Full programme · whole company · 1–2 months

Resilience audit and improvement: a working continuity system for the whole company in 1–2 months

We audit how the company would get through a serious disruption, test the plan in a tabletop stress test and leave you working plans, prepared people and recovery metrics. Free fixes are made during the work.

1–2 monthsfrom the first interview to working plans and metrics

Week 3first findings: the weak points and the cost of a downtime day

Whole companytwo scenarios chosen with you, all critical processes

Under NDAyour data stays with you

Priced by scopequote within two working days · excl. VAT

Discuss on Zoom See what you keep

What it gives you

Five questions owners and boards bring to us, and the answer you get. A drone strike or ransomware readiness check covers one scenario in five weeks. This programme covers the whole company.

“What does one day of downtime cost us?”A figure in AED for every critical process: lost revenue, penalties, recovery costs. You can show it to the board and the insurer.
“Are we ready for a serious disruption?”We test it on two scenarios that are real for you, for example a ransomware attack and the loss of a site, and show where the plan breaks and how many days recovery takes.
“Who does what in the first hour?”Roles, authority and a first-hours checklist, rehearsed by your team on a tabletop day.
“How do we measure resilience?”Recovery time objectives (RTO) for key processes, acceptable data loss (RPO) and a readiness index you can track quarter by quarter, also on a dashboard.
“What do we show NCEMA 7000 assessors, the Central Bank or a large client?”Plans, test records and metrics as evidence, written in the terms of AE/SCNS/NCEMA 7000 and ISO 22301.

Why it is worth starting now

A continuity system takes one to two months to build. The requirements of regulators, large clients and insurers already apply. Here is what 2026 showed.

Business interruption stays among the top three business risks.In the Allianz Risk Barometer 2026, 29% of 3,338 risk experts named business interruption a top peril, third in the world. Only 3% see their supply chains as very resilient.Allianz, 14 January 2026
Large UAE companies make NCEMA 7000 mandatory and extend it to contractors.The business continuity policy of Emirates Global Aluminium, implemented on 5 August 2026, calls AE/SCNS/NCEMA 7000:2021 a mandatory standard. The CEO owns the system, and third parties and contractors must comply with the policy.EGA, BCMS Operating Policy, August 2026
The Central Bank expects a full operational resilience framework.Regulation C1/2026 of the Central Bank of the UAE, issued in February 2026, requires licensed financial institutions to establish comprehensive frameworks for operational risk and operational resilience. The one-year transition under the new Central Bank Law ended on 16 September 2026.Hadef & Partners, 26 August 2026
What you can do this week.Name one owner for continuity, list the five processes that bring in most of the revenue and check when each of their plans was last tested.

How the work goes and when you get results

Three stages: understand, test, fix. Every step ends with a document you keep. A typical timeline for one company and two scenarios:

Weeks 1–3Understand
- Two scenarios chosen with you. By default, a ransomware attack and the loss of a site. For a trading house it may be a cornerstone contract, for a family business the departure of key executives, for a manufacturer a key supplier.
- The economics of the company: where revenue comes from, how it turns into EBITDA, where clients, suppliers and single points of failure are concentrated.
- Interviews with the people who make the money: who really holds each process together.
First findings: weak points and the cost of a downtime day
Weeks 4–5Test
- A tabletop stress test: CRM or ERP goes dark, a warehouse or a production block is closed. Systems keep running as usual; the decisions, gaps and timings of the day are real.
- The stress-test record: what broke, who decided what and how long recovery took.
Gaps confirmed on your own processes
Weeks 6–8Fix
- The recovery scheme, built with your team: who does what, at which hour, with what authority. People carry out plans they helped to write.
- Metrics and fixes: free fixes are made right away (plans, backup channels, contract wording, offline copies); measures that need a budget come with a payback case and a 90-day plan.
Plans, roles, metrics and a 90-day plan

Time from your people: leadership joins the scenario session, the stress-test day and two reviews; key people give one interview of about an hour each. The analysis, modelling and documents are ours.

An example of one fix

The client register lives in the CRM, and that is exactly what ransomware encrypts first. During the programme we export it to a simple offline file kept away from the office and agree a backup channel: a direct contact for every key client, collected in advance, with message templates ready. Cost: zero. On the day of an incident, sales keep talking to clients while IT recovers. The programme is full of fixes like this.

What you keep

Eight working documents, each with a reader who needs it. Figures in the samples are illustrative.

Readiness audit report

The company’s position on both scenarios, scored, with the three most serious gaps at the top.

for the board and the insurer

Risk map of key processes

Which scenario stops which process, and what one lost day costs.

for management and process owners

Single points of failure register

One supplier, one system, one person, one site: found, priced, with a decision on each.

for management, procurement and IT

Revenue → EBITDA resilience model

How revenue is made and where a disruption cuts into profit.

for the CFO and the board

Stress-test record

The tabletop day minute by minute: what broke and how long recovery took.

for management and the auditor

Business continuity plan (BCP) and IT disaster recovery plan (DRP)

Short and actionable: triggers, roles and authority, a first-hours checklist, system recovery.

for the duty shift and IT

Recovery scheme

Who does what and at which hour, from the disruption back to normal operations.

for the crisis team

Recovery metrics and a 90-day plan

Recovery time and recovery point objectives by process, ready for a dashboard; free fixes done, paid ones backed by risk economics.

for the board and the dashboard

Why clients trust us

We see the most sensitive things: how the company makes money, its contracts and its weak points. So the rules for your data are fixed before we start.

NDA before the first working meeting.We sign your non-disclosure agreement or offer ours.
Your data stays with you.We work on your premises and with your documents, and hand every document to you. On our website and in talks we use only anonymised examples.
Experience.Evgeny Telenkov built business continuity from scratch at a large mining and metals company and has written more than 30 continuity plans over his career. He has led risk functions in telecom, oil and gas and consulting (EY), and was Chief Risk Officer of a USD 20 billion petrochemical megaproject. Deputy Chair of Technical Committee 010 “Risk Management” of Rosstandart, Russia’s national standards body, and co-author of six GOST R national standards.
Industries.Mining and metals, oil and gas and petrochemicals, telecom, manufacturing.
A clear boundary.Security tools, engineering protection and certification audits stay with licensed specialists and certification bodies. We answer for the plans, the readiness of your people and the recovery metrics.

Price

The price depends on the number of sites and scenarios, the depth of the fixes and the size of the team we work with. We send a quote within two working days.

Priced by scopequote within two working days · excl. VAT

Discuss on Zoom

Free fixes are made during the work and are included in the price.

Lighter start

Readiness check: one scenario in five weeks, AED 109,000.A drone strike or ransomware check shows what stops, what one day of downtime costs and which measures cut the loss.
50% of the check is credited.If you order this programme within six months after a readiness check, half of the price of the check is credited.
Free readiness check, 5 minutes.Thirteen questions show your biggest gaps on screen, no email required.

Good to know

Prices exclude VAT.The final amount is fixed in the contract.

Frequently asked questions

What does the quote include?

The quote is fixed for the agreed scope. Everything fixable without capital spend is fixed together during the programme: plans, registers, backup channels, contract wording, drills. Measures that need investment come with a risk-economics case that shows how they pay back; the decision stays yours.

How is this different from a scenario readiness check?

A readiness check covers one scenario, a drone strike or ransomware, in five weeks and ends with a report to the owner and a roadmap. The programme builds continuity for the whole company in 1–2 months: plans, roles, a stress test and metrics. 50% of the price of a check is credited if you move to the programme within six months.

Will you really switch off our systems?

No. The stress test is a tabletop exercise: we model the loss of CRM and ERP or the closure of a site in a structured exercise. Production is never touched, and the decisions, gaps and timings the day produces are real.

Our biggest risk is neither ransomware nor the loss of a site. Does the programme fit?

Yes. The two default scenarios are starting points. For a trading house it may be the failure of a cornerstone contract, for a family business the departure of key executives, for a manufacturer a key supplier. We agree on the two scenarios that really threaten you at the start.

Does the programme prepare us for NCEMA 7000 or the Central Bank?

It builds what an assessor looks for: a business impact analysis, plans, a tested recovery scheme and metrics, in the terms of AE/SCNS/NCEMA 7000 and ISO 22301. Certification of a management system is done by an accredited body; we prepare the evidence.

What happens after the programme?

You keep the documents, the recovery metrics and the 90-day plan. Many clients continue with the continuity dashboard, the same metrics on one board-level screen, and an annual exercise. Both are optional.