Most emergency plans answer the question “how do we respond to the disaster?” Continuity of operations planning answers a harder one: “how do we keep doing our own jobs while the disaster is happening to us?” I have spent 25 years in emergency management, including years writing continuity-relevant plans for a regional health system, and I can tell you that the organizations that struggle most in a crisis are rarely the ones without a response plan. They are the ones that never asked what happens when the disruption hits their own building, their own people, or their own payroll.

What Continuity of Operations Planning Really Is

Continuity of operations, usually shortened to COOP, is the planning discipline that keeps an organization’s essential functions running through any disruption. Not just the dramatic disasters. A fire in the records room. A ransomware attack that locks every workstation. A pandemic that keeps half the staff home for months. A burst pipe that closes city hall for six weeks. The sudden loss of the one person who knows how the water billing system actually works. COOP planning treats all of these the same way, because from the inside they all produce the same problem: you still owe the public your essential services, and something you depended on is gone.

This is different from emergency response planning, and the difference matters. Response planning is outward facing: how we help the community when something bad happens. Continuity planning is inward facing: how we keep our own organization functioning when something bad happens to us. The two overlap during a major disaster, but plenty of continuity events never trigger a disaster declaration at all. A cyberattack on a county finance department is not a FEMA incident. It is still a continuity event, and it can still stop paychecks, permits, and public safety dispatch just as effectively as a flood.

A useful way to frame COOP for elected officials and executives is this: it is the plan for delivering your legal obligations to the public under degraded conditions. Courts still have deadlines. Payroll is still due. Emergency dispatch cannot pause. Continuity planning is how you honor those obligations when the normal way of doing them is unavailable.

The Hard Discipline of Naming Essential Functions

The foundation of every continuity plan is a short list of essential functions: the things your organization must keep doing, or resume very quickly, no matter what. And here is the uncomfortable truth I have watched play out in planning meeting after planning meeting: the hardest part is not identifying what is essential. It is getting people to admit that most of what they do can pause.

Every department believes its work is essential, and in normal times that is true in the sense that it matters. But continuity planning asks a narrower question: if we could only do five things for the next two weeks, which five keep people safe, keep the organization legally functional, and keep the lights on? For a small city, that list usually looks something like:

• Public safety dispatch and response. This cannot pause for an hour, let alone a day.
• Water, wastewater, and other life safety utilities. Operations and emergency repair, not billing.
• Payroll. If people are not paid, your continuity plan has a shelf life of one pay period.
• Legally mandated deadlines. Court dates, statutory filings, benefit payments, required notices.
• Emergency public information. The ability to tell residents what is happening and what to do.

Notice what is not on that list: most permitting, most inspections, recreation programs, routine records requests, long-range planning. Those functions matter, and they resume as soon as capacity allows. But a continuity plan that tries to protect everything protects nothing, because it spreads scarce people, space, and systems across work that could have waited.

Who Acts When Leaders Are Unavailable

Two concepts sit at the legal heart of continuity planning, and they are simpler than their names suggest.

Orders of succession answer the question: who fills a position when the person holding it is unavailable? If the city manager is unreachable, incapacitated, or gone, who is acting city manager, and who is next after that? A workable order of succession is at least three deep, names positions rather than individuals, and is written down somewhere more official than tribal knowledge. “Everybody knows Dana would step up” is not a plan. Dana might be on the same flight, at the same conference, or in the same building as the person she is supposed to replace.

Delegations of authority answer a different question: what specific powers transfer, and what are their limits? Succession puts a person in the chair. Delegation defines what the chair can legally do. Can the acting official sign emergency contracts, and up to what dollar amount? Approve overtime? Order an evacuation? Release public statements? Without written delegations, an acting official either freezes because they are unsure of their authority, or acts and creates legal exposure for the organization. Both outcomes are avoidable with a page or two of plain language approved in calm times.

Three practical points from experience. First, check your state law and local charter, because succession for elected officials and certain statutory positions is often set by statute and your plan must match it. Second, keep succession documents current; a plan naming a deputy who retired four years ago is worse than no plan, because people will follow it. Third, brief the people in the order of succession. I have met more than one third-in-line official who learned of that fact during an exercise, which is the second worst possible time to learn it.

Alternate Facilities and Remote Work

Every continuity plan needs an answer to the question: where do we work if we cannot use our building? Traditionally that answer was an alternate facility, a pre-identified location with space, power, and connectivity where essential functions relocate. That is still a valid strategy, and for some functions it is the only one. You cannot dispatch 911 from a kitchen table without serious preparation, and functions that require secure records, specialized equipment, or walk-in public access need a physical fallback. Mutual agreements with neighboring jurisdictions, school districts, or community colleges are a common and affordable way to secure alternate space, provided the agreement is written, the space is actually surveyed, and someone verifies it has not been converted to storage since the plan was signed.

Then the pandemic rewrote part of this chapter, and we should be honest about the lessons. Organizations discovered that a large share of government work could be done remotely, which turned remote work into a legitimate continuity strategy rather than a perk. But we also learned its limits the hard way:

• Remote work only works if it is set up in advance. Agencies that already had laptops, remote access, and electronic workflows transitioned in days. Agencies that ran on desktops, paper files, and wet signatures lost weeks.
• Some functions never went remote. Utility operations, field response, evidence handling, in-person court functions. Pretending otherwise in a plan is fiction.
• Remote work has its own failure modes. It depends entirely on power, home internet, and cloud services. A regional power outage or ice storm takes down your remote workforce and your building at the same time. Remote work is a strategy against a building loss and an infectious disease event; it is weak against infrastructure failure.
• Capacity erodes. Licenses lapse, laptops get reclaimed, and the muscle memory fades. If remote work is in your plan, somebody has to keep it real.

The right answer for most organizations is a mix: remote work for functions that tolerate it, a physical alternate site for functions that do not, and written triggers for who decides which mode applies.

Vital Records and the Systems Behind Them

Vital records are the documents, data, and systems without which your essential functions stop. Not your archives, not everything worth keeping: the working set you must be able to reach within hours. For a typical local government that includes payroll and personnel data, the financial system, emergency plans and contact rosters, contracts and insurance policies, utility system maps and operating procedures, permits and legal records with active deadlines, and the credentials needed to administer all of the above.

Three disciplines keep vital records survivable. First, identify them by function: for each essential function, list what it must access and where that lives. Second, back them up somewhere the disaster cannot reach. A backup server in the same building as the primary is a fire away from being the same server. Offsite or cloud backup matters, and so does testing restoration, because an untested backup is a hope, not a plan. Ransomware has made this brutally concrete: attackers deliberately target backups, so at least one copy should be offline or otherwise isolated. Third, keep a paper fallback for the truly critical items. Printed contact rosters, printed succession orders, printed utility maps, and a manual payroll procedure sound old fashioned right up until the day every screen in the organization shows a ransom note. The organizations that ride out cyberattacks best are usually the ones that can run their top functions on paper for a week.

Devolution and Reconstitution, Explained Simply

Two more terms from the continuity vocabulary are worth demystifying, because both describe things small organizations already do informally.

Devolution is the plan for when your organization cannot perform its essential functions at all, even from an alternate site, even with successors in place. It answers: who else does this work until we can take it back? A neighboring county handles your dispatch. The state steps in for a function you cannot staff. A contracted firm runs payroll. Devolution feels uncomfortable to plan for because it means admitting your organization could be knocked out entirely, but for small agencies it is often the most realistic strategy. A three-person department does not have depth; it has neighbors. The keys are pre-negotiated agreements, transferred knowledge in written procedures the receiving organization can actually follow, and clarity about what triggers the handoff and what authority moves with it.

Reconstitution is the return trip: the planned process of resuming normal operations after the disruption ends. It sounds automatic and it is not. Someone has to decide when the original facility is safe, migrate work and records back without losing what happened during the disruption, take back functions that were devolved, catch up on everything that paused, and take care of a workforce that may be exhausted or grieving. Plans that end at “relocate and continue” leave the organization improvising its way home. Even a single page describing who declares reconstitution, in what phases functions return, and how deferred work gets triaged puts you ahead of most.

The Communications Dependency

Every element above depends on one capability: communications. A continuity plan with perfect succession orders and a fine alternate site still fails if you cannot reach your people, your public, or your systems. Plan for three distinct layers.

Staff notification. You need a way to tell employees what happened, whether to report, and where. That requires current contact information, including personal phones for after-hours events, and a method that does not depend on the infrastructure that just failed. Whether you use a mass notification service, a call tree, or a text group, two rules apply: keep the roster current on a schedule, and test it. Every organization that tests its call tree for the first time discovers disconnected numbers and people who never knew they were in it.

Public communication. During a continuity event the public still needs to know which services are open, where to go, and what to expect. Pre-drafted templates for common scenarios, more than one trained spokesperson, and access to your website and social media accounts from outside your network all matter. That last one bites hard during cyber incidents: if the only credentials for your public website live on the compromised network, you have lost your voice at the worst moment.

Technical resilience. IT and radio systems need their own continuity thinking: redundant internet paths where feasible, backup power that is actually maintained and fueled, radio interoperability with neighboring agencies, and a plan for operating when primary systems are down. Your IT staff and radio technicians should be at the continuity planning table from the first meeting, not consulted after the plan is drafted. In my experience they will find the single points of failure faster than anyone else in the room.

Testing, Common Failures, and a Practical Starting Checklist

Here is the closest thing to a law in this field: the plan that has never been exercised will fail. Not might. Will. Exercises exist to make the plan fail cheaply, on a Tuesday morning with coffee, instead of expensively during a real event. You do not need elaborate drills to start. A one-hour tabletop where leadership walks through “our building is inaccessible as of 6 a.m. today” will surface more gaps than a year of plan-writing. So will small functional tests: activate the call tree after hours. Restore one file from backup. Have the acting official actually sign a document under delegated authority. Run one payroll cycle through the manual procedure on paper. After each test, write down what broke and fix it, because an exercise without follow-up is theater.

The failures exercises reveal are remarkably consistent across organizations. Watch for these in your own plan:

• Ghost rosters. Succession lists and contact rosters naming people who retired, transferred, or died years ago.
• Single points of failure in one person. The only person who can run payroll, restore the servers, or operate the plant. If a function lives in one head, it is one resignation away from stopping.
• Single points of failure in one building. Primary systems, backups, vital records, and the emergency operations center all under the same roof.
• No payroll continuity. Discussed above, and still the most common serious gap I encounter.
• Plans nobody has read. A binder written by a consultant, approved by a council, and opened for the first time during the event.
• Untested assumptions. The alternate site that became a warehouse, the backup that does not restore, the generator with no fuel contract.

If you are a small government or agency starting from zero, do not try to write the perfect plan. Do these things, roughly in order:

• List your essential functions. Aim for five to ten, with maximum allowable downtime for each, signed by leadership.
• Write orders of succession three deep for your top positions, by title, checked against state law and your charter.
• Draft delegations of authority covering emergency spending, personnel decisions, and public statements, with limits.
• Identify vital records by function, confirm offsite backups exist, and print the handful of documents you would need on day one.
• Write the payroll continuity procedure.
• Pick your relocation strategy for each essential function: remote, alternate site, or devolution to a partner, with agreements in writing.
• Build and test staff notification.
• Hold a one-hour tabletop within 90 days, fix what breaks, and put the next exercise on the calendar before the room empties.

Takeaways

• COOP planning keeps your essential functions running through any disruption, not just declared disasters: fires, cyberattacks, pandemics, building loss, and the loss of key people.
• The core discipline is admitting that most functions can pause. A short, signed list of essential functions is worth more than a thick binder.
• Orders of succession put someone in the chair; delegations of authority define what the chair can legally do. Write both down, keep them current, and brief the people named.
• Remote work is a real continuity strategy with real limits. Pair it with physical alternate sites and honest triggers for each.
• Vital records need offsite backups you have actually restored, and a paper fallback for the day every screen goes dark. Payroll continuity is non-negotiable.
• Devolution and reconstitution are just pre-planned answers to “who does this if we cannot” and “how do we come home.”
• The plan that has never been exercised will fail. A one-hour tabletop this quarter beats a perfect plan next year.