Article 3 Business continuity policy

Article 3 sets out the core requirements for what a business continuity policy must contain and achieve.

Building directly on Article 2, which establishes who is responsible for the policy, this article shifts focus to the substance of that policy itself.

It requires that the policy genuinely address disruptive incidents affecting critical systems, be recorded in a durable medium, and cover a defined set of mandatory elements — from scope and activation criteria to governance arrangements and alignment with ICT-specific continuity frameworks.

Important points:

• Ensure your business continuity policy is recorded in a durable medium and addresses disruptive incidents or performance issues affecting systems critical to your business functions.
• Include in the policy a clear scope, activation criteria with escalation procedures up to management body level, and governance provisions covering staff roles, responsibilities, and resources.
• The policy must be consistent with ICT-business continuity plans and ICT response and recovery plans under Delegated Regulation (EU) 2024/1774, ensuring alignment across continuity frameworks.