# Business Continuity Readiness Assessment: Score Your Ability to Survive a Disruption > Source: https://netray.co/tools/business-continuity-readiness-assessment > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Answer 8 questions on DR testing, RTO validation, single-source supply risk, and cyber integration to see how ready your operation is to survive a major disruption. ## Category aerospace-defense ## Tool **Kind:** assessment **Questions:** #### Does your organization have a documented, approved business continuity plan covering IT systems, production operations, and key suppliers? **Options:** ##### No plan exists **Score:** 0 ##### Informal or undocumented plan **Score:** 3 ##### Documented but not reviewed or approved in over 2 years **Score:** 6 ##### Documented, formally approved, and reviewed annually **Score:** 10 #### How often do you test your disaster recovery plan with a full failover exercise? **Options:** ##### Never tested **Score:** 0 ##### Tabletop discussion only, no technical test **Score:** 4 ##### Partial technical test conducted annually **Score:** 7 ##### Full failover test at least annually with documented results **Score:** 10 #### What is your recovery time objective (RTO) for core ERP and production systems, and can you actually meet it? **Options:** ##### No RTO is defined **Score:** 0 ##### RTO defined but never validated through testing **Score:** 4 ##### RTO defined and met in testing most of the time **Score:** 7 ##### RTO defined, consistently met, and contractually documented for customers **Score:** 10 #### How resilient is your supply chain to a single-source supplier disruption? **Options:** ##### No visibility into single-source risk exists **Score:** 0 ##### Some awareness, but no mitigation plan in place **Score:** 4 ##### Key single-source risks identified with partial mitigation **Score:** 7 ##### Full single-source mapping with qualified alternates or safety stock **Score:** 10 #### Do you have a documented incident communication plan for notifying customers, regulators, and prime contractors of a disruption? **Options:** ##### No communication plan exists **Score:** 0 ##### Informal plan, not documented **Score:** 4 ##### Documented but never tested **Score:** 7 ##### Documented, tested, and includes required regulatory and contractual notification timelines **Score:** 10 #### How is your business continuity plan integrated with cybersecurity incident response for ransomware or data breach scenarios? **Options:** ##### Not integrated at all **Score:** 0 ##### Loosely connected with significant gaps **Score:** 4 ##### Integrated with some overlap gaps remaining **Score:** 7 ##### Fully integrated single plan covering both physical and cyber disruption **Score:** 10 #### What backup and alternate site capability exists for critical production and IT systems? **Options:** ##### No offsite backup exists **Score:** 0 ##### Offsite backup exists, but no alternate processing site **Score:** 4 ##### Alternate site identified but never tested **Score:** 7 ##### Tested alternate site or cloud failover with a defined activation process **Score:** 10 #### Has your business continuity program been assessed against a recognized framework such as ISO 22301 or NIST SP 800-34? **Options:** ##### Never assessed **Score:** 0 ##### Aware of the requirement, no formal assessment conducted **Score:** 3 ##### Self-assessed within the last 2 years **Score:** 6 ##### Independently assessed or certified within the last 12 months **Score:** 10 **Bands:** #### Critical Gap: A Single Disruption Could Halt Delivery **Min:** 0 **Max:** 40 **Verdict:** Your organization lacks the tested plans and supply chain visibility needed to survive a significant disruption without a major delivery failure. Given contractual continuity obligations common in defense and regulated manufacturing, this level of exposure should be treated as an immediate priority, not a future project. **Recommendations:** - Draft and approve a documented business continuity plan covering IT, production, and critical suppliers within 90 days - Identify and map every single-source supplier for critical parts immediately - Schedule a full disaster recovery failover test within the next quarter - Establish a documented incident communication plan for customer and regulator notification - Engage leadership to formally approve and fund the continuity program #### Partial Readiness: Plans Exist, Testing Is the Gap **Min:** 41 **Max:** 65 **Verdict:** Foundational continuity plans and backups exist, but the gap between having a plan and proving it works through testing leaves real risk. RTOs are often defined but unvalidated, and supply chain concentration risk is only partially mapped, both common and fixable within a year of focused effort. **Recommendations:** - Move from tabletop exercises to full technical failover testing at least annually - Validate whether your defined RTOs are actually achievable under realistic test conditions - Complete single-source supplier mapping and identify mitigation options for the highest-risk items - Integrate cybersecurity incident response into the continuity plan as a single coordinated document #### Solid Foundation: Formalize and Integrate Cyber Continuity **Min:** 66 **Max:** 85 **Verdict:** Your continuity program has documented plans, tested backups, and reasonable supply chain visibility. The remaining gap is typically full integration between physical continuity and cyber incident response, plus extending communication and testing discipline to the sub-tier supply chain. **Recommendations:** - Fully integrate cyber incident response into the same continuity plan and testing cadence - Extend supplier continuity requirements and verification to key sub-tier suppliers - Formalize independent assessment against ISO 22301 or an equivalent framework - Rehearse the incident communication plan alongside the technical failover test #### Contract-Ready: Maintain and Extend to the Supply Base **Min:** 86 **Max:** 100 **Verdict:** Your business continuity program meets or exceeds expectations for regulated manufacturing and defense supply, with tested recovery capability, mapped supply chain risk, and integrated cyber response. The priority now is maintaining this discipline and using it as a qualification advantage with primes and customers. **Recommendations:** - Use your tested continuity posture as a differentiator in prime contractor supplier audits - Extend the same testing and mapping discipline to your critical sub-tier suppliers - Automate continuity evidence collection so audit requests are answered in hours, not weeks - Reassess single-source risk annually as your product mix and supplier base change ## Content **Intro:** Business continuity plans that exist only on paper fail the moment they are tested by a real disruption, whether that is a ransomware attack, a single-source supplier failure, or a natural disaster at a key facility. This 8-question assessment scores your organization across plan documentation, disaster recovery testing, RTO validation, supply chain concentration risk, and cyber integration, then places you in one of four readiness bands with specific next steps. It takes under five minutes and is built for regulated manufacturers and defense suppliers who carry contractual continuity obligations to primes and customers. **Sections:** #### A plan that has never been tested is a guess, not a plan **Body:** The gap between having a documented business continuity plan and actually being able to execute it under pressure is where most organizations fail during a real event. Recovery time objectives that sound reasonable on paper often turn out to be unachievable once tested, because dependencies between systems, data, and staff availability were never mapped in enough detail to validate the assumption. **Bullets:** - Tabletop exercises validate the plan's logic but not its actual technical execution - A full failover test at least annually is the minimum bar for defense and regulated supply chains - Untested RTOs are a common finding in prime contractor supplier audits #### Single-source supply risk is often the biggest blind spot **Body:** Manufacturers frequently discover during an actual disruption that a critical part has exactly one qualified source, with no alternate supplier, safety stock, or requalification plan in place. For defense suppliers under DFARS clauses or aerospace manufacturers under AS9100, this kind of concentration risk is a documented audit finding once discovered, and it is far cheaper to map and mitigate proactively than to scramble during a live disruption. **Bullets:** - Sole-source dependency should be mapped for every critical part, not just top-spend suppliers - Qualified alternates or contractually protected safety stock are the two practical mitigations - Sub-tier concentration risk is invisible without direct supplier engagement #### Cyber and physical continuity need to be one plan, not two **Body:** Ransomware and other cyber incidents are now among the most common triggers of a business continuity event, yet many organizations maintain separate, disconnected plans for cyber incident response and physical disaster recovery. A unified plan that treats both as continuity triggers with shared communication protocols and recovery playbooks responds faster and with less confusion than two plans that were never tested together. **Bullets:** - Ransomware is now a leading cause of activated continuity plans across manufacturing - A shared communication protocol avoids duplicated or contradictory customer notifications - Joint testing surfaces gaps that testing each plan separately will miss **Cta:** Netray builds resilient, on-prem AI and data architectures for regulated manufacturers and defense suppliers, so recovery is a tested, documented process rather than an improvised response to a live disruption. **Faq:** #### What is a reasonable RTO for core ERP systems in manufacturing? **Answer:** Most manufacturers target a recovery time objective of 4-24 hours for core ERP and production scheduling systems, depending on how directly the system drives shop floor operations. Defense suppliers with contractual delivery obligations often target the lower end of that range and validate it through annual failover testing. #### How often should a disaster recovery plan be tested? **Answer:** At minimum annually with a full technical failover exercise, not just a tabletop discussion. Organizations with contractual continuity obligations to prime contractors or regulated customers often test semi-annually, particularly after any significant change to core systems or infrastructure. #### What is single-source supply risk and why does it matter for continuity? **Answer:** Single-source risk exists when only one qualified supplier can provide a critical part or material, meaning any disruption at that supplier halts your production with no fallback. It matters because it is often invisible until an actual disruption occurs, and mitigating it requires proactive supplier mapping and qualification of alternates well before a crisis. #### Do DFARS or defense contracts require a documented business continuity plan? **Answer:** Many defense contracts include continuity and safeguarding requirements under DFARS clauses that expect suppliers to maintain the ability to continue critical operations and protect controlled information during a disruption. Specific requirements vary by contract, so suppliers should review applicable clauses directly with their contracting officer or prime. #### Should cybersecurity incident response be part of the business continuity plan? **Answer:** Yes, ransomware and other cyber incidents are now among the most frequent triggers of continuity events, and treating cyber response as a separate, disconnected plan creates confusion and delay during an actual incident. A unified plan with shared communication protocols and recovery playbooks responds faster and more consistently. ## Search terms business continuity readiness, BCP assessment, disaster recovery testing, RTO RPO assessment, supply chain continuity risk, DFARS business continuity, ISO 22301 readiness, business continuity plan audit --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json