The organization must identify the functions critical to the continuity of its operations (e.g. services offered to the customer).
Risks related to critical operations should be identified, evaluated and handled with emphasis and regularly in cooperation with service providers.