Continuity Authority

Continuityauthority.com is a public-sector reference authority covering the intersection of cybersecurity and business continuity — the regulatory frameworks, professional standards, service categories, and operational structures that govern how organizations maintain operations before, during, and after cyber incidents. The site serves industry professionals, service seekers, and researchers navigating a complex sector where cybersecurity obligations and continuity planning requirements increasingly overlap. Spanning 41 published pages, the content library addresses topics from ransomware recovery and federal continuity directives to sector-specific compliance, vendor risk, and resilience maturity models.

Core Moving Parts
Where the Public Gets Confused
Boundaries and Exclusions
The Regulatory Footprint
What Qualifies and What Does Not
Primary Applications and Contexts
How This Connects to the Broader Framework
Scope and Definition

Core moving parts

The sector this site covers sits at the junction of two distinct professional disciplines: cybersecurity — concerned with threat prevention, detection, and response — and business continuity management (BCM), concerned with maintaining essential functions under adverse conditions. When a ransomware attack encrypts production systems, a distributed denial-of-service event takes down payment infrastructure, or a supply chain compromise corrupts critical software, the relevant response draws on both disciplines simultaneously.

The operational architecture involves five distinct functional categories:

Risk assessment and threat modeling — identifying continuity-relevant cyber threats and quantifying their operational impact
Continuity planning — developing documented plans (Business Continuity Plans, Continuity of Operations Plans, Disaster Recovery Plans) that address cyber-specific disruption scenarios
Technical resilience controls — backup architectures, recovery point and recovery time objective engineering, failover infrastructure, and identity and access management in continuity scenarios
Incident response integration — defining the triggers, escalation thresholds, and coordination protocols that connect cybersecurity incident response with continuity activation
Testing, exercise, and improvement — structured tabletop exercises, simulation drills, and after-action review processes governed by frameworks such as NIST SP 800-84

Professional service providers in this sector include management consultants, cybersecurity engineers, BCM specialists, legal and regulatory compliance advisors, and managed security service providers (MSSPs). Credentialing bodies include (ISC)², ISACA, and the Disaster Recovery Institute International (DRII), each offering certifications that address parts of this combined domain.

Where the public gets confused

The most persistent confusion in this sector is the conflation of disaster recovery (DR) with business continuity. Disaster recovery is a subset of continuity planning focused specifically on restoring IT systems and data after a disruptive event. Business continuity management is broader — it encompasses people, processes, facilities, supply chains, and communications, not just technology restoration. A DR plan can be fully executed while an organization still fails to maintain its essential business functions.

A second widespread misconception is that cybersecurity compliance equals continuity readiness. Passing a SOC 2 Type II audit or achieving ISO 27001 certification demonstrates that security controls meet a defined standard at a point in time. Neither certification guarantees that the organization can sustain operations through a major cyber incident. Business continuity and cybersecurity intersect at specific control points, but the two governance domains have separate frameworks, separate testing regimes, and separate professional communities.

A third confusion involves Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs). These are engineering parameters — the maximum acceptable downtime and the maximum acceptable data loss measured in time — not aspirational targets. Organizations frequently document RTOs and RPOs without validating them through actual recovery tests. The recovery time objectives for cyber incidents and recovery point objectives in cybersecurity pages address the mechanics of these parameters in detail.

Boundaries and exclusions

This site covers the cyber-continuity sector as a professional and regulatory reference domain. It does not provide legal advice, regulatory compliance determinations, or vendor recommendations.

In scope:
- Federal and state regulatory frameworks governing continuity obligations in cybersecurity contexts
- Professional credential and qualification standards
- Service category classifications and market structure
- Framework comparisons and technical standards

Out of scope:
- Physical disaster preparedness unrelated to cyber events
- General IT operations management without continuity relevance
- Insurance product comparisons (covered as a structural topic in cyber insurance and continuity alignment, not as product advice)
- Human resources and workforce law (workforce continuity is addressed only in its operational dimension via workforce continuity during cybersecurity incidents)

The site does not function as a matchmaking or referral platform. The Cybersecurity Listings and Continuity Listings pages provide structured directory access to service providers, but the authority function of the site is reference and classification, not brokerage.

The regulatory footprint

No single federal statute governs cyber-continuity requirements across all sectors. Instead, the regulatory landscape is fragmented across sector-specific frameworks, each administered by a different federal agency or self-regulatory body.

Sector	Primary Framework	Administering Body
Federal agencies	Federal Continuity Directive 1 (FCD-1); NIST SP 800-34	FEMA; NIST
Financial services	FFIEC Business Continuity Management Booklet	FFIEC member agencies
Healthcare	45 CFR §164.308(a)(7) — HIPAA Security Rule Contingency Plan	HHS Office for Civil Rights
Critical infrastructure	NIST Cybersecurity Framework (CSF) 2.0; CISA sector-specific guidance	CISA
Defense contractors	CMMC 2.0 (32 CFR Part 170); NIST SP 800-171	DoD
Energy sector	NERC CIP-009 (Recovery Plans for BES Cyber Systems)	NERC / FERC

The NIST Cybersecurity Framework and business continuity page documents how the CSF's five functions — Identify, Protect, Detect, Respond, Recover — map to continuity planning obligations. The Recover function (RC) is the most direct intersection, but the Identify function's risk assessment requirements directly inform continuity scope determination.

CISA publishes sector-specific cybersecurity performance goals and coordinates with sector risk management agencies across the 16 critical infrastructure sectors designated under Presidential Policy Directive 21 (PPD-21). For federal agencies specifically, Federal Continuity Directive 1 establishes baseline continuity program requirements.

The regulatory requirements for cyber continuity in the US page maps the full landscape in tabular form across 9 major sectors.

What qualifies and what does not

A cyber-continuity service qualifies for classification within this sector when it addresses the maintenance or restoration of essential functions in direct response to a cyber-originated disruption. The qualifying criterion is operational impact, not technology category.

Qualifying service activities:
- Business Impact Analysis (BIA) incorporating cyber threat scenarios
- Continuity of Operations Plan (COOP) development with cyber activation triggers
- Backup architecture design meeting defined RPO/RTO parameters
- Tabletop exercise design and facilitation for cyber incident scenarios
- Incident classification framework development (defining what severity level activates a continuity plan)
- Post-incident lessons-learned integration into continuity planning

Non-qualifying activities (adjacent but outside this sector's classification boundary):
- General IT security auditing without continuity scope
- Penetration testing without continuity impact assessment
- Standalone vulnerability management programs
- Physical security consulting without cyber-physical intersection
- General enterprise risk management not tied to operational continuity

The distinction matters because cyber resilience frameworks used in the US define resilience as an organizational capacity — not a technology product. Service providers marketing "resilience solutions" without demonstrable continuity planning components fall outside the core classification.

Primary applications and contexts

Federal and state government: Federal agencies face mandatory COOP requirements under FCD-1, requiring each agency to maintain essential functions for a minimum of 30 days under adverse conditions. State and local government programs vary; the state government cyber continuity programs page surveys current state-level frameworks.

Healthcare: HIPAA's Contingency Plan standard at 45 CFR §164.308(a)(7) requires covered entities to establish data backup plans, disaster recovery plans, emergency mode operation plans, testing and revision procedures, and applications/data criticality analysis. The HIPAA cybersecurity and continuity in healthcare page covers these five required implementation specifications.

Financial services: The FFIEC Business Continuity Management Booklet requires financial institutions to address resilience across all business lines, not just IT systems. The financial sector cyber continuity requirements page covers examination expectations.

Critical infrastructure operators: The 16 CISA-designated critical infrastructure sectors face escalating cyber-continuity obligations, particularly in energy, water, and transportation. Operational technology environments present distinct challenges covered in operational technology and cyber continuity.

Small and mid-size organizations: Regulatory requirements scale down but do not disappear for smaller entities. The cyber continuity for small business in the US page addresses the proportionality principle across major frameworks.

How this connects to the broader framework

Continuityauthority.com operates within the Professional Services Authority network, a broader collection of reference properties covering professional service sectors. Within that network, this site focuses specifically on the cyber-continuity domain — a sector that crosscuts cybersecurity, business continuity management, regulatory compliance, and professional services.

The site's content architecture mirrors the sector's structural layers. Foundational reference pages define core concepts and regulatory frameworks. Sector-specific pages address the healthcare, financial, federal, and critical infrastructure verticals where obligations are most clearly defined. Technical deep-dives cover the engineering parameters — backup and recovery cybersecurity standards, zero-trust architecture in continuity planning, and cloud continuity considerations — that determine whether continuity commitments are technically achievable. The cyber continuity maturity models page provides a comparative framework for assessing organizational capability levels.

The directory function — accessible through Cybersecurity Listings and the Cybersecurity Directory: Purpose and Scope page — provides structured access to service providers across these functional categories, classified by service type and sector focus.

Scope and definition

For purposes of this site, cyber-continuity refers to the combined discipline of maintaining, restoring, and improving an organization's capacity to sustain essential functions in response to cybersecurity events. It encompasses:

Prevention-phase continuity design: building systems and processes that degrade gracefully under attack
Response-phase continuity activation: executing pre-planned continuity measures when an incident crosses defined thresholds
Recovery-phase restoration: returning to normal or near-normal operations following a disruption
Post-incident improvement: incorporating lessons learned into continuity planning and testing cycles

The scope boundary is the cyber event as a causal trigger. Natural disasters, pandemics, and other non-cyber disruptions are outside this site's primary focus, although frameworks such as NIST SP 800-34 Rev. 1 — the Contingency Planning Guide for Federal Information Systems — address all-hazards continuity planning in ways that directly inform cyber-specific planning.

Professional roles in this sector span a spectrum from technical implementers (backup engineers, cloud architects, IAM specialists) to strategic planners (BCM consultants, CISO-level executives, compliance officers) to assurance providers (auditors, exercise facilitators, maturity assessors). No single certification or licensing regime covers the full scope; practitioners typically hold a combination of cybersecurity credentials (CISSP, CISM) and continuity credentials (CBCP from DRII, MBCI from BCI).

The glossary of cyber-continuity terms provides standardized definitions for the technical and regulatory vocabulary used across the site's 41 published pages.