Continuity for People and Premises

Continuity for people and premises asks how a service continues when the staff who run it, or the place they work from, are unavailable. The answer is rarely a single alternative office. It involves skills cover, secure access, safe working arrangements, and an honest view of what remote working can and cannot support. Under DORA in the EU, which applies from 17 January 2025, and under the separate UK regime in FCA PS21/3 and PRA PS6/21, people and premises are part of the wider resilience picture, and the regime should be labelled where a duty is cited. A service plan that only covers evacuation has answered a safety question, not a service question.

People are often the most fragile dependency, because knowledge is unevenly spread. A service may depend on a small group of specialists, on staff who hold particular permissions, or on individuals who understand an exception process that is poorly documented. Continuity planning should map those concentrations of knowledge and build cover through training, documentation and deputisation, before disruption forces improvisation. Cover is not simply a named deputy on a chart. The deputy needs the access, the practice and the authority to act, and those three things should be tested. A deputy who has never performed the task under pressure, or who cannot access the systems involved, is a name rather than a control.

Premises disruption takes many forms beyond a building closure. Transport disruption, a local power problem, a health event affecting a team, or a loss of access to a secure area can each remove people from their normal workplace. Alternative locations help only if they provide the connectivity, security, equipment and access that the service actually needs. A general office with internet access may be enough for some work, but not for work that requires secure terminals, specialist equipment, paper records held on site, or supervision arrangements that protect customers. Planners should therefore match each service step to the location conditions it requires, rather than assuming that any alternative location will do for every task.

Consider an illustrative customer contact service for a lender. If its main site is unavailable, staff might work from home or from another site, but they still need secure access to customer records, call recording, vulnerability handling procedures, and escalation routes. They also need a way to verify identity safely and to record decisions accurately. If remote working weakens any of those controls, the service may need to change what it offers for a time, for example by limiting the transactions it handles remotely and directing complex cases to a controlled route. That is a service decision, owned by the service owner, not a technology decision made by default because remote access happens to be available.

Wellbeing and stamina matter during prolonged disruption. Staff who work extended periods under pressure, cover unfamiliar work, or handle distressed customers without support will make more mistakes and may themselves become unavailable. Continuity plans should therefore include rotation, rest, clear shift handover, and a way for staff to raise concerns about workload or safety. Managers need a realistic view of how long an alternative arrangement can be sustained, and a plan for bringing in additional cover or reducing service scope if disruption continues. A plan that assumes the same small team can sustain an emergency arrangement indefinitely is not a plan; it is a hope that disruption will end soon.

Testing people and premises arrangements should go beyond a fire drill. A useful test moves a team, or part of a team, to its alternative arrangement and asks them to perform real service tasks with the access and tools they would have. That kind of test exposes problems that a discussion cannot: a permission that does not travel, a record that cannot be reached, a phone route that fails, or a process that only works when a particular colleague is present. Findings should change rotas, access, documentation or location arrangements, and the change should be owned. Over time, that testing builds confidence that is grounded in experience, rather than confidence grounded in the existence of a premises plan.