Platform · Business Continuity
Continuity you can activate, not just attest.
A register of what the business does and depends on, a guided business impact analysis that sets the recovery objectives, plans that inherit them, exercises that test them, and a live task board the moment a plan is activated for real.
Who it is for
Nobody asked the process owner what a day of downtime costs.
The security lead
Continuity in the same system as the rest of the program.
- A plan inherits the strictest objectives from the processes it covers
- Dependencies typed as assets, vendors or named people
- Exercise and debrief findings escalate into the risk register
The process owner
A guided impact analysis, in language you already use.
- A BIA wizard deriving the maximum tolerable period of disruption live
- A recommended recovery time objective as you rate impact
- No continuity vocabulary required to complete it
The incident commander
An activation you work live, not a binder you photocopy.
- Activation as a task board with checklist items assigned to named people
- Hand-offs that notify both parties at urgent priority while it is live
- Assignees and the plan owner notified the moment a plan activates
Why it matters
Continuity fails when the plan is a document instead of a program.
Most continuity programs are written once and reviewed annually. Recovery objectives are typed from memory, the call tree points at people who changed roles two quarters ago, and the plan has never been run under pressure. When the incident arrives, the document is the last thing anyone opens.
Alvor hangs everything off the business process. Each process carries an owner, a deputy, ordered steps, and typed dependencies: the assets, vendors, people, sites, and other processes it cannot run without. A guided business impact analysis scores impact across categories and time horizons, and its approval stamps the criticality tier and derives the maximum tolerable period of disruption and a recommended RTO. Nothing is asserted; it is analysed.
Plans inherit their objectives from the approved analysis, the most stringent value winning. Exercises record achieved RTO and RPO against target. A real incident turns the plan into a live task board, and any finding can be escalated into the risk register. The module uses ISO 22301 vocabulary, and the process, plan and finding registers export to CSV as evidence for ISO 22301 or ISO 27001 A.5.30 controls in Compliance.
The product
What that looks like on screen.
01 · The overview
Which processes are covered, and which are still exposed
Processes with an approved business impact analysis, the plans covering them and the exercises run against those plans. Coverage is derived from the records rather than asserted, so a gap in the programme shows up as a gap on the screen.
app.alvor.io/business-continuity
When it happens
Activation turns the plan into a live task board.
Checklists flatten into tasks, each assigned to a named person or the primary holder of a recovery role. Assignees are notified the moment the plan goes live.
Payments processing · Continuity plan
Active incidentActivated 02:14 · six tasks across three recovery roles
RTO 4h · from BIARPO 1h · from BIA
Pending2
Verify settlement file integrity
LNL. NovakFinance Ops
Confirm vendor SLA invoked
TBT. BaptisteVendor Mgmt
In progress2
Redirect payment traffic to standby processor
MSM. SilvaPayments
Publish status page update
JCJ. ChenComms Lead
Done2
Declare incident, notify plan owner
ARA. RahmanRecovery Lead
Fail over primary database
KOK. OseiInfrastructure
GuaranteesReassignments notify both ends of the hand-off·Stand down before close, enforced·Every change audited
Capabilities
One loop runs from register to recovery.
Processes, analysis, plans, exercises, activations, findings. Each stage feeds the next, and nothing lives in a binder.
Process register
Business processes with owners, deputies, ordered steps, and peak periods. Typed dependencies link each process to the assets, vendors, people, and sites it cannot run without.
Guided business impact analysis
Impact scored across categories and time horizons. Approval stamps the criticality tier, derives MTPD and a recommended RTO, and schedules the next review automatically.
Objectives inherited, not asserted
A plan covering processes inherits RTO, RPO and MTD from their approved BIAs, the most stringent value winning, and shows which process set each number. Each asset those processes depend on shows its strictest RTO and RPO the same way.
Exercises, tabletop to failover
Walkthroughs, simulations, component tests, and full failover drills. Results capture achieved RTO and RPO against target, and lessons learned become tracked findings.
Live activation board
Activating a plan flattens its checklists into a real-time task board with auto-assignment and notifications. Incidents run active, stood down, then closed, in enforced order.
Findings, risk, and evidence
A person with risk access escalates an exercise or debrief finding into the risk register. The process, plan and finding registers export to CSV for use as evidence in Compliance.
AI assistant
The AI drafts the plan. You make the decision.
Ask the program a question
“Which Tier 1 processes have no active plan?” is answered from your register, not from a report someone compiled last quarter.
Get the draft, keep the decision
The assistant drafts business processes and continuity plans. Drafts inherit their objectives from the approved BIA, and nothing is created until you approve it.
Keep the calendar honest
It schedules the next tabletop, flags overdue reviews, and proposes escalating findings into the risk register.
The moments that matter stay human
Activating a plan, standing down, closing an incident, and approving a plan are never available to the assistant.
Approval required
Create continuity plan (draft)
Covers
Payments processing · Tier 1
Objectives
RTO 4h · RPO 1h · inherited from approved BIA
Strategies
Failover · Manual workaround
ApproveReject
The exact change, shown before it happens. Nothing executes without approval.
What it replaces
Continuity you can activate, not file.
Most continuity programs produce a document that satisfies an auditor and helps nobody at three in the morning.
Instead of
A continuity plan in a binder
Written for the audit, stored in a cupboard, never opened during an incident.
In Alvor
An activation that runs as a task board, with checklist items assigned to named people and hand-offs that notify both sides.
Instead of
Recovery objectives typed into each plan
Numbers restated by hand, drifting apart from the processes they came from.
In Alvor
A plan inheriting the strictest objectives from every process it covers, each attributed to the process that drove it.
Instead of
An impact analysis workshop
A day in a room, a spreadsheet afterwards, and no way to keep it current.
In Alvor
A guided wizard the process owner completes themselves, deriving the tolerable outage and recommended recovery time as they rate impact.
How it connects
These are the exact links in the data model.
Named precisely, because “everything connects to everything” is not a claim anyone can check. Select any module to see its links.
01Set the program
02Design new systems
03Prove controls work
04Manage risk, vendors and continuity
RegisterThe register the rest stands on
Runs onYour own instance
Dedicated cloudOne instance for your company, in your region
On-premiseThe same platform, on your own servers
Air-gappedFully disconnected, with a self-hosted model
Links the product makes today
Business Continuity links to
Asset ManagementDependencies link to the asset register, and each asset inherits the strictest RTO, RPO, MTPD and tier with driven-by attribution.
Third-Party Risk ManagementA process can declare a vendor as a typed dependency with its own criticality, so a plan knows which suppliers it relies on.
Risk ManagementAn exercise or debrief finding is escalated into the risk register by someone holding risk write access.
Where it fits
One program that assets, risk, and compliance read from.
Questions
Common questions about
business continuity.
The module runs the whole continuity program in five areas: a Dashboard for coverage and readiness, a Process Register of business processes with owners and dependencies, Plans with recovery strategies and approvals, Exercises from tabletops to full failover drills, and an Incidents & Findings register for every live activation and lesson learned. You register what the business does, analyse what it can survive, write plans against that analysis, test them, and activate them when something real breaks.
Get started
See how Alvor works for your role
Whether you lead security, run IT, manage compliance, or sit in the C-suite - we'll show you your view.