Business Continuity and Disaster Recovery Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends Business Continuity Managers, Operational Risk Managers and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 9 Nov 2026 Course code SD-BC-021

Before you join: Participants should understand their organisation's core services, operational processes or technology services and have some experience of incident, risk, safety, security, operations or IT management.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Disruption can stop critical services, expose people to harm, breach contractual obligations and create prolonged financial loss. Flooding, cyber incidents, utility failures, supplier collapse, industrial accidents and loss of key personnel demand more than an emergency contact list. Organisations need defined recovery priorities, workable continuity strategies, tested plans and clear authority for decisions made under pressure. This course addresses the practical work required to establish, improve or coordinate a business continuity and disaster recovery programme.

Participants examine the business continuity management system (BCMS) lifecycle through ISO 22301. They conduct business impact analysis, set recovery time and recovery point objectives, map dependencies, select recovery strategies and write usable continuity, crisis and IT disaster recovery plans. The course also covers emergency interfaces, crisis communications, supplier continuity, ransomware recovery, exercising, internal assurance and corrective action management. Participants learn to connect business recovery requirements with technical restoration capabilities rather than treating business continuity and IT disaster recovery as separate disciplines.

Teaching combines short instructor briefings with realistic cases, facilitated group analysis, plan reviews, decision simulations and structured application planning. Cases may include a ransomware event affecting payment services, a flood closing a healthcare facility, a critical supplier failure and loss of access to a major office. Participants leave with a set of reusable templates and analyses that can be adapted to their own organisation, alongside a documented 90-day improvement plan. Successful participants receive a certificate of completion.

The course is suited to professionals with responsibility for resilience, operational risk, safety, technology recovery, facilities, security or critical service delivery. It is particularly useful where plans exist but have not been validated, where recovery priorities are unclear, or where leaders need a consistent approach to disruption management.

What you will be able to do

  • Define a BCMS scope, governance structure and ISO 22301 evidence set
  • Conduct a business impact analysis using calibrated impact and dependency criteria
  • Set recovery time objectives, recovery point objectives and minimum service levels
  • Design continuity and disaster recovery strategies for critical people, premises, technology and suppliers
  • Draft crisis, departmental continuity and IT disaster recovery plan structures
  • Apply stakeholder communication, incident escalation and situation reporting methods
  • Plan and evaluate tabletop, simulation and technical recovery exercises
  • Build a corrective action register and 90-day continuity improvement plan

Benefits of attending

For you

  • Ability to lead structured business impact analysis interviews with process owners
  • Confidence setting defensible RTO, RPO and minimum service requirements
  • Practical methods for writing plans usable during real disruption
  • Improved credibility when briefing executives on recovery investment decisions
  • A clear 90-day plan for strengthening continuity arrangements

For your organisation

  • Clearer recovery priorities for critical services, applications and facilities
  • Reduced confusion between emergency response, crisis management and disaster recovery
  • Better evidence for ISO 22301 alignment, audit and customer assurance requests
  • More realistic recovery strategies for cyberattack, site loss and supplier failure
  • A repeatable exercise and corrective action process that improves plan reliability

Course modules

10 modules over 5 days

Participants can establish the scope, governance and management controls for a business continuity management system.

  • ISO 22301 clauses, lifecycle and documented information requirements
  • Business continuity policy, scope, governance and programme sponsorship
  • Distinguishing incident management, crisis management, continuity and disaster recovery
  • Three lines model roles for owners, risk and assurance
  • Setting recovery objectives against legal, contractual and stakeholder obligations
  • Programme maturity assessment using defined evidence and scoring criteria
  • Management review inputs, decisions and corrective action tracking

Participants can identify critical services, dependencies and disruption scenarios requiring continuity treatment.

  • Interested-party requirements mapped through interviews, contracts and regulatory obligations
  • Critical product and service mapping from customer outcome backwards
  • Process dependency diagrams linking people, premises, technology and suppliers
  • Threat scenario library covering cyberattack, flood, pandemic and utility loss
  • Risk assessment using likelihood, impact, existing controls and residual exposure
  • Maximum acceptable outage defined for priority services and processes
  • Risk treatment decisions documented with accountable owners and due dates

Participants can complete a business impact analysis and translate findings into recovery requirements.

  • Business impact analysis questionnaires structured by process, service and location
  • Maximum tolerable period of disruption calculated from escalating consequences
  • Recovery time objectives set for processes, applications and infrastructure
  • Recovery point objectives linked to data loss tolerance
  • Minimum business continuity objective identifies acceptable initial service levels
  • Financial, regulatory, safety and reputational impact scales calibrated
  • Dependency validation tests BIA assumptions with process owners
  • Prioritisation matrix ranks recovery requirements by urgency and consequence

Participants can evaluate and justify continuity strategies against recovery requirements and disruption exposure.

  • Strategy selection compares people, premises, technology, information and suppliers
  • Work-area recovery options assessed: remote work, reciprocal sites, alternate facilities
  • Technology recovery patterns: backup, replication, failover and rebuild
  • Manual workarounds designed for essential transactions during system outages
  • Supplier continuity clauses specify notification, recovery commitments and evidence
  • Cost-benefit analysis justifies resilience investment against disruption exposure
  • Recovery strategy assumptions recorded, approved and periodically challenged

Participants can structure and write practical plans for crisis coordination, continuity and technical recovery.

  • Plan architecture separates crisis, continuity, departmental and technical recovery plans
  • Activation criteria, authority levels and escalation paths defined clearly
  • Incident command structure assigns strategic, tactical and operational responsibilities
  • Call trees and contact registers maintained with verification controls
  • First-hour actions prioritise life safety, stabilisation and situational awareness
  • Continuity procedures sequence minimum service restoration and resource deployment
  • Plan checklists use decision points, owners, timestamps and evidence logs

Participants can manage timely, controlled and audience-specific communications during a disruption.

  • Crisis communication objectives distinguish employees, customers, regulators and media
  • Stakeholder notification matrix assigns messages, channels, owners and timing
  • Holding statements prepared for uncertain facts and evolving incidents
  • Media spokesperson protocols control approvals, briefings and interview boundaries
  • Common operating picture consolidates verified facts, actions and decisions
  • Situation reports use cadence, status categories and decision requests
  • Data protection and confidentiality controls shape emergency communications

Participants can align IT recovery plans and technical controls with business recovery priorities.

  • IT service mapping links business processes, applications, infrastructure and data
  • Recovery tiers align technical capabilities with approved recovery objectives
  • Backup policy covers frequency, retention, immutability, restoration and ownership
  • 3-2-1 backup rule assessed against ransomware and site-loss scenarios
  • Disaster recovery runbooks sequence failover, restoration, validation and handback
  • Cyber incident containment coordinates forensic preservation with service recovery
  • Cloud recovery responsibilities clarified through shared responsibility models

Participants can coordinate recovery decisions, resources and handback during an active disruption.

  • Initial incident assessment captures safety, scope, impact and urgency
  • Incident severity classification triggers proportionate response structures
  • Emergency response interfaces connect life safety and continuity decisions
  • Resource allocation boards track personnel, facilities, equipment and spending
  • Decision logs record rationale, authority, time and follow-up actions
  • Recovery status dashboards report service levels, blockers and forecasts
  • Handback criteria transfer restored services into normal operational control
  • Post-incident debriefs capture observations before evidence and memories fade

Participants can design, conduct and evaluate continuity and disaster recovery exercises.

  • Exercise programme aligns objectives, scenarios, participants and assurance priorities
  • Tabletop exercises test decisions, escalation and cross-functional coordination
  • Walkthroughs validate plan usability, contacts and procedural completeness
  • Simulation exercises inject changing conditions, failures and stakeholder demands
  • Technical recovery tests measure restoration against RTO and RPO targets
  • Evaluator guides define observation criteria, evidence and scoring methods
  • After-action reports distinguish findings, corrective actions and lessons identified
  • Corrective action registers assign ownership, deadlines and closure evidence

Participants can assure continuity arrangements and prioritise improvements through a practical implementation plan.

  • Internal audit criteria test ISO 22301 conformity and plan effectiveness
  • Key performance indicators monitor training, exercising, reviews and action closure
  • Supplier assurance reviews examine continuity evidence, tests and contract obligations
  • Change management triggers BIA, strategy and plan updates
  • Management review evaluates performance, resources, risks and improvement priorities
  • Application plan schedules first ninety days of programme improvements
  • Personal accountability commitments identify stakeholders, milestones and required approvals

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. BCMS scope and governance charter template
  2. Business impact analysis questionnaire and recovery requirements register
  3. Recovery strategy options appraisal model
  4. Crisis communication and stakeholder notification matrix
  5. IT disaster recovery runbook template
  6. Exercise evaluation and corrective action register

Who should attend

  • Business Continuity Managers — responsible for building, maintaining or improving continuity arrangements
  • Operational Risk Managers — need defensible disruption risk treatment and recovery evidence
  • IT Service and Infrastructure Managers — align technology recovery with business recovery requirements
  • Health, Safety and Environment Managers — connect emergency arrangements with service continuity decisions
  • Facilities and Security Managers — prepare premises, access and physical resource recovery measures
  • Internal Auditors and Compliance Managers — assess continuity controls, exercises and corrective actions

Skills and tools covered

Business impact analysisRecovery strategy designCrisis communicationsIT disaster recoveryExercise managementBCMS assurance

Tools and standards

ISO 22301, ISO 22313, ISO 27031

How the course runs

Training methodology

The instructor uses short briefings to introduce standards, methods and decision criteria, followed by case work based on realistic disruption scenarios. Participants analyse business impacts, map dependencies, compare recovery options and review continuity and disaster recovery plan content. Facilitated group exercises test escalation, communications and recovery decisions under changing conditions. Tabletop and technical recovery simulation approaches show how plans are evaluated. Each participant develops an application plan linked to current priorities, stakeholders and approval requirements.

Requirements and prerequisites

Participants should understand their organisation's core services, operational processes or technology services and have some experience of incident, risk, safety, security, operations or IT management. Familiarity with existing emergency procedures, business continuity plans or service-level commitments is helpful but not essential. Participants do not need prior certification in business continuity, audit qualifications, technical disaster recovery skills or knowledge of ISO standards. The course explains the required continuity terminology and methods before applying them to cases and participant situations.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

You should understand your organisation's services, processes or technology environment and have some relevant operational, risk, safety, security or IT experience. Prior business continuity training, ISO certification and technical recovery expertise are not required.

Bring examples of your current continuity plans, emergency procedures, service catalogues, recovery targets or exercise reports if you can share them appropriately. These materials are optional, and participants can work entirely from the course cases.

It suits managers and specialists responsible for continuity, operational risk, IT services, facilities, security, safety or assurance. It is also suitable for staff asked to improve plans that exist but have not been tested or updated.

Emergency response training concentrates on immediate life safety and scene control, while cyber incident training focuses on detecting and containing technology threats. This course addresses how critical services continue or recover after disruption, including the business decisions that guide IT restoration.

You can use the templates to refresh a business impact analysis, identify gaps between business and IT recovery requirements, or plan a targeted exercise. The final application plan identifies first actions, stakeholders, milestones and approval needs for the next 90 days.

Each training day runs from 08:30 to 16:30 and provides about 6.5 contact hours, totalling approximately 32.5 hours. Time progresses from governance and impact analysis through strategy, planning, IT recovery, exercising, assurance and implementation planning.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Business Continuity