The institution establishes a service continuity management (ITSCM) process to ensure the continuity of its services, especially those involving critical operations, and maintains the availability of information at an acceptable level in the event of significant disruption. The ITSCM should focus on those events that the institution considers significant enough to be treated as a “disaster”.

The risks of a loss of a business process, such as financial loss, damage to reputation or regulatory breach is measured through a joint exercise between functional team and ICT – called business impact analysis – , which determines the minimum critical requirements.