An alternate office or warehouse can look adequate on a property list and be unusable when the primary site is damaged. There may be power and desks but no approved storage, controlled network, safe equipment access or process records. A temporary site is not simply somewhere employees can gather: it must support a defined minimum service under the organization’s applicable safety, legal, information-security and product requirements. Preparing one demands practical inspection and readiness evidence long before an incident forces relocation.
01Specify the services the alternate site must support
Trace each priority activity to its minimum location-dependent requirements. Customer support may need secure voice channels and access to contract details; manufacturing may need ventilation, process utilities and inspection equipment; a laboratory may need environmental control and defined sample custody. Do not describe the substitute location only by square metres or workstation count. Specify the actual safe and accepted outputs.
Use the BIA and service recovery priorities to determine how much capability is needed, how quickly and for how long. The alternative may not need to support every normal process, but its permitted scope must be clear. Record functions that cannot be safely relocated and create a different continuity strategy for them. An untested claim of complete site interchangeability creates dangerous optimism.
Output design. Specify which product or service the temporary location must actually deliver and at what minimum level. A site with enough desks may still lack a legal laboratory permit, appropriate material storage or a controlled customer information channel.
Technical context: ISO 22301:2019 — Business continuity management systems — Requirements (with Amd 1:2024) is one verified source for the concepts discussed here.
02Evaluate legal permission, safety and physical suitability
Check whether the location may lawfully host the proposed work, including permits, occupancy limits, fire protection, access arrangements and environmental controls where relevant. Inspect material handling routes, emergency exits, storage limits, safe isolation arrangements and appropriate facilities for the workforce. Applicable duties vary by jurisdiction and activity and must be confirmed by competent local specialists.
Consider local incident conditions. An alternate site chosen solely for short travel distance may face the same flood, power outage or transport restriction as the primary premises. Verify the likely access of staff, critical suppliers and emergency responders during the actual disruption scenarios in the plan. A facility readiness checklist must be supported by site visits or credible evidence, not simply an address in an agreement.
Premises assurance. Check building safety, access, utilities, environmental control and permitted use for the specific activity. Geographic proximity is not proof of independence. Verify whether the same disruption can close both locations and whether employees and suppliers can reach the substitute.
03Provide identity, data and communication capability
Ensure necessary users can authenticate, reach approved applications and communicate with essential parties without bypassing information security. Test network capacity, remote access, devices, printing, power supplies and identity services under the anticipated concurrent load. A spare laptop is not operational continuity when its certificates, encryption credentials or approved business software are missing.
Plan for restricted information and document custody at a temporary location. Privacy and security requirements continue to apply even if staff are working from a borrowed office. Define who can access retained data, where printed records are stored and how devices are returned or wiped after the move. Temporary convenience must not create a permanent uncontrolled archive.
ICT authentication. Test real user roles, devices, voice channels and applications under expected concurrent demand. A spare network connection does not solve invalid credentials or missing certificates. Keep confidential data and temporary printing under appropriate controls at the alternate site.
04Validate supplier, equipment and logistics interfaces
List the deliveries, consumables, calibration services, cleaning, security, waste handling and other inputs required for the minimum activity. Verify addresses, receiving procedures and supplier lead times for the alternative location. Some contracts cover only named premises or particular equipment; do not assume the provider will automatically extend its normal obligations to a substitute site.
Test installation and start-up steps for critical equipment. Where the process needs specialized tools, confirm ownership, transport, insurance, safe assembly, calibration and competency requirements. Define a route for rejected materials and waste. A service can appear ready during a tabletop but fail when the first inbound shipment arrives at a loading dock with no authorized receiving team.
Supplier readiness. Confirm delivery addresses, receiving rules, specialist maintenance and supply contracts for the alternate location. Providers may have different lead times or legal restrictions at a substitute site. An inbound delivery test can reveal a missing authorization that a location checklist overlooks.
05Make essential instructions and evidence available at the new point of use
Employees need controlled operational instructions, current customer requirements, emergency contacts and the records needed to make decisions. Determine which information must be available offline and which can be securely accessed through alternate systems. Make versions and permissions explicit, especially where different sites use locally adapted procedures.
Plan how temporary output will be recorded and later reconciled. If approved paper forms replace digital records, specify their required fields and storage responsibility. When work returns to the original site, prevent duplicate transactions and retire obsolete temporary instructions. Information availability should be treated as a facility readiness criterion rather than an IT detail to resolve after occupancy.
Document access. Ensure current work instructions, customer requirements and controlled records exist at the alternate point of use. Plan offline sources and their version controls. Decide how emergency output is captured and later returned to normal repositories without creating duplicate work.
| Decision domain | Owner or objective | Observable evidence |
|---|---|---|
| Site scope | Process owner | Priority work supported |
| Safety | Facilities and EHS | Permits and site inspection |
| ICT | Technology owner | Access and transaction test |
| Closure | Site and quality manager | Return and reconciliation record |
06Exercise mobilization and first productive output
A useful readiness exercise measures more than travel and building access. Ask a representative team to move through activation, user authentication, receipt of inputs, execution of one priority activity, quality or safety checks, and delivery of accepted output. Identify which activities were simulated and which were genuinely performed. Observe delayed permissions, unavailable supplies and handover failures.
Test the limit of endurance, not only the first hour. Consider staff accommodation, fatigue, transport, waste handling and supply replenishment for a prolonged event. Record current usable capacity and the assumptions that would cause it to degrade. The site owner should be able to demonstrate that the location remains suitable as conditions and workloads change.
First productive output. Test a complete priority transaction from mobilization through acceptance, not only entry to the building. Include the workforce, utilities and supplier handoffs needed over a sustained outage. Record where capabilities were simulated rather than demonstrated.
07Set a formal readiness and closure decision
Before an alternate facility is labeled ready, require the responsible functions to accept documented risks and verify essential controls. Agree who has authority to activate it, what triggers relocation and who may pause activity when local conditions are unsafe. Residual gaps should be visible to leadership and matched with provisional safeguards or a different recovery option.
Design the return process at the same time: records, stock, devices, temporary access rights, building security and unresolved customer work must move back under control. A completed relocation is not measured by occupancy alone. It is proven when the minimum service can be delivered safely, with evidence and defined authority, from the substitute location.
Ready status. Require cross-functional acceptance of the site’s allowed scope and residual gaps. A partially ready alternative may support only certain services; the plan must not call it a complete substitute. Document how devices, records and temporary permissions will be closed after return.
Practical Review Questions
- Which priority service can the alternate location actually deliver?
- Are permissions, safety, occupancy and process conditions validated?
- Have supplier deliveries and first productive output been exercised?
- How will records, access and stock be controlled on return?
Prove a Temporary Location Through a First Accepted Output
Prepare a short readiness assessment that begins with the actual service assigned to the alternate location. Identify occupancy and safety requirements, essential utilities, protected information, authorized people, supplier deliveries and equipment validation. Separate requirements already demonstrated from assumptions still awaiting a test. Ensure the alternative site is not exposed to the same hazard or shared ICT dependency that defeats the primary premises.
Run a small mobilization exercise from activation to an accepted customer output. Verify that staff can enter safely, authenticate, use current instructions, receive materials, execute required checks and record the outcome. Document any simulated steps and remaining restrictions. Design return arrangements for devices, physical records, stock and temporary access before the location is declared ready.
Closing Perspective
An alternate site becomes a recovery capability when it can legally, safely and reliably perform the specific priority work assigned to it—not when keys and chairs are available.
References & Further Reading
Official ISO publications informing the continuity method discussed above. Guidance publications provide recommendations; ISO 22301 contains BCMS requirements. The organization must validate any sector-specific legal duties separately.
- ISO 22301:2019 — Business continuity management systems — Requirements (with Amd 1:2024)
- ISO/TS 22331:2018 — Guidelines for business continuity strategy
- ISO 22313:2020 — Guidance on the use of ISO 22301
- ISO/TS 22330:2018 — People aspects of business continuity
- ISO/IEC 27031:2025 — ICT readiness for business continuity