Business Continuity Planning and Program Support
Perry Group Consulting helps Canadian municipalities build business continuity programs that actually work when something goes wrong. We focus on the structure, ownership, and tools that keep plans current, tested, and usable across your organization.
Our work reduces risk, improves organizational resilience, and gives leadership real visibility into preparedness. Whether you need to assess where you stand, build a program from scratch, or move your existing plans off spreadsheets and into a managed platform, we bring deep municipal experience to every engagement.
Our Services
No two municipalities are in the same place with business continuity. Some have never had a formal program. Some have a plan sitting in a folder that nobody updates. Some have a solid program but are managing it in spreadsheets and need a better way. We offer three types of support depending on where you are starting: a focused assessment to understand your current gaps, full program development to build or rebuild your BCP, and encasedIT for ongoing program management.
BCP Program Assessment
A structured review of your current business continuity posture, identifying gaps in ownership, documentation, recovery targets, and departmental readiness before those gaps become problems.
Best for: Municipalities that have a continuity plan but are not confident it would hold up in a real incident, or organizations that have never formally assessed their BCP maturity and want an honest starting point before committing to a larger program.
Deliverables:
Current state assessment of your BCP program against established municipal benchmarks
Gap analysis identifying weaknesses in ownership, documentation, recovery targets, and departmental coverage
Prioritized recommendations with a practical path forward based on your size, capacity, and risk profile
Full Program Development
A structured, organization-wide effort to build or rebuild your business continuity program, with genuine business ownership, validated recovery targets, and plans that departments can actually maintain.
Best for: Municipalities that do not have an active BCP, whose existing plan lives in a spreadsheet no one updates, or where IT has been handed sole ownership of a program that needs to be driven by the business.
Deliverables:
Business Impact Analysis facilitated with department leads to identify critical services, realistic Recovery Time Objectives, and key dependencies
Departmental continuity plans with clear ownership, recovery procedures, and contact information validated at the department level
IT disaster recovery alignment connecting your technology recovery capabilities to the business services that depend on them
Tabletop exercise to test the plan and surface gaps before an actual incident does
Governance model defining program ownership, annual maintenance responsibilities, and funding structure
Ongoing Program Management and encasedIT
A managed approach to business continuity that replaces static documents with a live, structured platform. encasedIT gives municipal IT leaders a single place to manage continuity planning, cybersecurity, and IT strategy so plans stay current without requiring a painful annual overhaul.
Best for: Municipalities that have built a continuity program and want to move it off spreadsheets and SharePoint into a managed platform, or organizations implementing BCP for the first time who want structure from day one.
Deliverables:
Application and system catalog mapping every technology to the business services that depend on it
Automated RTO calculation using validated frameworks, with business units owning the inputs
Departmental mini-BCPs so each area manages their own plan within a shared platform
Executive dashboards and scorecards giving leadership real visibility into organizational readiness
Recovery playbook builder that pulls directly from your system catalog
Tabletop exercise module with downloadable reports
NIST 2.0 aligned cybersecurity assessments built in
Cloud-based and fully browser-based, accessible during the exact disruption it is designed to address
What encasedIT does
Application and System Catalog Every technology your municipality runs is mapped to the business services that depend on it. When something goes down, you can see immediately what is affected and in what order recovery needs to happen. No guesswork. No scrambling to figure out dependencies during an incident.
Automated RTO Calculation Recovery Time Objectives are calculated using validated frameworks, with business units providing the inputs rather than IT estimating on their behalf. When departments understand the real trade-offs, RTOs become realistic. Costs come down. Plans reflect what your organization can actually deliver.
Departmental Mini-BCPs Each department manages their own continuity plan within the platform, aligned to corporate goals and connected to the broader program. Updates take two to three hours per department per year, not a painful annual overhaul that nobody has time for.
Executive Dashboards and Scorecards Leadership gets a live view of organizational readiness. Not a verbal assurance. Not a PDF that may or may not be current. A dashboard that shows where the program stands, what has been tested, and where attention is needed.
Recovery Playbook Builder Playbooks are generated directly from your system catalog, so they are always accurate and current. When something goes wrong, staff are not working from a document that was written three years ago by someone who has since left.
Tabletop Exercise Module Structured simulations with downloadable reports so your organization can test plans, identify gaps, and improve on a regular cycle rather than treating exercises as a one-time event.
NIST 2.0 Cybersecurity Assessments Continuity planning and cybersecurity are managed together in one platform. The built-in assessment framework is aligned to NIST 2.0, giving you a structured way to benchmark your security posture alongside your BCP program.
IT Strategic Plan Management Built on Perry Group's Municipal Technology Model, encasedIT also supports IT strategic planning, roadmap management, and maturity tracking. Municipalities use it to manage their full IT program in one place, not just their BCP.
“The City of Guelph began its Business Continuity Program with Perry Group approximately two years ago. encasedIT was implemented city-wide across all divisions, and the results have been exceptional. Our city is more resilient and better prepared, with plans in place specific to each division from Emergency Services to Public Works and Corporate Services. The feedback from staff across our corporate structure has been overwhelmingly positive.”
LEARN ABOUT ENCASEDIT
BCDR: Beyond the Backup
Learn the essential steps to move from ad-hoc disaster recovery to a mature, high-availability posture.
ISO 22301: Measure Success
Benchmark your BCM capabilities and identify critical gaps with our interactive maturity assessment tool.
ITSP: Drive Digital Growth
Stop managing spreadsheets and start managing strategy. Align IT spending with your organization's biggest goals.
FAQs
What is business continuity planning for municipalities?
1
Business continuity planning (BCP) for municipalities is the process of identifying critical services, defining how those services will be maintained or restored during a disruption, and putting plans in place that departments can actually follow. It covers a wide range of disruptions including ransomware attacks, natural disasters, facility outages, and supply chain failures. Effective municipal BCP programs assign ownership to business units, define realistic Recovery Time Objectives, and are tested and maintained on a regular basis rather than built once and forgotten.
The most common reason is time. In a recent webinar poll, 77% of municipal leaders cited not enough time as their biggest barrier to maintaining their BCP. The second reason is format. When plans live in Word documents, PDFs, or spreadsheets, updating them is painful enough that it rarely happens. Contacts go stale, recovery priorities are never revalidated with business units, and plans drift further from reality every year. Structured platforms like encasedIT are specifically designed to address this by making maintenance manageable rather than overwhelming.
Why do so many municipalities not have an up-to-date business continuity plan?
2
Business continuity planning should be led by business units, with IT as a critical partner on the disaster recovery side. IT cannot define Recovery Time Objectives for services they do not deliver. The most effective municipal BCP programs Perry Group has seen assign departmental ownership to each continuity plan, with Emergency Management or a designated BCP coordinator leading the overall program and IT responsible for the technology recovery components.
Who should own business continuity planning in a municipality?
3
What is the difference between business continuity planning and IT disaster recovery?
4
Disaster recovery is a subset of business continuity planning. IT disaster recovery focuses specifically on restoring systems, infrastructure, and data after a disruption. Business continuity planning is broader and covers how the entire organization keeps delivering services during and after a disruption, including non-IT functions like facilities, staffing, communications, and vendor dependencies. The two need to be aligned, which means IT recovery targets should be driven by business recovery requirements, not set by IT independently.
A Recovery Time Objective (RTO) is the maximum amount of time a service or system can be offline before the impact becomes unacceptable. RTOs for municipal services should be set by the business units that deliver those services, not by IT. A structured Business Impact Analysis facilitated with department leads is the most effective way to define realistic RTOs. When departments understand the cost implications of shorter recovery windows, they often find that a three or seven day RTO is more appropriate than the 24-hour target they initially assumed they needed.
What is a Recovery Time Objective and how is it set for municipal services?
5
BC's Emergency and Disaster Management Act is the most prominent current example, pushing British Columbia municipalities toward mandatory business continuity planning. Other provinces are moving in the same direction. Beyond legislation, cyber insurers and provincial oversight bodies are increasingly requiring evidence of BCP maturity as a condition of coverage or infrastructure funding. Municipalities across Canada should treat BCP as an ongoing program requirement rather than waiting for legislation to make it mandatory in their province.
What legislation requires municipalities in Canada to have a business continuity plan?
6
encasedIT is a cloud-based management platform developed by Perry Group Consulting in partnership with WG Advisory. It gives municipal IT leaders a single place to build, maintain, and report on their business continuity program, cybersecurity posture, and IT strategy. Key capabilities include an application and system catalog that maps technology to critical business services, automated RTO calculation, departmental mini-BCPs, executive dashboards, recovery playbook generation, tabletop exercise support, and NIST 2.0 aligned cybersecurity assessments. It runs on an unlimited-use enterprise license and is fully browser-based, meaning it is accessible during the exact kind of disruption it is designed to address.
What is encasedIT and how does it help municipalities with business continuity planning?
7
Yes. encasedIT is specifically designed to make BCP maintenance manageable for smaller teams. Departments typically spend two to three hours per year on updates rather than a resource-intensive annual overhaul. Several smaller municipalities have also entered into shared services agreements through Perry Group, pooling resources and sharing knowledge across a region to make the investment more practical.
Can small municipalities afford and maintain a business continuity program?
8
How much does encasedIT cost for a municipality?
9
encasedIT runs on an unlimited-use enterprise license, meaning pricing does not scale with the number of users or departments. Everyone who needs access has it. Pricing is based on the size of your organization. Contact Perry Group Consulting for a quote and a platform demo.
How long does it take to build a municipal business continuity program?
10
A BCP Program Assessment typically takes four to six weeks. Full program development, including Business Impact Analysis, departmental continuity plans, IT disaster recovery alignment, and a tabletop exercise, typically runs three to five months. Implementing encasedIT as the ongoing management platform usually takes a few weeks and is often aligned with the program development timeline. Perry Group provides implementation support, training, and ongoing advisory throughout the process.