Continuity Plan Activation Criteria

Activation criteria are the pre-agreed signals that tell a firm when to start its continuity plan for a service, who may make that call, and whether activation is full, partial or precautionary. Without them, teams wait for certainty while harm grows, or they activate inconsistently, with different teams working to different assumptions. Criteria should be written in service terms, linked to tolerance and customer impact, and rehearsed before disruption. Under DORA in the EU, which applies from 17 January 2025, and under the separate UK regime in FCA PS21/3 and PRA PS6/21, the surrounding duties should be labelled separately, because the regimes use different language for resilience and recovery.

Good criteria describe observable signals rather than vague judgements. A signal might be that a customer-facing step is unavailable, that a key supplier has reported a failure affecting the service, that data integrity is in doubt, or that a team or location needed for the service is unavailable. The plan should state which signals, alone or in combination, justify activation, and which signals justify a precautionary step, such as convening a decision group or preparing a workaround, without full activation. That distinction matters, because full activation consumes attention and resources, while no action at all leaves the firm unprepared if the situation worsens. Criteria should therefore support graduated responses, not a single on-or-off switch.

Decision rights must be clear. The plan should name the person who may activate it, the deputy who may act when that person is unavailable, and the route for escalating when the situation crosses service boundaries. It should also state how the decision will be recorded, including the signal observed, the information available at the time, and the reasoning for the level of activation chosen. That record matters for later review, for customer communication, and for explaining why a plan was or was not activated. A decision made informally, without a record, is hard to defend and hard to learn from, even when it turns out to have been the right call.

Consider an illustrative investment platform service. A disruption to its trading interface affects customers differently from a disruption to its reporting or document service. Activation criteria should reflect that difference: the trading step may justify rapid activation and a degraded service offer, while the reporting step may justify a more limited response, with customer communication and a planned recovery. If criteria treat all steps identically, the firm may overreact to a minor disruption, or underreact to a serious one, because the criteria do not distinguish customer impact. Service-level criteria, tied to impact analysis, avoid that trap by linking activation to what customers actually experience.

Ambiguity is normal in the opening phase of disruption. Information is incomplete, supplier messages are uncertain, and different teams may interpret the same signal differently. Criteria should therefore include a route for handling uncertainty, such as a time-limited precautionary activation, a decision review point, or a defined escalation if new information arrives. That route should be agreed in advance, because inventing it during disruption adds delay and disagreement. Test scenarios should deliberately include ambiguity, so that decision makers practise activating on incomplete information, revising the level of activation as facts emerge, and communicating that revision clearly to staff and customers.

Deactivation deserves the same care as activation. The plan should state who decides that normal service has resumed, what checks must pass before that decision, and how customers and staff will be told. Premature deactivation can leave reconciliation, data checks or customer follow-up unfinished, while delayed deactivation can keep staff in emergency mode longer than necessary and blur accountability for normal operations. A clean handover, with outstanding actions owned and dated, marks the end of activation and the beginning of learning. That handover should feed directly into the post-incident review, so that activation criteria themselves are improved by experience, not just by theory.