What absolutely cannot stop?

What absolutely cannot stop?

Declaring every process critical makes continuity investment arbitrary. The starting point is the business outcome whose interruption creates unacceptable harm: safety, legal obligation, customer protection, liquidity, irreversible revenue loss or the ability to coordinate recovery.

Work backward from those outcomes to minimum viable service. Define which customers, products, locations and transactions must continue, at what capacity and for how long. Establish maximum tolerable disruption, recovery time and acceptable data loss. Full normal operation is rarely the immediate objective; a controlled degraded mode may protect far more value.

Map the people, facilities, technology, data, utilities and suppliers needed to deliver that minimum. Follow dependencies across functions and third parties, including identity, communications and payment services used by many processes. A nominally non-critical component can become the true single point of failure when every recovery path relies on it.

Prioritise resources and restoration using consequence over time, not executive visibility. NIST contingency controls call for identifying essential mission and business functions together with recovery objectives, restoration priorities, roles and metrics. ISO 22301 similarly focuses continuity on delivering products and services at a predefined acceptable capacity.

Validate the choices through exercises that remove key dependencies and force trade-offs. Confirm that leaders will actually stop lower-priority work to protect the critical outcome. What cannot stop is not the process with the loudest owner; it is the smallest set of capabilities whose loss crosses an agreed boundary of unacceptable consequence.