Municipal business continuity: a guide for Belgium

A municipality does not only manage crises that hit its residents. It must also keep serving them when it is hit itself: a cyberattack, an IT outage, a building that cannot be used, part of the staff unavailable, a supplier that fails. That is the purpose of a business continuity plan for municipal services.

This guide walks through the steps. It does not replace an official template: we found no public Belgian template for a municipal business continuity plan or business impact analysis.

Emergency plan and continuity plan work together

The general emergency and intervention plan (PGUI) organises the protection of the public during an emergency on the territory. The business continuity plan keeps the services of the municipality and of its public social welfare centre (CPAS in French, OCMW in Dutch) running when their own resources are affected.

The two meet. During a crisis, the municipality has to function in order to manage it: crisis centre, communication, reception of evacuated people. The royal decree of 22 May 2019 also asks the authority to assess the socio-economic effects of its decisions and to prepare recovery. And for entities within the scope of NIS2, the Belgian law of 26 April 2024 explicitly lists business continuity, backup management, disaster recovery and crisis management among the minimum cybersecurity measures.

Identify critical services

A service is critical if stopping it quickly causes serious harm: to a person, to meeting a legal deadline, to finances or to residents' trust. In a municipality, the list often includes:

Civil registry and population: birth and death registrations, identity documents, registers.
Payroll for the staff of the municipality and the CPAS/OCMW.
Social welfare (CPAS/OCMW): urgent social assistance, payment of benefits, services for elderly or isolated people.
Roads and public works: road safety, signage, urgent work on public land.
Reception, at the counter and by phone, which directs residents and passes on information.
Support functions that everything else depends on: IT, telephony, buildings, finance.

Each municipality adapts this list to its own remit: schools, childcare, care homes, cemeteries, water or waste where it runs them itself.

Run the business impact analysis (BIA)

The business impact analysis (BIA) answers a simple question: what happens if this service stops for an hour, a day, a week? It is done with heads of department, not only with IT.

For each activity, record:

the impacts over time: human, legal, financial, social, reputational;
the maximum tolerable period of disruption, beyond which the damage becomes unacceptable;
the RTO (recovery time objective), the target time to resume the activity, shorter than that maximum;
the RPO (recovery point objective), the maximum amount of data you accept to lose, expressed in time: for example, the last four hours of input;
the minimum service level to provide in degraded mode;
the dependencies: people and skills, applications, data, premises, equipment, suppliers.

The result is a list of activities ranked by priority, with their recovery times. It then underpins the IT recovery plan, the contracts and the exercises.

Choose continuity strategies

For each critical dependency, the municipality plans a fallback:

Premises: a fallback site chosen in advance (another municipal building, a CPAS/OCMW building, an agreement with a neighbouring municipality), equipped for work.
People: named deputies, cross-trained staff, written procedures so that a colleague can take over a task.
Degraded mode: paper forms, temporary registers, printed contact lists, to keep going for a few days without IT.
Critical suppliers: software vendors, hosting providers, the IT provider or inter-municipal company, the payroll bureau, telecoms, energy. The contract sets recovery times, backups, return of data and a contact person reachable during a crisis.

The IT recovery plan

The IT recovery plan describes how applications and data are brought back into service, in the order set by the BIA. It includes:

an inventory of applications and data with their owners, including what a supplier hosts;
regular backups, with at least one copy kept off the network so that an attacker cannot encrypt or delete it;
real restore tests, not just a check that the backup job ran;
the restart order, the target times (RTO, RPO) and the people to call on;
emergency access (administrator accounts, keys) kept outside the main system.

Prepare for a cyber incident

A cyberattack can take down email, files and telephony at the same time. Prepare the response in calm conditions:

an escalation procedure: who confirms the incident, who decides to isolate systems, who informs senior management and the municipal executive;
external contacts: IT provider, insurer, information security adviser, data protection officer;
notifications: personal data breaches under the GDPR and, for entities within the scope of NIS2, an early warning to the national CSIRT within 24 hours followed by an incident notification within 72 hours;
regional support: in Flanders, the Flemish Centre for Digital Security (Vlaams Centrum voor Digitale Veiligheid) supports and coordinates the response to cyber incidents at local authorities; in Wallonia, the association of Walloon municipalities (UVCW) mentions a Walloon Cyber Response Team set up by the Digital Agency (Agence du Numérique) with the Centre for Cybersecurity Belgium.

To find out whether your municipality falls under NIS2, see our guide NIS2 and Belgian local authorities.

Organise crisis communication

Internal and external crisis communication is part of the plan. Agree how to reach staff when email is down, who speaks for the municipality, and which channels will inform residents: website, social media, posters, service counters. Template messages written in advance save valuable time. If a phase of the PGUI is declared, this communication follows discipline 5.

Test the plan and keep it alive

A continuity plan that has never been exercised remains theory. A few simple habits:

one tabletop exercise a year, for example on a cyberattack scenario;
a restore test of a critical application;
a test of the fallback site and the call tree;
an update after every exercise, incident or reorganisation.

ISO 22301 as a reference

The international standard ISO 22301 describes a business continuity management system: context, leadership commitment, impact and risk analysis, strategies, plans, exercises, evaluation and improvement. Municipalities are not required to follow it. It does offer a useful structure for building a continuity plan and keeping it alive, without any need to seek formal recognition.

Checklist

Management has named an owner for the plan and set its scope (municipality, CPAS/OCMW, municipal companies).
Critical services and their dependencies are mapped.
The BIA sets an RTO, an RPO and a minimum service level for each activity.
A fallback site and degraded-mode procedures exist.
Contracts with critical suppliers cover recovery and return of data.
The IT recovery plan is written and a restore was tested this year.
One backup copy is kept off the network.
The cyber incident procedure and emergency contacts also exist on paper.
Crisis communication templates are ready.
An exercise took place in the last twelve months.