ESRM Program · Operations Cluster
Business Continuity
Know which operations matter most, and how fast you need them back.
$2,500 fixed-fee assessment 3–4 weeks Credited toward the vCSO program
Measured against ISO 22301. Led by Don Oxman, CPP, CISSP, CISM. Licensed by Texas DPS. In business since 2013.
Many continuity plans have never been tested.
Business continuity is one of thirteen domains in our Enterprise Security Risk Management (ESRM) program, and part of the Operations cluster with Organizational Resilience, Crisis Management, and Supply Chain Security. It covers how operations recover from a disruption: an Arlington plant without power for days, or a clinic whose scheduling system fails.
Continuity planning usually lands with the office manager or the IT provider. The result is often a backup schedule and an old binder nobody has opened. Few companies have decided how long each operation can be down, so the first real test of the plan is the outage itself. We work out what has to come back first and how fast, then write and test the plan.
What can stop your operations
Facility loss
A fire, flood, burst pipe, or tornado closes a building, and there is no agreed alternate site or remote setup for the people who work there.
Systems outage
Ransomware or a failed server takes down ordering, billing, or scheduling. Backups may exist, but nobody has confirmed how long a full restore takes.
Utilities & weather
Long power or water outages, ice storms, and summer strain on the Texas grid can stop production or force a site to close for days.
People unavailable
Illness, severe weather, or a resignation can take out the only people who know how to run a critical process, with no one trained to step in.
Vendor failure
A payroll processor, cloud platform, or sole-source supplier goes down, and you have no workaround and no recovery commitment in the contract.
Customer commitments
Contracts often promise delivery dates or service levels even during disruptions. Missing them can cost you the customer, trigger penalties, or both.
Five questions for leadership
- Do you know which operations must be running again within 24 hours, and which can wait a week?
- When did you last test a full restore of your critical systems, not just confirm backups ran?
- If your main building were closed for a month, where would your people work?
- Does your continuity plan name specific people, and do those people know they are named?
- Has the plan been exercised against a realistic scenario in the last twelve months?
If you answered “no” or “not sure” to any of these, that is where we would start. Most of these gaps cost little to fix before an incident and a great deal to fix after one.
How an Engagement Works
Every ESRM domain starts with the same fixed-fee assessment. If you decide to continue, we credit the fee toward the program, and business continuity becomes part of your vCSO engagement alongside whichever other domains you need.
Business Continuity Assessment
- Interviews with operations leaders, finance, department heads, and your IT provider.
- Structured review: a 15-question risk profile, a 25-point practices checklist, and a maturity score from 1 (Initial) to 5 (Optimized).
- Business impact analysis: your critical operations, what each depends on, and how long each can be down.
- Gap analysis against ISO 22301, the international standard for business continuity management.
- Written report and prioritized roadmap, walked through with your leadership team. The report is yours whether or not you continue.
The fee is credited in full toward the program if you start within 90 days.
The vCSO / ESRM Program
- Assess (Q1): we start from your assessment findings and the business impact analysis.
- Build (Q2): recovery time objectives for each critical operation, written continuity plans, alternate work arrangements, and a call tree.
- IT recovery alignment: we set the business priorities for system recovery, and your IT provider does the technical work to meet them.
- Exercises, starting with a tabletop and moving to a live test of one critical process, so gaps show up before a real outage.
- Operate (Q3+): we stay on as the named owner, with annual plan updates, regular exercises, and continuity reporting to leadership or your board.
Month to month. Cancel with 30 days’ notice. About the vCSO program →
Continuity Projects
- BIA refresh for a new site, an acquisition, or a major system change.
- Continuity exercise for one scenario, such as ransomware or a tornado.
- Plan review when a customer, lender, or insurer asks to see your plan.
- Vendor continuity review of what your critical providers have committed to.
Why Total 360
Operations first, then IT
Many continuity plans are really IT backup plans. We start from the operations that earn revenue and serve customers, then make sure system recovery supports them.
Physical and cyber causes
Outages come from buildings, weather, and systems. We plan for all of them, so your continuity plan works whether the cause is a tornado or ransomware.
Experienced leadership
Led by Don Oxman: M.S. in Security Management, CPP, CISSP, CISM. U.S. Army and AT&T background. In business since 2013 and licensed by Texas DPS.
Common questions
What does a business continuity assessment cost?
$2,500, as a fixed fee. It usually takes three to four weeks from kickoff to the readout. If you start the vCSO program within 90 days, the full fee is credited toward it.
What do we get at the end of the assessment?
A written report with your maturity score from 1 (Initial) to 5 (Optimized), the gaps we found against ISO 22301, the international standard for business continuity management, and a prioritized roadmap. We walk your leadership team through it, and the report is yours whether or not you continue.
Do we have to sign up for the full program?
No. The assessment stands on its own. If you continue, business continuity runs inside the vCSO program at $2,500 to $7,500 a month depending on scope. It is month to month, and you can cancel with 30 days’ notice.
Can we buy continuity projects without the program?
Yes. They are available to any client. Billed per engagement, quoted in advance.
Will you replace the people and providers we already use?
No. We work alongside your IT provider, attorney, insurer, and other advisors. We set the standard, help them meet it, and check that the work gets done.
Start with a 30-minute Risk Discussion
No deck and no sales pitch. Tell us which operations you could not do without and what your current plan looks like. We’ll give you an honest read on the gaps and send a scoped proposal within five business days.
Schedule a Risk Discussion Or call 817-677-0515 · info@total360security.com