Over the past few years, this question has been asked of me more than once as I present on the topic of Major Incident Handling. It is a very valid question because the topics are very closely related, yet at the same time they are distinctly different. Below is my attempt to differentiate the two and provide some clarity to the topic.

Question: Business Continuity Planning and Major Incident Handling seem to be quite similar. Can you share where you see similarities and differences?

-- In my view, Business Continuity Plans tend to focus on an "after the fact" response to catastrophic events that have already occurred and that have already produced a significant impact which now threatens Business Continuity. A good example would be a Data Center fire that requires restoration of services to an alternate location. Business Continuity Plans are also more business focused and tend to look at multiple aspects of the business that may be impacted, not necessarily just only Incident Response.

-- Major Incident Handling is more "real time" and seeks to control or mitigate an event in progress in order to prevent a significant impact to the business that might threaten Business Continuity.

-- Both are focused on Incident Response with the caveat that Major Incident Handling tends to be focused on managing an incident in progress while Buisness Continuity is usually post event with a goal of managing the after effects of the Incident.

-- Think of Major Incident Handling as the fire fighters fighting a major fire in a housing community while Business Continuity would be the rescue and relocation teams who work with the victims of the fire after it has been extinguished in order to insure they have adequate shelter and basic necessities to survive.

Just like Major Incident Planning, Business Continuity planning has a very important role to play in an overall Organizational Risk Management scheme.  With that in mind, I want to share a source of some well-founded guidance. For me, I have found that the National Institute of Standards and Technology (NIST) is a very good source. Below are some links to the NIST guidance concerning Business Continuity and Risk Management that I think you will find useful.

Link to all of the NIST Standards (Special Publication Series 800-XX)

Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities

Contingency Planning Guide for Federal Information Systems (Errata Page - Nov. 11, 2010

NIST Contingency Plan Template

DRAFT Guide for Conducting Risk Assessments

More to follow...

Braun Tacon