A business continuity question is not asking whether your organisation owns a policy document. NHS evaluators want to know what will happen if critical employees, systems, premises, equipment or suppliers suddenly become unavailable.
Your response must show that you understand the services that cannot stop, the patients and teams that could be affected, and the controls required to maintain safe delivery. It should also demonstrate that recovery arrangements have been tested rather than written around an ideal scenario.
Why Service Resilience Matters to NHS Buyers
NHS services operate through interconnected clinical, operational and supply-chain relationships. Disruption involving one provider can affect patient pathways, clinical capacity, waiting lists and the work of several other organisations.
The current NHS Emergency Preparedness, Resilience and Response assurance process requires NHS organisations and relevant providers of NHS-funded services to assess their compliance with applicable EPRR core standards. The findings should inform improvement plans and local resilience priorities.
Your exact tender requirements will still depend on the contract. A software provider may need to concentrate on hosting, cyber incidents and data recovery. A clinical service provider could be assessed on safe staffing and patient pathways, while a medical supplier may need to evidence stock, logistics and alternative products.
The buyer is looking for a proportionate response to the risks created by your service.
Business Continuity, Disaster Recovery and EPRR
These terms are closely connected, but they do not mean exactly the same thing.
| Term | Main focus |
| Business continuity | Maintaining priority services during disruption |
| Disaster recovery | Restoring technology, data, premises or infrastructure |
| Operational resilience | Absorbing disruption and adapting while important services continue |
| EPRR | Wider NHS arrangements for emergencies, major incidents and continuity |
| Contingency plan | A defined response to a particular risk or scenario |
A disaster recovery plan might explain how a platform will be restored following an outage. The wider continuity response must also address temporary working arrangements, staff availability, communication and any effect on patients.
The NHS England Business Continuity Management Toolkit uses a Plan, Do, Check, Act approach. It covers establishing a business continuity management system, defining requirements, testing arrangements and implementing corrective action.
This is a useful model for tender responses. Evaluators need to see how you identify critical services, implement controls, test performance and improve the plan.
Start With the Critical Service
Many weak responses begin with a long list of risks. A stronger approach starts by identifying what must be protected. For each critical activity, establish:
- Who depends on the service
- The effect of disruption
- The minimum acceptable service level
- Critical staff and competencies
- Systems and information required
- Essential equipment and premises
- Reliance on suppliers or subcontractors
- Maximum tolerable disruption
- Recovery priorities
- Communication requirements
Consider a diagnostic provider whose booking platform becomes unavailable. The continuity requirement is not simply to restore the software. The provider may also need to protect urgent referrals, preserve appointment information, operate a temporary booking process and keep patients and NHS teams informed.
This is why a contract-specific business impact analysis is more persuasive than attaching a generic corporate continuity plan.
Plan for Realistic Disruption Scenarios
Prioritise scenarios that could materially affect the proposed NHS service. These may include:
- Workforce absence
- A cyber attack or system outage
- Loss of premises
- Utilities failure
- Equipment breakdown
- Supply shortages
- Failure of a critical subcontractor
- Transport disruption
- Extreme weather
- Demand surges
- Infectious disease outbreaks
- Financial distress
- Loss of an essential accreditation
For each material risk, explain:
- The preventative controls.
- How the disruption will be detected.
- Who can activate the response.
- The temporary service arrangements.
- How stakeholders will be informed.
- The recovery process.
- How normal delivery will resume.
- How lessons will be recorded.
Avoid claiming that every disruption can be prevented. NHS buyers are more likely to trust a supplier that recognises credible risks and shows how they will be controlled.
Protect Workforce Capacity
Staffing is a critical dependency across clinical, technical and operational NHS services. A strong response may need to cover:
- Minimum safe staffing
- Critical roles and competencies
- Cross-training
- Reserve or bank workers
- On-call arrangements
- Absence monitoring
- Succession planning
- Agency controls
- Redeployment
- Recruitment pipelines
- Staff welfare during prolonged incidents
Commitments around capacity and waiting times are more convincing when the bid explains what happens if referrals rise or workforce availability falls outside the original forecast.
Distinguish normal capacity management from emergency contingencies. Regular reliance on agency cover or overtime may not demonstrate a resilient core workforce. Where staff will be redeployed, explain how competency and service safety will be protected. Moving an available employee into a specialist role is not a credible contingency unless that person is trained and authorised to perform it.
Evidence Technology and Data Recovery
Digital dependency is now central to NHS resilience. The NHS England EPRR update for 2026/27 highlights continued work across cyber resilience, digital services, infrastructure and workforce preparedness.
Depending on the contract, your answer may need to address:
- System availability targets
- Hosting resilience
- Backups
- Failover
- Recovery time objectives
- Recovery point objectives
- Data restoration
- Manual workarounds
- Alternative communication methods
- Cyber incident response
- Technical support
- Prioritisation of critical functions
A recovery time objective defines how quickly a service should be restored. A recovery point objective defines the maximum acceptable period of data loss. Do not simply state that backups are completed every day. Explain where they are stored, how they are protected and when restoration was last tested. Manual workarounds also need detail. State what information they require, who activates them, how records will later be reconciled and how long the temporary process can operate safely.
Include Delivery Partners and Critical Suppliers
Your continuity arrangements are only as strong as the organisations and resources on which the service depends.
Identify:
- Critical suppliers
- Single-source products
- Geographic concentrations
- Long lead-time items
- Minimum stock levels
- Alternative suppliers or products
- Supplier-monitoring arrangements
- Contractual continuity obligations
- Escalation routes
- Replacement arrangements
Where delivery partners provide clinical capacity, logistics, technology or specialist services, they should appear within the same continuity model as the lead bidder.
The buyer should not have to work out which organisation will coordinate the response. The lead supplier must retain visible accountability, even where a subcontractor caused the disruption.
NHS England has published a defined process for reporting potential supply disruptions involving medical equipment and consumables. The guidance sets out escalation routes involving trusts, integrated care boards, procurement teams and regional EPRR functions.
Suppliers should understand how their own incident communication would support the buyer’s wider escalation responsibilities.
Explain Governance and Communication
An escalation plan needs more than a list of telephone numbers.
Your response should identify:
- Who can activate the continuity plan
- Incident management roles
- Clinical and operational leadership
- Decision-making authority
- Severity levels
- Escalation thresholds
- NHS contacts
- Reporting frequency
- Patient or service-user communication
- Regulatory notifications
- Stand-down authority
Effective supplier relationship management provides the governance and communication rhythm needed to identify emerging risks before they become major service failures.
Show how continuity risks will feature within normal contract meetings, performance reports and risk registers. The buyer should not first hear about a critical dependency when it fails.
Communication arrangements should reflect the incident. A short interruption may require operational updates, while a prolonged clinical disruption could involve commissioners, patients, regulators and partner organisations.
Give Measurable Recovery Commitments
Avoid phrases such as:
- “The service will be restored quickly.”
- “We have robust contingencies.”
- “Alternative staff will be available.”
- “There will be no impact on patients.”
These statements provide no basis for evaluation.
A more useful answer might state:
Within 30 minutes of a priority system outage, our Incident Manager will activate the continuity procedure. Urgent referrals will move to the secure manual process while the technical team initiates failover. We will update the trust every hour until normal service is restored.
This gives the evaluator:
- A trigger
- A named owner
- An activation time
- A temporary process
- A recovery action
- A communication interval
Use measurable commitments wherever the evidence supports them. These could include minimum service levels, stock cover, response times, alternative capacity and recovery targets.
Make sure they are realistic. An impressive but unachievable recovery time can create contractual risk after award.
Prove That the Plan Has Been Tested
A continuity plan that has never been tested provides limited assurance. The NHS toolkit includes testing and review resources covering scenarios such as reduced staffing and disruption involving services or suppliers. It also encourages organisations to measure performance, identify gaps and take corrective action.
Useful evidence may include:
- Exercise dates
- Scenarios tested
- Teams involved
- Activation performance
- Recovery results
- Problems identified
- Corrective actions
- Retesting
- Senior approval
- Lessons from real incidents
Testing could involve desktop exercises, system failover, data restoration, call-tree checks, reduced staffing or loss of a critical supplier.
Do not stop at confirming that an exercise took place. Explain what it revealed and what changed afterwards.
Use Evidence That Matches Your NHS Experience
New NHS Suppliers
New NHS suppliers may not have evidence from a live NHS contract, but they can draw on comparable regulated, healthcare or critical-service environments. Explain why the experience is transferable. Relevant evidence might include tested recovery plans, audit results, incident examples and performance against agreed recovery targets.
Named team members with NHS experience can add confidence, but their CVs should not replace evidence of organisational readiness.
Incumbent Providers
Incumbent providers should use real contract performance. Show what happened during service disruptions, how quickly delivery recovered and what was learned. Evidence could include availability results, missed activity, commissioner feedback and completed improvement actions.
Do not hide previous issues. A well-managed incident followed by measurable improvement can provide stronger evidence than a general claim that nothing has ever gone wrong.
Avoid Common Continuity Weaknesses
Common issues affecting NHS responses include:
- Attaching a generic continuity plan without explaining the contract
- Focusing only on IT disaster recovery
- Ignoring patient or service-user consequences
- Listing risks without showing controls
- Providing no minimum service level
- Leaving activation authority unclear
- Omitting suppliers and subcontractors
- Giving no evidence of testing
- Promising uninterrupted service in every scenario
- Using conflicting recovery times across answers
- Failing to connect continuity with mobilisation
- Describing lessons without showing what changed
A final review should compare the continuity answer with the staffing, implementation, cyber security, supply-chain and performance sections. The full submission must describe one consistent delivery model.
Build a Stronger NHS Resilience Response
NHS evaluators are not looking for a guarantee that disruption will never happen. They want confidence that the supplier understands its dependencies, can protect critical services and will recover through a controlled and tested process.
Bidding helps healthcare suppliers turn continuity plans, operational controls and specialist input into clear responses built around the evaluation criteria. We can support individual questions, review an internally prepared draft or coordinate a wider NHS submission.
Speak to Bidding about strengthening the business continuity and service resilience sections of your next NHS tender.
