Minimum Business Continuity Objective (MBCO)

The Minimum Business Continuity Objective states the floor: the minimum level of products and services the organisation commits to deliver during a disruption. It exists so that the hardest choices — what to keep and what to sacrifice — are made calmly in advance, not improvised in the middle of a crisis. For the executive team the MBCO is the pre-agreed answer to who gets served first when capacity is scarce. It also protects the brand, because a defined floor can be communicated to customers and regulators.

Business owners propose the MBCO during the BIA, executive management approves it, and it is written into the business continuity plan. A retail bank, for example, may commit that during a major disruption 30 percent of branches stay open, cash withdrawals and salary payments continue, while new loan origination is suspended. The MBCO then shapes recovery sequencing: the RTO brings the service back to MBCO level first, and full service follows. People, sites and systems in the plan are sized to hold that floor.

The typical failure is an MBCO that was never quantified — a phrase like serving customers as best we can — so in a real event managers argue over scarce resources while customers wait. A floor that is not a number is not a commitment. How teams hold an agreed minimum under pressure is examined in ERGP module M4 on crisis leadership.

How an MBCO is set

1. Start from the impact analysis. The BIA establishes which products and services matter, how fast harm accumulates and who is affected first.
2. Propose a floor for each service. The business owner states the minimum volume, coverage or capability that must survive a disruption, expressed as a number rather than an intention.
3. Test the floor against resources. Sites, people, systems and suppliers are sized to hold that level. If they cannot, either the floor moves or the investment does.
4. Obtain executive approval. The MBCO is a commitment made on behalf of the organisation, so it is signed off by executive management, not by the continuity function.
5. Write it into the plan and the recovery sequence. Recovery restores the service to the MBCO first, then to full capacity. Without this ordering the plan optimises for the easiest system rather than the most important service.

Worked example, a retail bank

The value of the table is not the numbers but the fact that the argument happened before the incident. During a real event the same conversation costs hours the organisation does not have.

MBCO, RTO and MTPD compared

The three are set together. An RTO without an MBCO restores something, but nobody agreed how much of it. An MBCO without an MTPD sets a floor with no deadline attached.

Common mistakes

• A floor that is not a number. Phrases such as serving customers as best we can cannot be planned for or communicated.
• Set by the continuity team alone. The MBCO allocates scarce capacity between customer groups. That is an executive decision with commercial and regulatory consequences.
• Never revisited. Volumes, channels and customer expectations change. A floor agreed three years ago may now be either unreachable or embarrassingly low.
• Not reflected in contracts. If suppliers are not held to the same floor, the commitment exists only on paper.

Questions

What does MBCO stand for? Minimum Business Continuity Objective — the minimum level of products and services an organisation commits to deliver while disrupted.

Who approves the MBCO? Executive management, on a proposal from the business owners of each service. The continuity function facilitates and documents it.

How is the MBCO different from the RTO? The MBCO is a level of service, measured in volume or coverage. The RTO is a deadline, measured in time. Recovery normally restores service to the MBCO level within the RTO.

Is an MBCO required by ISO 22301? The standard requires the organisation to determine the minimum acceptable level of products and services to be delivered during a disruption. The abbreviation MBCO comes from the ISO 22300 vocabulary of security and resilience terms and is the usual shorthand for that requirement.

How should an MBCO be expressed? As a measurable quantity tied to a named service, for example a percentage of normal transaction volume, a number of open sites, or a specific capability that must not stop.