Business Continuity Planning in Rwanda

What is business continuity planning, and who needs it

It’s a structured exercise to work out what matters most, how long each critical activity can be disrupted, how each supporting system will be recovered, and what people do in the meantime, followed by a written plan and a drill. It suits hospitals and clinics, banks and microfinance institutions, hotels, schools, NGOs running field programmes and any organisation where an outage directly stops service to customers or beneficiaries.

The problem it solves

Without a plan, every outage is improvised. People wait for one person who knows the systems, recovery happens in whatever order seems urgent, nobody has the supplier’s contract number, and customers hear nothing. With a plan, the decisions have been made calmly in advance: who leads, what comes back first, how work continues by hand, and who is told what.

The numbers that drive the plan

The international standard for business continuity management, ISO 22301, uses a few terms worth knowing:

Business impact analysis. Working out which activities matter most and how quickly the damage from their disruption grows over time.

Maximum tolerable period of disruption. How long an activity can be down before the impact becomes unacceptable.

Recovery time objective. The target time to resume an activity or recover a system, always shorter than the tolerable period.

Recovery point objective. How much data, measured in time, you can afford to lose: a nightly backup means up to a day.

A hospital’s patient system and its staff canteen menu clearly sit at opposite ends. Writing the numbers down for each system is what lets you spend on resilience where it counts, and not elsewhere.

What the plan contains

• Roles: who declares an incident, who leads recovery, and their deputies.
• Contacts: staff, suppliers, internet providers and support contracts.
• Recovery order for systems, with steps and expected times.
• Manual fallbacks for each critical activity, such as paper forms, offline price lists or a second site.
• Communication: what staff, customers and regulators are told, and by whom.
• Where things are: backups, credentials, documentation and spare equipment.

Regulated institutions

Institutions supervised by the National Bank of Rwanda are covered by its Regulation No 43/2022 on business continuity management and operational resilience, which replaced an earlier banks-only rule and requires a continuity team and a board-approved plan. Its cyber security regulation, No 50/2022, also expects tested recovery. We’re not lawyers, so we support the technical recovery side and leave compliance judgements to your risk and legal advisers.

What the work involves

1. Interview management and department heads about critical activities.
2. Analyse impact and agree recovery targets for each system.
3. Check reality: can current backups, hardware and connectivity meet those targets?
4. Write the plan, short and specific.
5. Test it with a tabletop exercise and, where possible, a technical restore.
6. Fix gaps the test revealed, and set the review date.

What’s included and what’s not

Typical timelines and what drives cost

An initial plan for a single site typically takes one to two weeks, including interviews and a tabletop exercise. Cost is driven by the number of critical systems and sites, how much needs to be established from scratch, whether a technical restore drill is included and any regulatory format the plan must follow.

Common mistakes we see

Treating backups as the whole plan. A plan written by one person and known only to them. Recovery targets nobody agreed to. No manual fallback for the activities that matter most. Contact lists that are years out of date. And a plan that has never been tested, so the first drill is a real outage.