The plan can exist and the priority can still be missing
For APS Judgment, the error is arriving at the disruption without a priority that is justified, workable, approved, and known by the people who must carry it out. A continuity plan organizes the response. Recovery priority is a separate decision, and it can wait until the operation has already stopped.
That day, the meeting divides attention among whoever is in the room. People, a contractor, a corridor, and a system compete. Without a known priority, what feels urgent displaces what the organization needed to resume.
ISO/TS 22317:2021, confirmed in 2025, supports that sequence. The organization should close one cycle of business impact analysis before choosing continuity strategies. The result that matters is a justified statement of priorities approved by leadership.
Three decisions left for later
The first is which products and services resume before the rest. Without that list, the crisis rewards whatever makes the most noise. The guidance asks to start with what the organization delivers, including internal services of a strategic nature, and only then identify activities, resources, and dependencies. What comes first is whatever a prioritized product depends on.
The second is keeping two time frames apart. One marks when the harm to the product ceases to be acceptable: the maximum tolerable period of disruption. The other is the moment at which the organization intends to resume the activity. Folding them into a single figure hides whether any margin remains. That margin is part of the approval.
The guidance also asks that delivery return within a set time and at a defined capacity. Partial resumption, in a hypothetical example, can mean dispatching only the orders under a contract that cannot wait, with one shift and one dock, while receiving and the other orders stay stopped. It does not describe a real operation: it shows that coming back can be less than a normal day's volume.
The third is stating what can wait. Without that exclusion, everything looks urgent and the prioritized activity falls behind something that could have been deferred.
The guidance itself describes a bias: some areas overstate their requirements and others understate them. The list cannot be the sum of departmental requests. Someone has to lead the analysis, each activity needs an owner, and leadership has to approve. The impact types used for comparison are agreed beforehand: business objectives, financial effect, obligations, reputation, operations, the environment, and the health and safety of people.
The dependency the plan does not name
The intelligence in this decision sits in what the document does not name. A less visible dependency is whatever the prioritized activity cannot start without inside the time frame: the person who holds the access, the stretch of route, the data that must return to a usable state, the other activity this one waits on.
If incomplete, confidential, or withheld information is used to postpone approval, the priority still does not exist on the day of the disruption. The guidance asks for quality and timeliness to be balanced: record the gap and close with what is already known.
Context also changes the conditions of that priority. A calendar review falls short if the corridor changed, a supplier became a single point of dependence, or an exposure can cut access, energy, or people. The 2024 amendment to ISO 22301 asks the organization to determine whether climate change is a relevant issue. When it is, it can change the resources, the time frames, or the means of meeting them even if the sequence of products stays the same. It can also change what resumes first. If it already alters one of those conditions and is filed as a note on context, the approved priority is out of date.
When the disruption is digital, the gap is similar. The NIST Cybersecurity Framework 2.0 calls for recovery actions to be selected and prioritized, and for critical mission functions to be considered. That consideration works if the priorities are already approved and the people recovering know them. Otherwise the response has to build them during the incident.
What leadership signs
Approval leaves the priorities justified, workable, and known by the people who carry them out.
- Which products and services resume first, and which less visible dependency blocks each prioritized activity.
- From what moment the harm is unacceptable, what time frame is proposed, and what margin remains between the two.
- What minimum capacity is acceptable, to what state information returns, and what resources that time frame requires: people, sites, suppliers, data.
- What can wait.
- What information was missing and was recorded.
- What change in context would require a review of resources, time frames, solutions, or the priority itself.
Those priorities guide the response. During the incident they can be adjusted to what actually happened, especially if people's safety is at stake. The adjustment starts from a known priority.
Methodological note
Research cutoff: 19 October 2026. ISO/TS 22317:2021 was confirmed on 8 October 2025. The text used is the public preview of that guidance, which is paid in full: the cycle before strategy selection, the priority of products and services, the two time frames, defined capacity, the bias across areas, and the balance between quality and timeliness. ISO 22301:2019 remains published and is under revision; the committee draft of the third edition closed its comments on 10 May 2026. The February 2024 climate amendment adds the requirement to determine whether climate change is relevant and a note on interested-party requirements. The time frames are used in the sense of the 2021 guidance; the 2025 vocabulary was not checked term by term. Meeting the time frame is a later decision. A sector or a contract may require shorter times. The dock example is hypothetical. This text does not describe a client.
The decision
If the plan exists and the priority does not, the disruption allocates attention. A priority that is approved, and known by the people who carry it out, settles that allocation beforehand and can still be adjusted when people's safety requires it.
Talk with APS about how to apply these criteria to your operation.