Business Continuity Clause
Definition
Business Continuity Clause
A business continuity clause obliges a provider to maintain the contracted service through disruption, by planning for it, resourcing the plan and proving it works. Continuity is about carrying on — restoring the technology afterwards is a different obligation entirely.
The distinction drives the drafting — continuity covers people, premises, process and manual workarounds; disaster recovery covers systems and data, measured in recovery times.
A plan alone is not continuity — the clause has to require testing at a stated frequency, results shared with the buyer, and remediation of anything the test exposes.
Scope is where these clauses quietly fail. A provider’s corporate continuity plan covering its head office is not the same as a plan covering your service, delivered from your site, by your team.
Key takeaways
- Continuity keeps the business service running; disaster recovery restores the technology.
- The clause must require testing, evidence of results and remediation, not just a plan.
- Plans should be service-specific rather than corporate boilerplate.
- Manual workarounds matter most in the first hours, before any system is restored.
How it works
The provider maintains a plan covering the contracted service, tests it at an agreed frequency, shares the results, and notifies the buyer of invocation. The buyer typically retains a right to review the plan and to participate in tests.
The concept is well defined in vendor reliability guidance. Microsoft describes business continuity as “the state in which a business can continue operations during failures, outages, or disasters”.
It separates the two halves the same way this clause should. Disaster recovery, by contrast, is “about planning how to deal with uncommon risks and the catastrophic outages that can result”.
Public contracting states the continuity obligation in its bluntest form. The federal clause records that “The services under this contract are vital to the Government and must be continued without interruption”.
| Clause requirement | Weak version | Strong version |
|---|---|---|
| Plan scope | Corporate plan referenced | Service-specific plan, annexed and versioned |
| Testing frequency | “Regularly” | At least annually, with scenario variety |
| Buyer participation | None | Right to observe and to require a scenario |
| Results sharing | On request | Within 30 days, with a remediation plan |
| Invocation notice | Not specified | Immediate, with defined escalation contacts |
The buyer-participation row separates real assurance from paperwork. A test the buyer can observe, and whose scenario the buyer can choose, is considerably harder to stage-manage than one reported after the fact.
Examples
Continuity clauses are judged on what happens in the first day of a real disruption, not on the paperwork. The four cases below show what preparation was actually worth.
A contact centre provider loses a site to flooding and moves eight hundred agents to home working within a day. The plan named the equipment, the connectivity and the order of recall.
A finance provider tests annually against a scenario its buyer selects. The third test exposes a single-point dependency on one payments specialist, which is fixed before it matters.
A retailer relies on its provider’s corporate plan. When the delivery site is affected, the plan turns out to cover head office relocation and nothing about the service itself.
An insurer’s provider tests yearly but never shares results. A regulator asks for evidence of testing and the buyer has none of its own to give.
Related terms
Resilience obligations arrive in three distinct clauses that are frequently merged into one. The entries below separate keeping the service going, coming back afterwards and being excused from performing altogether.
- Business continuity plan (BCP): the plan document the clause obliges a provider to maintain.
- Risk outsourcing: the wider transfer of exposure that continuity terms sit inside.
- Multi site outsourcing: the delivery structure that makes continuity achievable at scale.
- Redundancy: duplicated capability, which is how most continuity plans are resourced.
- Business risk: the exposure a continuity clause is written to contain.
- EBA outsourcing guidelines: European banking rules mandating continuity terms for critical functions.
- MAS outsourcing: the Singapore regime with equivalent continuity expectations.
FAQ
How is this different from a disaster recovery clause?
Continuity keeps the business service running through disruption, including by manual means. Disaster recovery restores technology and data after a defined event, measured against recovery objectives.
How often should plans be tested?
At least annually, with the scenario varied each time. Testing the same scenario repeatedly proves only that one rehearsed answer still works.
Should the buyer see test results?
Yes, within a defined window and with a remediation plan attached. Results kept internal give the buyer nothing to show a regulator or a board.
What does service-specific mean?
A plan covering your service, your site, your team and your systems, rather than a corporate document about the provider’s own head office.
Do manual workarounds still matter?
Very much, in the first hours. Systems recovery takes time, and a documented manual process is often what keeps customers served in the interim.
Who pays for continuity capability?
It is normally built into the price. Buyers asking for site-level resilience beyond the standard offering should expect it to be priced separately.
Compare providers who can evidence tested continuity plans in the Outsource Accelerator directory.
Independent
