Emergency Management - Those models own what happened, strategic crisis command or emergency response. This aggregate binds their references and owns continuity-capability state only.
  • Organization, Product, Service and Activity - The capability records why referenced delivery is prioritized and at what bounded level, but external masters own identity and normal operational state.
  • People, facilities, assets, systems, data, suppliers and contracts - Readiness and dependency assertions reference authoritative masters; this model does not copy their inventories, custody, employment or contract lifecycles.

parent

  • WM-ACT-008

What else AI and robots need to interact with it Filled

Identity and identifiers required Filled

  • Authoritative master-system continuity-capability or plan identifier qualified by source and profile.
  • Governed globally resolvable capability IRI.
  • Dimension UUID when neither preceding identifier exists.

Direct properties not applicable Not applicable

Not applicable

Institutional or informational subject: no invented physical properties.

Recognition optional Filled

  • A continuity capability has a scope, an owner, BIA results, recovery objectives, plans and exercise records.
  • It is confused with incident response, disaster recovery of one system or a risk register.

Capabilities and actions required Filled

  • Register continuity capability: Governed operation to register continuity capability with attributable evidence and no hidden master-system mutation.
  • Perform business impact analysis: Governed operation to perform business impact analysis with attributable evidence and no hidden master-system mutation.
  • Set recovery objectives and select strategy: Governed operation to set recovery objectives and select strategy with attributable evidence and no hidden master-system mutation.
  • Release continuity plan: Governed operation to release continuity plan with attributable evidence and no hidden master-system mutation.
  • Assess operational readiness: Governed operation to assess operational readiness with attributable evidence and no hidden master-system mutation.
  • Conduct and evaluate exercise: Governed operation to conduct and evaluate exercise with attributable evidence and no hidden master-system mutation.
  • Activate continuity plan: Governed operation to activate continuity plan with attributable evidence and no hidden master-system mutation.
  • Coordinate continuity and recovery: Governed operation to coordinate continuity and recovery with attributable evidence and no hidden master-system mutation.
  • Reconstitute, close and improve: Governed operation to reconstitute, close and improve with attributable evidence and no hidden master-system mutation.
  • Project, retain and audit: Governed operation to project, retain and audit with attributable evidence and no hidden master-system mutation.

Hazards and failure modes required Filled

  • Failed recovery because plans were never tested.
  • Harm to people when critical services stop longer than tolerated.
  • Misuse of leaked plans to target weak points.

Standards and interfaces required Filled

  • ISO 22300 security and resilience vocabulary.
  • NIST SP 800-34 contingency planning guide.
  • ISO/IEC 27031 ICT readiness for business continuity.

Context of use required Filled

  • Essential function, critical service and important business service classifications depend on the adopting authority and jurisdiction.
  • Government devolution and succession constructs are optional profiles outside applicable public-sector mandates.
  • DORA requirements apply only within its regulated scope and effective legal context.

Sources Filled

  1. ISO 22301:2019 Security and resilience: Business continuity management systems: Requirements - International Organization for Standardization
  2. ISO 22313:2020 Guidance on the use of ISO 22301 - International Organization for Standardization
  3. ISO/TS 22317:2021 Guidelines for business impact analysis - International Organization for Standardization
  4. ISO/TS 22331:2018 Guidelines for business continuity strategy - International Organization for Standardization
  5. ISO/TS 22318:2021 Guidelines for supply chain continuity management - International Organization for Standardization
  6. ISO/TS 22330:2018 Guidelines for people aspects of business continuity - International Organization for Standardization
  7. ISO 22398:2013 Guidelines for exercises - International Organization for Standardization
  8. ISO 22361:2022 Crisis management guidelines - International Organization for Standardization
  9. SP 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems - National Institute of Standards and Technology
  10. SP 800-184 Guide for Cybersecurity Event Recovery - National Institute of Standards and Technology
  11. The NIST Cybersecurity Framework 2.0 - National Institute of Standards and Technology
  12. Continuity Guidance Circular - Federal Emergency Management Agency
  13. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector - European Union
  14. PROV-O: The PROV Ontology - World Wide Web Consortium
  15. Date and Time on the Internet: Timestamps - Internet Engineering Task Force

Open questions

  • Formal registry approval for WM-ACT-008 and WM-ACT-042 edges: Define whether continuity capability inherits plan identity from WM-ACT-008 or references it; define whether WM-ACT-042 owns incident facts or continuity capability owns activation authority; create approved relationship contract.
  • Full-text ISO 22301:2019 (Amendment 1:2024), 22313, 22317, 22318, 22330, 22331, 22361, and 22398 clause-by-clause alignment: Map each clause to corresponding findings, artifacts, and functions; identify gaps; document any conflicts with NIST, FEMA, or DORA profiles.
  • Sector-specific continuity-capability profiles: Create and publish health, safety, civil-protection, financial (DORA-aligned), telecom, energy, government, and humanitarian sector successor models with explicit boundary, conformance statement, and regulatory references.
  • Jurisdiction-specific essential-function and critical-service classification schemes: Document how US federal, EU (DORA), UK, Canadian, Australian, and other authority classifications map to continuity capability priority and recovery objectives; document conflicts and resolution procedures.
  • Operational policy binding and role-based access control: Instantiate eight steward roles in RBAC system; define delegation approval workflows; document residual-risk acceptance procedures; create audit-log schemas and redaction rules for protected continuity data.
  • Claude and Grok each timed out on one bounded attempt; no independent external result was admitted.
  • The Plan / Schedule parent and incoming Incident Response reference are candidate registry relations, not approved edges.
  • ISO sources were limited to public catalogue abstracts and preview content; no clause-level or certification conformance is claimed.
  • FEMA is a United States continuity profile and DORA is an EU financial-sector regulation; neither is universal.
  • Health, safety, civil protection, financial, telecom, energy, government, humanitarian and other sector continuity duties require separate profiles.

Machine files

Card as JSON Specification AGENTS.md Source Card backlog vercy.card/1

Provenance

world-models research · reviewable-draft

Built from: models/wm-act-043-business-continuity-recovery/spec.yaml, ver-cy/world-models/card-supplements/wm-act-043-business-continuity-recovery.json