Business Continuity

Bought, Not Built

Turning business continuity plans into an operating capability for utilities and other essential public services.

By Jeff Crow, CBCP · October 21, 2026

Executive Summary

Most public utilities and essential-service agencies already own the parts of a business continuity program: an emergency operations plan, IT disaster recovery, perhaps a continuity software license. Few have put those parts together into a capability that would hold up on a bad day.

Water, wastewater and power organizations are good at emergency response. They drill, they use the Incident Command System, and they know how to restore a main or a pump station. The weak point sits behind the response, in the business functions that keep the organization running for days or weeks after the first operational period: payroll, procurement, chemical and parts supply, customer communications, billing, regulatory reporting, and the people who know how all of it works.

This paper draws on Teleion's business continuity engagements with health systems, a global technology company, a large mission-driven enterprise and a public water agency. Across these sectors the same pattern appears. Continuity is often bought, not built: a plan, tool or policy is acquired, but nobody is resourced to make it operate. The fix is rarely another document. It is a phased program, grounded in recognized standards, that moves the organization from ad hoc response to a managed, tested capability.

Key takeaways

Emergency management is not business continuity. Strong incident command does not guarantee that critical business functions keep running. Both are needed, and they must connect.
Tools do not make programs. A continuity platform without an owner, templates, training and reporting is an unused license.
Business owners set recovery objectives. Recovery time and data-loss tolerances have to come from the people who run the processes, then be reconciled with what IT and operations can deliver.
Maturity is built in phases. A crawl-walk-run roadmap over roughly three years, aligned to the DRII Ten Professional Practices and ISO 22301, moves most organizations from Level 1 or 2 to Level 4.
Lean teams can do this. Pairing an internal continuity owner with a credentialed practitioner who carries execution is a proven, repeatable model.

Why Continuity Matters for Essential Public Services

Essential public services have little room for a partial outage. A retailer that loses a distribution center can reroute orders. A water utility that loses pressure triggers boil-water notices, hospital contingency plans and school closures. Recent events show how quickly a local failure becomes a community crisis, and how often the failure begins outside the core operating system.

Three recent lessons

Cascading infrastructure failure. During the February 2021 winter storm, 1,445 Texas public water systems reported service disruptions, affecting nearly 14.4 million people in 190 counties. Much of the damage traced back to the loss of electric power, a dependency outside the utilities’ control. [1]
Compounding operational fragility. In August 2022, flooding on the Pearl River combined with pump failures at a treatment plant already running on backup equipment to leave approximately 150,000 residents of Jackson, Mississippi, without safe drinking water. An EPA review earlier that year had cited understaffing and high employee turnover among the system’s problems. [2]
Supply-chain disruption. In June 2021 an electrical failure at a single chemical manufacturer disrupted chlorine supply to water and wastewater facilities in Washington, Oregon, Idaho and parts of California. Utilities were directed to mutual-aid channels and local emergency management while supplies recovered. [3]

None of these began as a cyber event, and none was solved by response skill alone. Each tested the business functions behind operations: supplier management, staffing, communications, finance and coordination with outside agencies. That is the territory of business continuity.

Workforce risk raises the stakes. Brookings estimates that nearly 1.7 million people work directly in U.S. water, and that several water occupations, including treatment operators, skew significantly older than the national workforce. [4] When experienced people retire, undocumented knowledge leaves with them. A continuity program is one of the few disciplines that systematically captures how critical work actually gets done.

Bought, Not Built: The Common Failure Pattern

In our engagements we rarely find an organization with nothing. We find organizations with pieces: a plan written for an audit, an IT recovery runbook, a software license, a binder in the emergency operations center. What is missing is the operating model that makes those pieces work together and keeps them current.

Five symptoms we see repeatedly

A platform without an owner. The continuity tool was purchased, but documents were never loaded, nobody administers it, users were never trained and no reports come out of it.
IT-only coverage. Recovery plans exist for systems but not for finance, human resources, procurement, customer service, legal or communications.
Unreconciled recovery objectives. Business units assume systems will be back in hours; IT's recovery strategy delivers in days. Nobody has put the two numbers side by side.
No exercise cadence. Plans are written once and filed. Without tabletop exercises and after-action reviews, nobody knows whether they would work.
A capacity gap. One person, often newly hired or part time, is asked to run an enterprise program while also administering a tool and chasing department inputs.

A continuity program that exists only as a purchase is not a capability. The question is what each function would do on day one, day three and day thirty.

Field example: Large mission-driven enterprise. From an unused license to an operating program

The situation. The organization had purchased a capable continuity platform but never put it into use. Plans covered IT but not the rest of the enterprise, recovery objectives were not consistently defined, and there was no exercise program or cross-functional plan for a ransomware event. A single newly hired continuity manager owned the whole program.

What Teleion did. Teleion placed a CBCP-credentialed practitioner as the program’s execution arm so the manager could focus on strategy and stakeholders. The work ran in three layers: platform (assessment, configuration and access framework, templates, training, automated reporting and a program health dashboard); content (BIAs, recovery plans and playbooks developed with each department, recovery objectives reconciled with IT, and a cross-functional ransomware playbook as one of several hazard scenarios); and program management (tabletop exercises, after-action reports, steering committee reporting and a maturity assessment).

The result. The platform is now an operating capability with a populated repository and live coverage reporting. At the client’s request Teleion also built an enterprise-wide recovery framework, which was not in the original scope, to tie departmental plans together. The engagement has been renewed twice, and the client’s program lead rated Teleion a 10 on Net Promoter Score.

Business Continuity, Emergency Management and IT Recovery

Utilities often assume that a strong emergency management function means they are covered. The two disciplines are related but answer different questions. Emergency management protects people, property and the environment in the first hours of an incident. Business continuity keeps the organization's critical functions running through and after the disruption, often for weeks. IT disaster recovery restores the technology both depend on.

Exhibit 1. Three related disciplines, three different questions

Aspect	Emergency Management	Business Continuity	IT Disaster Recovery
Core question	How do we protect life, property and the environment now?	How do critical functions keep running until normal operations resume?	How fast can we restore systems and data?
Time horizon	Before, during and immediately after an incident	During the disruption and through long-term recovery	From system failure to restoration
Typical owner	Emergency manager, safety, operations	Continuity manager with business-unit leaders	IT infrastructure and applications
Key artifacts	Emergency response plan, ICS roles, EOC procedures	BIA, recovery strategies, business continuity plans, exercises	DR plans, backups, recovery runbooks
Utility example	Main break response, evacuation, boil-water notice	Paying staff, buying chemicals, billing customers and reporting to regulators during a long outage	Restoring the customer information or work-order system

Source: Teleion analysis, adapted from engagement work and DRII Professional Practices. [5]

Where NIMS fits

Most utilities already know the National Incident Management System. Since its release in 2004, NIMS has given responders a shared language, systems and processes, including the Incident Command System, Emergency Operations Center structures and Multiagency Coordination Groups, and it applies to the private sector and non-governmental organizations as well as government. [6] FEMA’s Continuity Guidance Circular states the connection directly: organizations should integrate continuity planning with incident management planning and operations. [7]

In practice that means the EOC should be able to answer continuity questions as well as response questions. Which business functions are degraded? Which recovery objectives are at risk? Which suppliers, staff or systems need to be redirected? A continuity program supplies those answers in advance through the business impact analysis and recovery plans, so the incident commander is not improvising them.

Field example: Public water agency (in progress). Building the bridge between incident command and continuity

The situation. A large public water agency is implementing an Emergency Operations Center to coordinate its response to incidents affecting water delivery.

What Teleion is doing. Teleion is supporting the EOC implementation. The engagement treats the EOC as the point where incident command and business continuity meet: response roles aligned to ICS, and a structure that can call on continuity information about critical functions, dependencies and recovery priorities.

Why it matters. An EOC that knows only about the incident manages the first operational period well. An EOC connected to the continuity program can also manage day three and day thirty.

A Standards-Based Backbone

A credible program needs a recognized framework so that leadership, auditors and partner agencies can see what good looks like. Teleion aligns its work to the Disaster Recovery Institute International (DRII) Ten Professional Practices for business continuity management [5] and to ISO 22301, the international standard for business continuity management systems. [8] The practices give a complete map of the program; the standard gives a management-system discipline of policy, objectives, review and continual improvement.

We use the ten practices as a diagnostic. Exhibit 2 shows a gap profile typical of organizations that have strong emergency response but no formal continuity program. It is drawn from a Teleion assessment of a large regional health system, and the pattern closely matches what we see at utilities.

Exhibit 2. Typical gap profile against the DRII Ten Professional Practices

Professional Practice	Gap	Typical finding
1. Program Management	High	No formal program, charter or executive sponsor
2. Risk Assessment	Medium	Strong focus on IT risk; limited view of operational risk
3. Business Impact Analysis	High	BIAs incomplete across critical functions
4. Business Continuity Strategies	Medium	Some strategies exist but are not optimized
5. Incident Preparedness and Response	Medium	Basic incident management that needs enhancement
6. Plan Development and Implementation	Medium	Plans exist but are not integrated or standardized
7. Awareness and Training	High	No formal continuity training or awareness
8. Exercise, Assessment and Maintenance	High	Isolated tests; no enterprise exercise program
9. Crisis Communications	Low	Emergency protocols within a unified escalation framework
10. Coordination with External Agencies	Low	Established relationships with emergency services

Source: Teleion gap assessment of a large regional health system, against DRII Professional Practices. [5]

The pattern is worth noticing. The practices closest to emergency management (crisis communications and external coordination) score well. The practices that make continuity a managed program (governance, BIA, training and exercising) score poorly. Utilities with mature emergency response should expect a similar profile.

The Crawl-Walk-Run Maturity Path

Continuity maturity is built in sequence. Trying to run full-scale exercises before business impact analyses exist, or buying a tool before there is anyone to run it, is how programs end up bought rather than built. Teleion uses a five-level maturity model and a three-phase roadmap that most organizations can complete in about three years.

Exhibit 3. Business continuity maturity levels

Level	Name	Description
Level 1	Basic	Ad hoc response; plans live in people's heads
Level 2	Developing	Plans exist but are not integrated (typical starting point)
Level 3	Defined	Documented, standard processes
Level 4	Managed	Integrated program, tested regularly (three-year target)
Level 5	Optimized	Continuous improvement

Source: Teleion maturity model.

Exhibit 4. Crawl-walk-run roadmap by workstream

Workstream	Crawl (Year 1): Foundation and structure	Walk (Year 2): Process and documentation	Run (Year 3): Maturity and simulation
Governance	Executive sponsor; charter and policy approved; steering committee formed	Plan review and approval cycle	Performance review; culture assessment
Program management	Team formed; resources allocated	Implementation; change management	Optimization; continuous improvement
Risk and impact	Initial risk review; BIAs for critical functions	Risk validation; recovery objectives reconciled with IT	Ongoing assessment; external audit readiness
Plans	Recovery strategies selected	Plans documented and integrated under an enterprise recovery framework	Refinement; alignment with ISO 22301
Training and exercises	Team training; awareness launched	Tabletop exercises with after-action reports	Functional and full-scale exercises with partner agencies
Technology	Assess existing tools; configure or select platform	Templates, reporting and notification integrated	Automation; program health dashboard

Source: Teleion roadmap developed for a large regional health system, generalized.

Sizing the team

The most common reason programs stall is staffing. In a recent assessment of a regional health system with more than ten thousand staff, Teleion found two fractional team members supporting continuity. Using a planning ratio of roughly one continuity professional per 1,000 employees, we recommended a dedicated team of six: a director, program managers aligned to major business areas, and an executive sponsor. Smaller utilities will need fewer people, but the principle holds: a program needs named owners with time to do the work.

Not every agency can hire a full team at once. In those cases we recommend the model that has worked for our clients: a client-owned continuity lead who sets strategy and owns relationships, supported by a credentialed practitioner who carries execution. That keeps decision rights inside the organization while giving it the capacity to move through the roadmap.

Field Lessons

Beyond the examples above, three further engagements shaped how we approach continuity for organizations with essential missions.

Field example: Multi-hospital health network. Standing up a program across a distributed network

The situation. A health network spanning more than a dozen hospitals needed a single continuity framework across facilities that had each planned on their own.

What Teleion did. Established the enterprise continuity framework, led continuity tool selection, and conducted risk assessments and business impact analyses across the network.

Lesson for utilities. Distributed operations (treatment plants, pumping stations, field crews) need one framework with local plans beneath it, not a separate approach at each site.

Field example: Global technology company. Keeping facilities running through a pandemic

The situation. At the onset of the COVID-19 pandemic, the company's real estate and facilities operations had to keep buildings open and vendors working while public health rules changed weekly.

What Teleion did. Identified critical functions and set up a daily inventory process for protective supplies, with monthly consumption forecasts, redundant vendors and stock rotation. Produced the missing step-by-step remote-access instructions so vendor staff could work securely off site. Found that about 80% of the staff running a key workflow platform were in one metro area, and established backups in another region. Separately, Teleion supported supply-chain risk analysis and continuity compliance for a cloud infrastructure group.

Lesson for utilities. Single points of failure hide in people, places and suppliers as much as in systems. The chlorine shortage of 2021 is the same problem in a different form.

Field example: Large regional health system. Making the case for a formal program

The situation. The organization had strong emergency management and a partial BIA, but no formal continuity program, limited staffing and little enterprise exercising.

What Teleion did. Assessed existing documentation and supply-chain readiness, ran a gap analysis against the ten practices, identified 18 critical functions for business impact analysis, and delivered staffing, technology and roadmap recommendations to leadership.

Lesson for utilities. A short, standards-based assessment gives leadership a clear picture of current state, target state and the cost of getting there, which is what it takes to win sponsorship and funding.

Where to Start: A Self-Check for Leadership

These ten questions, one per professional practice, give a quick read on where your organization stands. If you answer no or not sure to more than three, your program is probably at Level 1 or 2.

Does the continuity program have an executive sponsor, an approved charter and a steering committee?
Have you assessed operational risks, such as power, chemicals, staffing and key suppliers, as well as IT risks?
Has every critical function, not just IT, completed a business impact analysis in the last two years?
Have business owners set recovery time and data-loss objectives, and has IT confirmed it can meet them?
Can your EOC see which critical business functions are degraded during an incident?
Do finance, HR, procurement and customer service each have a tested continuity plan?
Do staff with continuity roles receive training, and is continuity part of onboarding?
Did you run a continuity tabletop exercise in the last 12 months and close its after-action items?
Is there a crisis communications plan for customers, regulators and elected officials during a long outage?
Are mutual-aid agreements and partner-agency contacts documented and current?

Start with a business continuity maturity assessment

A fixed-scope assessment of your current program against the DRII Ten Professional Practices. You receive a gap analysis, a maturity rating with a target state, staffing and technology recommendations, and a crawl-walk-run roadmap your leadership can fund.

For more information about how Teleion can help build your business continuity program, please visit Security, Risk and Compliance.

References

Texas Commission on Environmental Quality figures as of February 20, 2021, reported in “More than 14 Million Texans Remain Under Advisories Related to Severe Weather,” Bowie News, February 2021. bowienewsonline.com
“Jackson, Mississippi water crisis.” Wikipedia, accessed October 2026, summarizing contemporaneous reporting and EPA findings. en.wikipedia.org
“U.S. Department of Homeland Security Reporting Chlorine Shortage in California.” Water Online, June 23, 2021. wateronline.com
Kane, J., and Tomer, A. Renewing the Water Workforce. Brookings Institution, June 2018. brookings.edu
DRI International. Professional Practices for Business Continuity Management. drii.org
Federal Emergency Management Agency. 20 Years of the National Incident Management System. 2024.
Federal Emergency Management Agency. Continuity Guidance Circular (2018, updated 2024). fema.gov
International Organization for Standardization. ISO 22301:2019, Security and resilience. Business continuity management systems. Requirements.

About the author

Jeff Crow, CBCP

Jeff Crow is a Practice Director at Teleion and a Certified Business Continuity Professional. He leads Teleion's business continuity and emergency operations work, including EOC design and activation frameworks, business impact analysis and continuity planning, crisis communications planning, and exercise programs built on short, frequent practice. His engagement experience spans health systems, public utilities, global technology companies, and large mission-driven enterprises.

Have a challenge worth tackling?

Let's talk!