A business continuity assessment answers one question: how mature is the program, measured against a standard, and where is it weakest? The phrase covers everything from a ten-question quiz to a consultant engagement, and the difference between them is depth, not purpose.
This post covers what a full assessment scores, the three depths you can buy it at, and what each one costs in money and in your team’s time.
What a full assessment covers
A maturity assessment scores the program against the controls of a published standard. For ISO 22301, that means the whole management system: context and leadership, planning and support, operation, performance evaluation, and improvement. Operation is where most of the practical work sits: the business impact analysis, risk assessment, continuity strategies, plans, and exercising.
The ResiliencyPulse ISO 22301 model has 105 questions in 13 categories that follow the standard’s order. Each question is scored on a 0 to 5 maturity scale, with a written rationale and the evidence behind it. Other standards cover other ground: ISO 22361 for crisis management, ISO 27031 for IT disaster recovery, FFIEC and FINRA Rule 4370 for financial services. The standards page lists all eight.
What you get at the end:
- An overall score and a level in words
- A score for every domain, so you can see which ones hold the total down
- The gap between each score and the target you set
- A comparison with peers on the same standard, where a publishable cohort exists
- A two-page executive summary for leadership
Assessment, audit, or gap analysis?
An audit asks whether you conform: yes or no, clause by clause, usually ahead of certification. A gap analysis lists what is missing against the standard. A maturity assessment asks how well each practice runs, on a scale, so a program can show progress between “missing” and “conforms.” Most programs need the maturity view first, because it tells you which gaps are worth closing before an auditor ever sees them.
The three depths
| Self-check | Self-run assessment | Facilitated assessment | |
|---|---|---|---|
| What it is | Ten questions across the main resilience domains | The full standard, scored by your team in ResiliencyPulse | Bryghtpath consultants conduct and review the assessment with you |
| What you get | An indicative score | Scores, gaps, benchmark, executive summary, history | All of that, plus a report written by the engagement team |
| Time | About four minutes | An afternoon of scoring, once the evidence is gathered | Typically 8 to 12 weeks |
| Cost | Free | $749.99 to $7,999 a year, unlimited assessments | Often $50,000 to $100,000 |
The self-check
The self-check is ten questions weighted toward business continuity, with crisis management, IT disaster recovery, risk, third-party, and emergency response represented. It takes about four minutes and gives an indicative score from 0 to 5. It is a starting point, not an assessment: ten questions cannot see evidence, and they cannot tell you which category inside a domain is the problem.
A self-run assessment
Your team scores the full standard in ResiliencyPulse. Every question carries help text and a list of the artifacts that would support a score, so the person scoring knows what to look for. Scores are yours, and so is the rationale behind them.
The money cost is the subscription. The real cost is your team’s time, and most of it is not scoring. It is finding the evidence: the current business impact analysis, the last exercise report and whether its findings closed, the minutes of the last leadership review. A program whose evidence is in one place scores quickly. A scattered one spends most of the time looking.
Once the evidence is gathered, a team can score a first ISO 22301 assessment in an afternoon.
A facilitated assessment
Bryghtpath’s Resiliency Diagnosis® is the same assessment, conducted by Bryghtpath consultants with your team. They score with you, review the result, and release it as a deliverable: an executive summary written by the engagement team, scores, domains, gaps, and a prioritized roadmap. It is delivered in ResiliencyPulse, so you keep read-only access afterward and can subscribe to keep measuring on your own. See With Bryghtpath.
A Resiliency Diagnosis® typically runs 8 to 12 weeks and often costs $50,000 to $100,000, depending on scope.
Which depth to choose
Take the self-check if you want a rough read before anything else. It costs four minutes.
Run it yourself if someone on your team knows the program well, can be candid about it, and has the time to gather evidence. Most programs reassess this way once a baseline exists.
Bring in a facilitator when the first baseline has to be defensible to a board or regulator, when the program spans teams that will not score each other candidly, or when nobody inside has scored against the standard before. The most common inflation in a self-run assessment is scoring the existence of a document as a 3. An outside assessor catches that the first time.
How often
Once a year. A single assessment is a snapshot; the second one is where the value is, because it shows whether the program moved. ResiliencyPulse reminds you at ten months and flags the assessment as due at twelve.
To see roughly where you stand today, take the self-check. For plan details, see pricing.