Continuity Planning and Essential Institutional Functions

Status, question and scope

Research question

What distinguishes continuity capability from a written continuity plan?

Scope

Continuity is demonstrated when essential functions, authority, information and dependencies can operate through disruption and transition.

ASPC application and limitations

Proposed application

• Prioritize functions by public and institutional consequence.
• Name delegated authorities, critical records, minimum staffing, dependencies and restoration objectives.
• Exercise the plan and track corrective actions to closure.

Limitations

• The source guidance concerns U.S. federal continuity. International institutions must adapt it to local law, resources and risk.

Documented findings

Continuity begins with essential functions

Federal continuity practice starts by identifying the functions that must continue under disrupted conditions, the people and authorities required to perform them, and the records and systems on which they depend. GAO-05-619T emphasized that sound continuity planning requires agencies to identify essential functions and establish plans that can sustain operations when normal facilities or personnel are unavailable.

NARA's vital-records guidance distinguishes records needed to conduct emergency operations from records needed to protect legal and financial rights. Both categories require deliberate identification, protection and access arrangements before an incident occurs.

Institutional interpretation

Continuity is broader than disaster recovery. Technology restoration does not restore a function if delegations, qualified staff, counterpart contacts, decision records or payment authority are missing. Plans therefore need operating priorities and succession arrangements, not only backups.

Continuity design notes

Function profile

• Define the minimum acceptable service and maximum tolerable interruption.
• Name primary and alternate decision authorities and document delegations.
• Identify personnel, vendors, facilities, data and vital records required for operation.
• Map upstream dependencies and downstream institutions affected by failure.
• Specify activation, communication, reconstitution and after-action procedures.

Exercise and assurance

Each function should be exercised against a credible disruption, including loss of a facility, information system, supplier or key leader. Exercises should test access to records and authorities and produce assigned corrective actions with deadlines.

ASPC partnership reviews should ask whether continuity obligations are funded, whether alternates are trained, and whether changes in personnel or technology trigger plan revision. A plan that has not been exercised should be reported as unvalidated.