0 / 24

Model 20 of 74 · Operations & Delivery

Business Continuity & Resilience Maturity Assessment

Assess how well your organisation can anticipate disruptions, maintain critical operations, and recover when things go wrong.

Pillars & areas

Assess

Know the risks

  1. 01Risk Assessment & Business Impact
  2. 02Continuity Planning

Respond

Act under pressure

  1. 03Crisis Management & Response
  2. 04Recovery & Restoration

Strengthen

Build back better

  1. 05Testing & Exercising
  2. 06Organisational Resilience

Levels

  1. 1UnpreparedNo formal plans
  2. 2PlannedCritical functions covered
  3. 3ResilientDisruptions anticipated

01 Risk Assessment & Business Impact

Does the organisation systematically identify threats and understand which functions are most critical?

0/4 answered

RA-1How does your organisation identify the threats and hazards that could disrupt operations?

Think about whether you have a documented list of plausible disruptions (e.g. cyberattack, supplier failure, natural disaster, pandemic) or whether threats are only discussed after they occur.

RA-2How well does your organisation understand which business functions are most critical?

Consider whether you have formally ranked your functions by how quickly they need to be restored, or whether everyone assumes their own area is the top priority.

RA-3How well does your organisation understand dependencies between its systems, people, and suppliers?

Think about whether you know what would break if a key supplier, system, or team were suddenly unavailable.

RA-4How does your organisation assess the financial and reputational impact of different disruption scenarios?

Consider whether you have quantified what a day, a week, or a month of downtime would actually cost for each critical function.

02 Continuity Planning

Are there documented, actionable plans that people can follow when a disruption occurs?

0/4 answered

CP-1Does your organisation have documented business continuity plans for its critical functions?

Think about whether there is a written plan someone could pick up and follow if a key system or facility became unavailable tomorrow.

CP-2How current are your continuity plans?

Consider when the plans were last reviewed — if the answer is 'when they were first written', they are probably out of date.

CP-3How well do your continuity plans account for different types and scales of disruption?

Think about whether your plans only cover one scenario (e.g. building loss) or whether they address a range of disruptions at different severities.

CP-4How does your organisation plan for the continuity of its workforce during a disruption?

Consider whether you have arrangements for staff to work from alternative locations, or whether a building closure means operations stop.

03 Crisis Management & Response

Can the organisation mobilise quickly, make good decisions under pressure, and communicate effectively during a crisis?

0/4 answered

CR-1How does your organisation activate its response when a disruption occurs?

Think about the first 30 minutes after something goes wrong — is there a clear process for who to call, who decides, and what happens first?

CR-2How does your organisation make decisions during a crisis?

Consider whether decision-making authority is clear, or whether people wait for approvals that slow down the response.

CR-3How does your organisation communicate with staff, customers, and stakeholders during a disruption?

Think about whether you have pre-drafted messages, agreed channels, and a spokesperson, or whether communications are improvised under pressure.

CR-4How does your organisation manage the wellbeing of staff during and after a crisis?

Consider whether anyone checks on how people are coping, or whether the focus is entirely on operational recovery.

04 Recovery & Restoration

Can the organisation restore critical operations within acceptable timeframes and return to normal operations in a controlled way?

0/4 answered

RR-1Does your organisation have defined recovery time objectives for its critical functions?

A recovery time objective (RTO) is the maximum acceptable time a function can be down before the impact becomes unacceptable.

RR-2How does your organisation prioritise what to restore first after a disruption?

Think about whether there is an agreed sequence of restoration, or whether whoever shouts loudest gets recovered first.

RR-3How does your organisation manage the transition from crisis mode back to normal operations?

Consider whether there is a controlled handover from the crisis team back to business-as-usual, or whether things just drift back to normal.

RR-4How does your organisation handle data loss or integrity issues following a disruption?

Think about whether you have tested backup and recovery procedures, or whether you would discover problems only when you need to restore data for real.

05 Testing & Exercising

Does the organisation regularly test its plans to make sure they actually work?

0/4 answered

TE-1How frequently does your organisation test its business continuity plans?

Think about when the last test or exercise took place — if nobody can remember, that is your answer.

TE-2How realistic are your continuity exercises?

Consider whether exercises genuinely challenge the organisation, or whether they are predictable events where everyone knows the answers in advance.

TE-3How does your organisation act on findings from tests and exercises?

Think about whether exercise findings lead to actual changes, or whether the report is filed and forgotten.

TE-4Does your organisation involve external parties (suppliers, partners, regulators) in its continuity exercises?

Consider whether your key suppliers and partners have been part of any exercise, or whether you are only testing your own internal response.

06 Organisational Resilience

Is resilience a cultural value, embedded in how the organisation designs its operations, makes decisions, and develops its people?

0/4 answered

OR-1How does your organisation build resilience into the design of its operations and services?

Think about whether resilience is considered when designing new processes, systems, or services, or whether it is only thought about after a failure.

OR-2How does your organisation's leadership demonstrate commitment to business continuity and resilience?

Consider whether senior leaders actively participate in continuity planning and exercises, or whether it is delegated entirely to a support function.

OR-3How well does your organisation learn from actual disruptions and near-misses?

Think about the last time something went wrong — was there a structured review, and did anything actually change as a result?

OR-4How does your organisation develop continuity and resilience awareness across its workforce?

Consider whether staff beyond the continuity team know what to do in a disruption, or whether most people would not know where to find the plan or who to contact.

Self-assessment report

Business Continuity & Resilience

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Business Continuity & Resilience maturity model

Every organisation will face disruption — a cyberattack, a supplier collapse, a natural disaster, a pandemic, or simply an unexpected failure at the worst possible moment. The question is not whether it will happen, but whether the organisation can keep going when it does. Business continuity is the discipline of preparing for disruptions; resilience is the broader capability of absorbing shocks, adapting, and emerging stronger.

Too many organisations treat continuity planning as a compliance exercise — a document that satisfies auditors but sits unused on a shelf. Real resilience is not a document. It is a combination of clear plans, practised responses, empowered people, and a culture that treats preparedness as a strategic investment rather than overhead.

This model assesses both the tactical readiness (do you have plans, and do they work?) and the strategic maturity (is resilience built into how you operate?). It is designed to help organisations move from reactive crisis management to proactive, embedded resilience that protects people, operations, reputation, and revenue.

24 questions across 6 key areas, assessing your organisation's ability to anticipate disruptions, maintain critical operations, and recover effectively. Takes approximately 10-15 minutes to complete.

Scoring is based on 3 maturity levels per question. Your overall score reflects the average maturity across all areas, highlighting where your continuity capability is strong and where vulnerabilities remain.

Who this assessment is for

  • Senior leaders and executives with accountability for operational resilience
  • Business continuity managers and coordinators
  • Risk and compliance professionals
  • IT disaster recovery and infrastructure leads
  • Operations managers responsible for critical services
  • Anyone involved in crisis management or emergency response

The three maturity levels

  • Level 1 — Unprepared: The organisation has no formal continuity plans. Response to disruptions is improvised, inconsistent, and dependent on individual knowledge. Critical functions, dependencies, and recovery priorities are not documented. When something goes wrong, people scramble — and whether the organisation recovers quickly is a matter of luck, not design. There is no structured learning from incidents, so the same vulnerabilities persist.
  • Level 2 — Planned: Continuity plans exist for critical functions, and people know their roles. Business impact analysis has been completed, recovery priorities are agreed, and a crisis management team can be mobilised. Plans are tested periodically, and the organisation can execute a structured response to known disruption scenarios. There are gaps — plans may not cover every scenario, testing may not be sufficiently challenging, and some dependencies may be unmapped — but the foundation is in place.
  • Level 3 — Resilient: Continuity is embedded into how the organisation operates, not bolted on as an afterthought. Resilience is a design principle for new systems and services. Plans are continuously updated, rigorously tested with realistic exercises, and improved based on findings. Leadership actively champions resilience, staff at all levels understand their role in a disruption, and the organisation learns systematically from every incident and near-miss. Recovery is fast, controlled, and practised. The organisation does not just survive disruptions — it adapts and emerges stronger.

The 6 areas assessed

  1. Risk Assessment & Business Impact — Does the organisation systematically identify threats and understand which functions are most critical?
  2. Continuity Planning — Are there documented, actionable plans that people can follow when a disruption occurs?
  3. Crisis Management & Response — Can the organisation mobilise quickly, make good decisions under pressure, and communicate effectively during a crisis?
  4. Recovery & Restoration — Can the organisation restore critical operations within acceptable timeframes and return to normal in a controlled way?
  5. Testing & Exercising — Does the organisation regularly test its plans to make sure they actually work?
  6. Organisational Resilience — Is resilience a cultural value, embedded in how the organisation designs its operations, makes decisions, and develops its people?

How this model relates to other frameworks

  • ISO 22301 — Business Continuity Management Systems
  • ISO 22316 — Security and Resilience: Organisational Resilience
  • BCI Good Practice Guidelines (Business Continuity Institute)
  • NIST SP 800-34 — Contingency Planning Guide for Federal Information Systems
  • BS 65000 — Guidance on Organisational Resilience
  • ANSI/ASIS ORM.1 — Security and Resilience in Organizations (successor to ASIS SPC.1)
  • FFIEC Business Continuity Management Handbook (financial services)

Frequently asked questions

What is the Business Continuity & Resilience maturity model?

Assess how well your organisation can anticipate disruptions, maintain critical operations, and recover when things go wrong. It is an original, simplified model with three maturity levels (Unprepared, Planned and Resilient), assessed through 24 questions across 6 areas: Risk Assessment & Business Impact, Continuity Planning, Crisis Management & Response, Recovery & Restoration, Testing & Exercising and Organisational Resilience.

How long does the Business Continuity & Resilience assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Unprepared), 2 (Planned) or 3 (Resilient). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.