Disaster and Crisis Governance
The Global Risks Forum (GRF)
When a disaster strikes, hospitals, utilities, banks, ports and ministries must keep their essential services running. Business continuity governance decides which services are essential, how long they may be interrupted and who answers if they fail. ISO 22301 and sector rules on operational resilience set the frame. This page sets out how continuity governance works and fails, the records that show it, and who holds the decisions.
GRF · In development · service level R0
Business continuity governance is how an organization decides which services must continue through disruption, how much disruption is tolerable and who answers if services fail. ISO 22301 and sector operational resilience rules set the frame. Boards, sector regulators and civil protection authorities hold the decisions.
For business continuity governance, in GRF's situational-awareness reading, the map opens on population density, flood water and night lights, framed on the Caribbean; 3 further NASA layers wait in the list.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
People and hazards, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
For business continuity governance, in GRF's situational-awareness reading, the map opens on population density, flood water and night lights, framed on the Caribbean; 3 further NASA layers wait in the list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Business continuity governance · National crisis centre · Exercise EX-98
| Warning | Meteorological service | Civil protection | Clear | Active |
| Evacuation | Municipality | Police | Overlap | Tasked |
| Shelter | Social services | Volunteer society | Clear | Active |
| Public information | Crisis coordinator | All | Gap | Unassigned |
Operator and public coordination. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Continuity starts by identifying the services whose interruption would cause harm, and setting tolerances for how long and how much disruption is acceptable. Without that, plans protect systems rather than outcomes.
Services rely on power, telecom, suppliers and staff who may all be affected by the same event. Plans that ignore shared dependencies fail when the backup shares the same weak point.
Continuity is a governing body responsibility. Where it sits only with an operational team, investment decisions do not reflect tolerances and gaps surface in an event.
Staff change, systems are replaced and suppliers shift. Plans that are not exercised against severe, plausible scenarios lose accuracy without anyone noticing.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Business continuity | The capability of an organization to continue delivering products and services within acceptable time frames during disruption, in ISO terms. |
| Recovery time objective | The target time within which a service or system must be restored after disruption. |
| Single point of failure | A component whose failure stops a whole service because no alternative exists. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Organizations certified to ISO 22301 | count | annual | ISO Survey of certifications | REPORTED |
| Essential services with set impact tolerances | share of identified services | annual | Self-assessments | DECLARED |
| Continuity exercises against severe scenarios | count per year | annual | Exercise records | DECLARED |
| Recovery time achieved against target | hours | per incident and per test | Incident and test records | OBSERVED |
| Critical suppliers with continuity assurance | share of critical suppliers | annual | Supplier management records | DECLARED |
| Public service interruptions after disasters | service hours lost | per event | Regulator and operator reports | REPORTED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| ISO Survey of management system standard certifications | Counts of certifications by standard and country | Free to read, ISO terms |
| Basel Committee Principles for Operational Resilience | Expectations for banks' operational resilience and continuity | Free, BIS terms |
| Sector regulator operational resilience rules and reports | Requirements and supervisory findings for regulated sectors | Public records, terms per regulator |
| Business Continuity Institute research | Surveys of continuity practice and incidents | Free to read with registration, terms to check |
| Utility and telecom outage reports | Recorded service interruptions and causes | Public records, terms per regulator |
Disaster and Crisis Governance prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Boards and accounting officers | Which services are essential and what disruption is tolerable | Service mapping practice and comparable tolerances |
| Sector regulators | What continuity and resilience obligations apply | Comparative rules and supervisory findings |
| Civil protection authorities | How essential service operators are included in emergency plans | Dependency maps and exercise records |
| Procurement and supplier managers | Which suppliers need continuity assurance | Supplier criticality and assurance practice |
When a disaster strikes, people need power, water, telecommunications, fuel, food, payments and health care. The organizations that provide these services must keep operating while their own staff, sites and suppliers are affected. Their continuity plans, and the way those plans fit with public priorities, often decide how long a community goes without essential services.
Continuity governance links internal planning, sector obligations and public coordination.
Business impact analysis, continuity strategies and plans for loss of staff, sites, systems and suppliers.
Many sectors require operators of essential services to plan for continuity and report incidents. Requirements and enforcement vary.
Arrangements for information sharing, priority restoration, fuel and access during emergencies.
Information sharing between operators and authorities is often the weakest link. Operators may be reluctant to share vulnerabilities for commercial or security reasons, while authorities may lack the expertise to use what is shared. Trusted forums with clear rules on confidentiality, and joint exercises that build relationships, are common ways to overcome this.
Review of plans and their assumptions. Plans often assume that other services will be available.
Mapping of dependencies between operators. Commercial confidentiality can limit sharing.
Exercises involving operators and authorities test whether plans work together.
Review of service disruptions and restoration times after events.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.