Custom resilience plan and continuity file
The Critical Entities Resilience Act (Wet weerbaarheid kritieke entiteiten) has applied since 15 August 2026. Designated organisations must assess their risks, take measures and report serious incidents. Appfront builds the software in which the resilience plan and the continuity file live: risks and measures with an owner, dependencies and scenarios, exercises and evaluations, and a plan that stays current instead of going out of date in a folder.
What is software for the resilience plan and continuity file?
A resilience plan describes how an organisation keeps delivering its essential services when something serious happens: a flood, an act of sabotage, a power outage or an attack. The Critical Entities Resilience Act (Wet weerbaarheid kritieke entiteiten), the Dutch implementation of the European CER Directive, requires designated organisations to assess their risks, take appropriate measures and report incidents. The directive refers to a resilience plan or an equivalent document.
A continuity file is the day-to-day working-out of that plan: which processes are critical, what they depend on, what we do if a system, supplier or site goes down, and who calls whom. In many organisations this sits in separate documents and spreadsheets, with an owner who has already left. The plan is written for the regulator and then never opened again.
We build custom software because every organisation has different services, risks and dependencies. Your sector, your regulator, your systems and the way you work determine how the software works. It connects to your risk register and incident management, so the plan uses the same data as the rest of the organisation.
One plan
Risks, measures and scenarios.
Dependencies made visible
Systems, suppliers and sites.
Practised
Exercises and evaluations recorded.
How we build your resilience plan and continuity file software
We start with your organisation: which services are essential, which law and regulator apply to you, and where the plans are now. Then we map the dependencies and look at which systems already hold data, such as your CMDB, risk register or contract management. We often start with the critical processes and their dependencies, because everything else builds on them. Measures, scenarios, exercises and reports follow once that works well. After that, we maintain the software as rules, regulators or your organisation change.
Services, laws and plans.
Systems, suppliers and sites.
Plan, measures and exercises.
Go-live, and maintenance as things change.
What resilience plan and continuity file software actually does
The components below appear in almost every piece of resilience and continuity software. Which ones you need depends on your organisation and your regulator.
Critical processes
With their dependencies.
Risk assessment
Scenarios with likelihood and impact.
Measures
With owner and deadline.
Exercises
Planning and evaluating.
Incidents
Recording and reporting.
Plan as an export
Even when systems go down.
Who we build resilience plan and continuity file software for
The software is intended for organisations that must be able to demonstrate their resilience, or that want to for their own reasons. The more services, sites and suppliers you have, the more it delivers.
Critical entities
Designated under the Wwke.
Under the Cbw
Continuity during cyber incidents.
Suppliers
Requirements from your customers.
Business continuity
In line with ISO 22301.
Test your idea first: a working prototype in 1 day
With OneDayBuild, we make your idea tangible in a single day for €1,150, so you know whether further development is worth the investment. Decide to go ahead with the full build? Then we deduct the cost in full.
View OneDayBuild →Technology and integrations
This page covers the resilience plan and the continuity file. For the digital side, see our page on software for the Cybersecurity Act; for alerting during an incident, our page on alerting and crisis communication; and for the broader risk picture, our page on operational risk management. You can read about our approach on building software.
Why Appfront for your resilience plan and continuity file software?
A plan written for the regulator that then goes stale in a folder, dependencies nobody has a view of, and exercises whose lessons end up nowhere all leave an organisation vulnerable at the moment it matters. That is what we build against: one plan with owners, visible dependencies, and exercises that improve the plan.
Demonstrable
Ready for the regulator.
Up to date
Every measure has an owner.
Usable
Even when things go wrong.
Security and privacy in resilience plan and continuity file software
The software holds sensitive information: vulnerabilities, dependencies, scenarios and contact details of key people. Access is strictly set up per role, sensitive sections are visible only to those who need them, and every change and every view is logged.
The software runs in a European data centre or in your own environment, with encrypted storage and daily backups. Because a plan is needed precisely when systems fail, there is an encrypted export that also works offline. We record the processing in a data processing agreement.
Frequently asked questions about resilience plan and continuity file software
Questions organisations ask before they get started.
A plan in which an organisation describes how it will keep delivering its essential services during serious disruptions, such as natural disasters, sabotage or power or system outages. The European CER Directive requires critical entities to describe their measures in a resilience plan or an equivalent document.
The Dutch Critical Entities Resilience Act (Wwke) has applied since 15 August 2026 to organisations designated as critical entities, in sectors such as energy, transport, banking, healthcare, drinking water, wastewater, digital infrastructure, government and food. You will hear from the government whether you have been designated. Suppliers also feel the effect, because their customers will start setting requirements.
The resilience plan describes the measures at a high level, often for the regulator. The continuity file is the practical elaboration: critical processes, dependencies, fallback and recovery plans and contact lists. In the software they sit together, so the plan and day-to-day practice do not drift apart.
The Cybersecurity Act covers the digital side: network and information systems and cyber incidents. The Wwke is broader, covering physical and other risks. Many organisations fall under both. The software can track both, so measures and incidents do not end up in two separate systems.
Yes. You plan exercises per scenario, record who took part and what went well and what did not, and turn improvement points into measures with an owner. That way every exercise is reflected in the plan.
Yes. That is exactly when you need it. There is an encrypted export of the plan and the contact lists that works offline and is updated automatically. We agree with you where the export is stored.
For designated critical entities, organisations covered by the Cybersecurity Act, their suppliers, and organisations that want to set up business continuity properly, for example in line with ISO 22301. If you have a single site and few dependencies, a well-maintained document is often still enough.
A plan that stays up to date?
Tell us which rules apply to you and where your plans stand today. We'll show you what the software looks like.