Your Contingency Plan Has Never Been Validated

Four medical device manufacturers were disrupted by cyberattacks between March and August 2026. The pattern each one exposed had nothing to do with firewalls.

On August 25, 2026, Boston Scientific identified unauthorized activity on its network. By August 28 the company remained in a network outage, with its ability to manufacture products and to process and ship customer orders still disrupted and no timeline for full restoration. At the company's manufacturing site in Cork, Ireland, staff were sent home. Weeks earlier, on August 13, Baxter disclosed unauthorized activity involving certain third-party applications and stated in its own public statement that manufacturing, customer operations and business continuity were unaffected. The extortion group behind it later released the stolen data. Two very different outcomes from broadly similar events.

Earlier in the year the same industry absorbed two more. A wiper attack in March destroyed data across sites at one orthopedic manufacturer and forced production to stop. A network breach in April at another device maker produced a large data theft without halting output. Different vectors, different consequences, one shared variable: whether the organization had a contingency plan it had actually proven would work before it needed it.

That variable is not an information technology question. It is a management system question, and it sits in clauses most organizations have never seriously implemented. This article is about those clauses, what a defensible contingency plan contains, and the validation step that separates the organizations that recover in days from the ones still explaining themselves to customers a month later.

Diana Lynn has spent 28 years watching this specific gap open. Across 200+ audits attended and 80+ certifications supported, the pattern repeats in manufacturing, technology, medical device, government, healthcare and other regulated industries: the plan exists, the plan is current, the plan has never been run. Capture. Prove. Test.

DEFINITION

What is a contingency plan in a management system context?

Operate. Deliver. Recover.

The phrase gets used loosely, and the looseness causes real damage. In finance and project management a contingency is a reserve — money or schedule held back against the unknown. That is not what a contingency plan means in ISO 9001, ISO 13485, ISO 14001, ISO 45001 or ISO 7101, and organizations that import the financial meaning end up with a budget line where they needed an operating procedure. In a management system the subject is operational capability, not reserve.

Three things are frequently confused, and separating them is the first useful step in any contingency plan project.

Most organizations need the middle one and reach for either of the outer two. They either write an evacuation procedure and believe operational continuity is covered, or they scope a full ISO 22301 project and abandon it as disproportionate. The middle arrangement is smaller than certification and larger than a fire drill, and it is the one the standards you are already certified to actually require.

Why the distinction decides whether the plan gets tested

Emergency response gets tested because a clause says to test it and because failing to evacuate a building is visibly unacceptable. A contingency plan for operational continuity has no equivalent testing clause in ISO 9001 or ISO 13485. Nothing in either standard tells you to rehearse operating without your enterprise resource planning system, or to prove you can release product when the electronic record system is unavailable. So the exercise never gets scheduled, and the first live run of the plan is the incident itself.

That is the whole argument of this article in one sentence. The obligation to have a contingency plan is written down. The obligation to prove it works is not, which is precisely why an experienced ISO consulting engagement treats validation as the deliverable rather than the document.

EVIDENCE

Why does an untested contingency plan fail exactly when it is needed?

Written. Filed. Unproven.

The 2026 medical device incidents are useful precisely because they were public, close together and varied in outcome. Read as a set, they show where the recovery time actually goes.

Network restoration is the fast part. Rebuilding a server is a known engineering task with a predictable duration. What takes weeks in a regulated operation is proving that what comes back can be trusted. As one assessment of the Boston Scientific disruption put it, software involved in producing and tracking regulated devices sits inside a validated quality system, so restoring a server and establishing that its data can still be trusted are two different problems. You cannot ship an implantable device on trust alone.

That second problem is a quality system problem, and a contingency plan that never contemplated it offers no help at all. Consider the questions that arrive on day three of an outage in any regulated operation:

• Which records were open and in-flight when the systems went down, and can their state be reconstructed?
• Was the restored application the validated version, and does the validation evidence still apply after the restore method used?
• Were electronic signatures, audit trails and time stamps preserved through the restoration, or does a population of records now lack attribution?
• Did anyone operate on paper during the outage, and if so, under what authority and with what review before those records enter the permanent file?
• Which lots moved during the gap, and can identification and traceability be demonstrated across it?
• What was released to customers on the basis of records that cannot now be verified?

None of those are answerable at speed unless the answers were designed in advance. Designing them in advance is what a contingency plan is for, and rehearsing them is what turns the document into a capability.

The failure is structural, not technical

It is tempting to read these incidents as security failures and respond with security spending. That response is incomplete in a specific and expensive way. Two organizations with identical security postures can experience the same intrusion and diverge sharply in recovery, because recovery speed is governed by preparation inside the management system rather than by the perimeter around it.

The security team decides whether you get hit. The management system decides how long you stay down.

MSI client experience suggests that organizations who have exercised a contingency plan at least once treat the first forty-eight hours very differently. They already know who declares the disruption, which processes have manual fallbacks and which do not, what evidence the manual fallback must generate, and which customers have contractual notification windows measured in hours. Organizations meeting those questions for the first time spend the first forty-eight hours discovering the questions.

This is not a medical device phenomenon. The same structure applies to any operation with committed outputs and controlled records, which is to say every organization certified to a management system standard. The device sector is simply where the consequences surface fastest, because medical device cybersecurity obligations already force the interaction between security events and quality records into the open.

CLAUSE MAP

Which ISO clauses actually require a contingency plan?

Clause. Obligation. Evidence.

This distribution is why so many organizations believe they are covered when they are not. There is no single checkbox to miss. The requirement is assembled from parts, and each part looks satisfied in isolation. Organizations running one system against several standards meet it in compounded form, which is why MSI treats continuity as an integrated management systems question rather than a single-standard one.

ISO 9001 — Clause 8.2.1 e), the requirement that fell through transition

ISO 9001:2015 Clause 8.2.1 e) requires the organization to establish specific requirements for contingency actions, when relevant, as part of determining requirements for products and services. It was new in the 2015 revision with no predecessor in the 2008 edition. During transition there was nothing to map it from, so on most correspondence tables it simply had no source row — and in a very large number of organizations it was never implemented at all. A decade later the contingency plan obligation is still, in MSI's audit experience, among the most commonly unaddressed requirements in an otherwise mature ISO 9001 system. MSI's ISO 9001 quality standard page sets out where the clause sits in the wider system.

Four further ISO 9001 clauses complete the picture, and they are the ones auditors actually walk when they probe continuity:

The ISO 9001:2026 revision is scheduled for publication on September 16, 2026, and organizations planning a transition will want their contingency plan work aligned to the same cycle rather than run as a separate project. Doing both at once is materially cheaper than doing them a year apart, which is the sequencing MSI's SurePath turnkey certification approach is built around.

ISO 13485 — the validated-system problem

ISO 13485 uses the pre-Annex SL structure, so it does not share the harmonized ten-clause layout of the other standards discussed here, and it has no equivalent to ISO 9001 Clause 8.2.1 e). What it has instead is a set of obligations that make the recovery half of a contingency plan far harder and far more consequential for device manufacturers.

• Clause 4.1.6 requires validation of computer software used in the quality management system, proportionate to risk, with records of that validation. After a restore, the question is whether the validated state was preserved — and if it cannot be shown, the software is unvalidated until it is revalidated.
• Clause 4.2.4 and Clause 4.2.5 govern control of documents and records, including retrieval, protection from loss and defined retention. Records that cannot be retrieved during an outage are a live nonconformity, not a temporary inconvenience.
• Clause 7.5.6 requires validation of processes where output cannot be verified by subsequent monitoring, including validation of the software used in those processes. Contingency operation of a validated process is a change to that process.
• Clause 7.5.8 and Clause 7.5.9 require identification and traceability throughout realization, with traceability records retained. There is no allowance for a gap.
• Clause 8.3 governs control of nonconforming product, including product detected after delivery — the clause the organization lands in if release decisions were made on unverifiable records.

Layered on top for United States manufacturers is the regulatory position. The FDA's Quality Management System Regulation amended 21 CFR Part 820 to incorporate ISO 13485:2016 by reference, which means these clauses now carry regulatory force rather than certification force alone — the mechanics of which MSI covers in its breakdown of the QMSR rule and Part 820 alignment. Where electronic records and signatures are in play, 21 CFR Part 11 adds audit trail, attribution and record-integrity obligations that a paper fallback has to satisfy on re-entry, not merely approximate.

The practical reading for a device manufacturer is uncomfortable but clarifying. Your contingency plan is not finished when it explains how to keep making product. It is finished when it explains how you will demonstrate, afterward, that everything made during the disruption conforms — and what you will do about anything you cannot demonstrate. MSI's overview of the ISO 13485 standard sets out how those clauses interact in a working system.

ISO 14001:2026 — protection from loss of integrity, and the new audit objective

The fourth edition of ISO 14001 was published in April 2026, cancelling and replacing the 2015 edition, with the transition deadline set for April 30, 2029. Three of its requirements bear directly on a contingency plan, and the environmental management standard is more explicit than ISO 9001 on two of them. MSI's ISO 14001 environmental standard page covers the fourth edition in full.

• Clause 7.5.3 requires documented information to be controlled so that it is available and suitable for use where and when needed, and adequately protected — the standard names loss of confidentiality, improper use and loss of integrity. It then requires the organization to address distribution, access, retrieval and use; storage and preservation including legibility; control of changes; and retention and disposition. That is a records contingency specification in everything but name.
• Clause 8.2 requires processes to prepare for and respond to potential emergency situations, including periodically testing the planned response actions where practicable, and periodically reviewing and revising them — particularly after an occurrence or a test.
• Clause 9.2.2 now requires the organization to define the audit objective, criteria and scope for each audit. An internal audit of contingency arrangements with no stated objective no longer satisfies the clause.

Clause 6.3, planning of changes, closes the loop: the annex guidance explicitly lists business disruption from supply chain issues, labour disputes, natural disasters and similar events among the circumstances that give rise to change requiring planned management. An environmental management system that has never considered how it operates during disruption has an unaddressed Clause 6.3 obligation.

If your team also needs the change map and the auditing rework, MSI runs an ISO 14001:2026 Transition course and a companion ISO 14001:2026 Internal Auditing course that trains auditors against the updated clauses rather than the retired checklist.

ISO 45001 — the one standard that makes testing unqualified

ISO 45001 Clause 8.2 requires processes to prepare for and respond to potential emergency situations, and its testing requirement is not softened by a practicability qualifier. It also requires the organization to communicate relevant information to workers, contractors, visitors, emergency response services and authorities, and to involve workers in developing the planned response.

That last requirement is the one worth borrowing for the wider contingency plan. The people who will operate the fallback are the people who know whether it can be operated. A continuity arrangement written by management and handed down is the one that fails at three in the morning, because the assumptions embedded in it were never checked against the work. Leadership teams getting up to speed quickly often start with the ISO 45001 Executive Brief, or MSI's ISO 45001 safety standard page.

ISO 7101 — contingency planning named outright

ISO 7101, the healthcare quality management standard and an expanding focus area for MSI, is the most direct of the five. Clause 8.2.2 addresses contingency planning explicitly, and Clause 7.5.4 f) adds a requirement bearing on the contingency of information systems — an obligation that, in most healthcare organizations, has no natural owner because it sits between clinical operations and information technology and is claimed by neither.

For hospitals and clinics that is the single highest-value finding in this whole clause map. An information-system contingency plan with no assigned owner is not a plan; it is an expectation. MSI's ISO 7101 Overview covers where these requirements sit in the healthcare quality management system as a whole, alongside the ISO 7101 healthcare standard page.

SECOND SOURCE

Why can't a critical manufacturer just have a backup site?

Transfer. Validate. Register.

Cyberattacks make the news, but they are not the most reliable way to lose a plant. Water is, and any contingency plan that only contemplates intrusion is scoped too narrowly. The single best illustration of what single-site concentration costs happened to the same company that appeared at the top of this article, two years before its network incident.

Eleven months: what one flooded plant did to a national supply

Hurricane Helene made landfall on Florida's Gulf Coast on September 26, 2024 and moved north through the southeastern United States. In western North Carolina it flooded Baxter's North Cove manufacturing site at Marion. The company had a hurricane preparedness plan in place, and rain and storm surge nonetheless caused a levee breach that put water inside the site and destroyed a bridge serving the plant. North Cove produced roughly 60% of the intravenous fluids supplied to hospitals in the United States.

Read the last item again, because it is the one that matters commercially. The plant recovered in five months. The market position did not recover in two years. Customers who found another way through the shortage did not all come back, and competitors who could supply during the gap kept some of what they won. No contingency plan is more expensive than that outcome.

The plant came back in five months. The market share did not come back in two years. That gap is the actual cost of single-site concentration.

And the concentration was visible in advance. A single site producing the majority of a national supply of an essential product is not a hidden risk; it is a documented fact that appears in every capacity review. It was accepted because concentration is efficient, and efficiency is the thing that gets measured every quarter while resilience is the thing that gets measured once, retrospectively, after it is missing. A contingency plan is the instrument that puts resilience on the quarterly agenda instead.

ISO 14001:2026 made this a required planning input

Organizations that treat extreme weather as bad luck rather than as a planning input now have a clause problem as well as an operational one. ISO 14001:2026 Clause 4.1 requires the organization to determine external and internal issues, and states that these issues shall include environmental conditions being affected by the organization or capable of affecting the organization — naming pollution levels, availability of natural resources, climate change, biodiversity and ecosystem health.

The annex removes any ambiguity about what that means in practice. Among its examples of risks with potential adverse effects, ISO 14001:2026 lists climate change impacts such as increased flooding, drought, extreme temperatures and wildfires that affect the organization's assets, along with water scarcity affecting the ability to operate emission control equipment and resource constraints that impact production. Those are not environmental impacts the organization causes. They are environmental conditions acting on the organization, and the fourth edition requires you to consider them.

So the reasoning runs cleanly through the standard. Clause 4.1 requires you to determine the condition. Clause 6.1.4 requires you to determine the resulting risks. Clause 6.1.5 requires you to plan action. Clause 6.3 requires the resulting changes to be managed in a planned manner. An environmental management system that has never considered site concentration against extreme weather has an unaddressed obligation sitting at the very front of the standard — which is why MSI's ISO 14001 work now starts context determination there rather than with the aspects register, and why a weather-exposed contingency plan starts at Clause 4.1 rather than at the emergency response procedure.

ISO 13485 Clause 7.3.8 — why the backup site cannot be arranged afterward

This is the mechanism most continuity discussions skip. “We should have a backup manufacturer” is a sound instinct and an incomplete instruction, because in a regulated environment the backup has to be brought into existence through a controlled sequence. Each step below has a duration measured in weeks or months, and none of them can be compressed by urgency.

Add these together and the honest answer to “why don't they just have a backup plant” becomes clear. They could have. It would have taken most of a year and cost real money against a risk that had not yet materialized. The decision not to do it was rational on the day it was made and catastrophic the day the levee failed — which is the general shape of every contingency plan decision anyone will ever face. The purpose of a contingency plan is to make that decision deliberately, with the cost of both options written down, rather than by default.

What a proportionate answer looks like

Full duplicate manufacturing is the most expensive option and rarely the right one. The useful question is not whether to build a second plant but how far along the readiness ladder to climb, and the ladder has rungs at very different price points.

• Documented single-point-of-failure map. Which products depend on one site, one line, one tool, one supplier, one qualified operator. Costs a week and is the input to every decision below.
• Design transfer package kept transfer-ready. Outputs maintained in a state where transfer under Clause 7.3.8 could begin immediately rather than starting with document archaeology. Cheap, and it cuts months off any future transfer.
• Identified and evaluated alternate site or contract manufacturer, evaluated under Clause 7.4 but not yet producing. Costs an evaluation cycle. Removes the longest lead item from the critical path.
• Qualified alternate, dormant. Transfer complete, validation done, registration in place, producing nothing or producing a small qualifying volume. Expensive, and the only option that genuinely delivers continuity in weeks rather than quarters.
• Dual production as standard. Both sites run continuously. Highest cost, lowest risk, and reserved for the products where unavailability is a public health event rather than a commercial one.

Most organizations should be on rung two or three and are on rung zero. Moving from zero to two is inexpensive and can be done inside a quarter; it is the single highest-return continuity investment available to a device manufacturer, it requires no capital, and it belongs in the contingency plan rather than in a capital request. Teams that need the design and development discipline underneath it start with MSI's ISO 9001 design and development process training and the companion design and development video series, both of which cover the transfer step that Clause 7.3.8 formalizes.

The clause map from a contingency plan perspective is worth stating plainly. ISO 14001:2026 tells you the weather is a planning input. ISO 13485 tells you what standing up an alternate site actually requires. ISO 9001 Clause 8.2.1 e) tells you to capture what you promised the customer about continuity. Nothing tells you to test the arrangement, and nothing tells you when the concentration risk becomes unacceptable. Those two judgments belong to leadership, informed by the system — which is the entire argument for keeping continuity inside the management system across every industry MSI serves rather than parking it with facilities or with information technology.

CAPTURE

What has to be captured before a contingency plan can be validated?

Promise. Owner. Record.

This is the least technical and most valuable step in the whole exercise, and it usually takes a week. Continuity demands that were rare before 2020 are now routine in customer contracts across manufacturing, technology, medical device, government, healthcare and other regulated industries. Procurement organizations ask for them. Sales teams sign them. The commitment lands in a contract file and stops there.

A commitment that exists only in a contract has three properties that make it dangerous. Nobody maintains the underlying capability, because maintaining it was never assigned. Nobody re-verifies it when the supplier, site or inventory policy changes, because no trigger exists. And nobody discovers the gap until the customer invokes the clause, which by definition happens on the worst day.

The contingency obligations register

The remedy is a single controlled record. Every contingency plan MSI helps build starts with one, because it converts a scattered set of promises into something a management system can act on.

Where contingency is genuinely not relevant to a transaction or to the business, record that determination and the basis for it. An undocumented decision that something does not apply is indistinguishable, from the outside, from never having considered it. A defensible contingency plan either addresses an obligation or states plainly why it does not — and the second option takes one sentence.

The mirror image nobody writes down

ISO 9001 Clause 8.2.1 e) obliges you to capture the contingency the customer requires. It says nothing about the far more common event: you cannot deliver what you promised. Capacity lost, supplier failed, test failed the week before shipment, systems down. Because no clause demands it, almost no sales or order handling procedure contains it, and the abnormal case gets handled by whoever notices, at whatever speed they choose — which is exactly the vacuum a contingency plan exists to fill.

Customers forgive the failure far more readily than they forgive the silence. Notification speed is the variable you actually control.

A complete contingency plan treats this in three parts: capture what the customer requires, confirm you can meet it before committing, and define what happens when you cannot. The third part is where reputations are made or lost, and it is the part that is almost always missing.

PROVE

How do you prove a contingency plan still works after the disruption?

Restore. Requalify. Release.

The sequence below is the one MSI walks with clients, and it is deliberately ordered. Each step depends on the one before it, which is why organizations that improvise the order lose weeks. Building the sequence into the contingency plan in advance is what makes it executable under pressure.

Steps three and four are the ones that surprise people. Restoring a server is an engineering task with a predictable duration. Establishing that the data coming out of that system can still be trusted is a quality task with no predictable duration at all, unless the method was designed in advance. Designing it in advance is the single highest-return item in any contingency plan.

What the paper fallback has to be able to do

Almost every plan names a manual fallback. Very few specify what it has to produce. A fallback that keeps the line moving but generates records that cannot enter the permanent file has converted a systems outage into a records nonconformity, which is a worse problem and a longer one.

• Every field the electronic record captured, including the ones nobody looks at until an investigation.
• Attribution — who performed the act, not merely who wrote it down afterward.
• Contemporaneous timing, recorded at the time and not reconstructed.
• A defined review and entry path back into the system, with the reviewer identified by role.
• A retention arrangement for the physical originals that matches the retention requirement for the electronic record they substitute for.

Organizations that already think in terms of design rationale find this easier, because the discipline is the same one applied in medical device threat modeling: capture the reasoning at the moment of the decision, because reconstructing it later is expensive and rarely convincing. Software and digital health organizations face the same demand at the regulatory boundary, which MSI covers in its work on digital health FDA compliance.

NOTIFY

What notifications does a contingency plan have to trigger?

Regulator. Customer. Record.

Regulatory supply notification and the trap inside it

For device manufacturers, Section 506J of the Federal Food, Drug, and Cosmetic Act requires notification to the FDA of a permanent discontinuance or an interruption in manufacturing likely to lead to a meaningful disruption in domestic supply. The FDA maintains a 506J Device List by product code and uses the notifications to publish its shortage list and prioritize reviews and inspections that could relieve a shortage.

The trap is the trigger. The mandatory duty applies during or in advance of a declared public health emergency. Outside one, Section 506J(h) permits voluntary notification at any time but does not compel it — so a disruption that halts shipments in an ordinary month is not, on the face of the statute, a mandatory notification event. The FDA nonetheless encourages voluntary notification, and the final guidance confirms that voluntary submissions may be made at any time, unrelated to any emergency declaration.

A second trap sits alongside it. The statutory trigger is an interruption in manufacture, not in distribution. An organization that can still make product but cannot process or ship orders faces an awkward fit with the statutory language — a question regulatory affairs should answer on day two of an incident, not day twenty. Deciding it in advance costs an hour. Deciding it during an incident costs a week and produces a worse answer. Every regulatory position a disruption could raise belongs in the contingency plan, resolved in advance and owned by a named role.

Securities disclosure, where applicable

Publicly traded organizations carry a parallel obligation. Under rules the Securities and Exchange Commission adopted in July 2023, a registrant must disclose a cybersecurity incident it determines to be material on Item 1.05 of Form 8-K, generally within four business days of that determination, and the compliance guide notes the clock runs from the materiality determination rather than from discovery, with that determination to be made without unreasonable delay.

The management system connection is direct. Materiality assessment depends on operational facts — what cannot be made, what cannot be shipped, for how long — and those facts come from the same people executing the contingency plan. If the plan does not name who supplies them and how fast, the determination is made on guesswork.

The notifications organizations forget

• Customer contractual windows. Frequently measured in hours, frequently unknown to operations, and frequently the first obligation breached.
• Certification body notification. Many certification agreements require notice of significant changes affecting the management system or its scope. Check yours before you need it; accreditation expectations are set through Global ACI, which replaced the prior international arrangements on January 1, 2026.
• Notified body or regulator for site-level disruption where the disruption affects a registered activity or a validated process.
• Breach reporting where personal or health data is involved, on statutory timelines independent of any operational recovery.
• Interested parties under the environmental and safety standards, whose communication requirements do not pause because the systems are down.

Every entry above should appear in the plan with an owning role, a trigger condition and a time limit. Building that list is a two-hour exercise that repeatedly proves to be the highest-value two hours in the whole project — the kind of structural work an ISO consulting engagement should insist on before any document is drafted.

FRAMEWORK

What does the MSI Contingency Validation Gate require?

Five. Gates. Proof.

The gates are ordered by how often they fail. Gate one fails least; gate five fails most. Score honestly — the value of the framework is entirely in refusing to credit yourself for a gate you have not passed.

Gate four is where nearly everyone stops. A tabletop discussion in a conference room is a useful start and is not an exercise, because nothing in it can fail. An exercise has an objective, a scenario the participants cannot see the whole of, and a real possibility of a bad outcome that gets written down. If your last contingency plan test produced no findings, it was not a test.

Gate five is where plans quietly die. The arrangement was sound when written and the sole-source supplier changed eighteen months ago. Wiring re-verification into change planning — ISO 9001 Clause 6.3, ISO 14001:2026 Clause 6.3 — is the only mechanism that keeps a contingency plan current without heroics, and it is the reason continuity work belongs inside the management system rather than beside it. Organizations that would rather not carry that maintenance internally use MSI's SureResults year-round maintenance program to keep it live between audits.

PATTERNS

Where do contingency plans break down most often?

Assume. Orphan. Drift.

1. The backup nobody has restored

Backups are monitored for completion, not for restorability. The distinction only becomes visible under pressure. A restore test with a stated objective, a defined success criterion and a written result is the cheapest single item in this entire article, and in MSI's audit experience it is performed far less often than organizations believe.

2. The alternate supplier who was never qualified

A named second source is not a qualified second source. Qualification means the evaluation, the approval record, and where the process is validated, evidence that the alternate's output meets the same specification. Organizations typically report discovering the difference at the moment they try to place the first order, which adds weeks to a recovery that the contingency plan assumed would take hours.

3. The orphaned obligation

A continuity commitment with no owning role decays from the day it is signed. This is the pattern the obligations register exists to prevent, and it is worth auditing on its own: pull five contracts signed in the last two years, extract every continuity commitment, and ask who maintains each capability. The answer is instructive.

4. The undefined declaration authority

Someone has to say the words that switch the organization from normal operation to contingency operation. If that authority is undefined, the switch happens late, partially, or in several places at once with different assumptions. Every contingency plan should name the declaring role, the deputies, and the criteria that make declaration mandatory rather than discretionary.

5. The records-blind fallback

Covered above at length because it produces the most expensive findings. The fallback keeps output moving and generates records that cannot enter the permanent file, converting a temporary outage into a durable documentation problem that surfaces at the next audit or the next investigation.

6. Drift between the plan and the operation

The plan describes a line that was reconfigured, a system that was replaced, a site that closed, or a role that no longer exists. Drift is not a failure of diligence; it is the default behavior of any document not connected to a change trigger. The remedy is Gate five, and the audit that catches drift is a scoped internal audit — MSI runs internal audits against exactly this kind of cross-clause question, and trains client teams to do it through its ISO 9001 internal auditing training.

Corrective action closes the loop on all six. Findings from a contingency exercise are findings, and they belong in the corrective action process with cause analysis and effectiveness review rather than on an action list — the discipline MSI teaches in its corrective action and nonconformity procedure course.

SELF-CHECK

How ready is your contingency plan today?

Ten. Honest. Answers.

• We can produce a register of every continuity commitment made to customers, with owning roles.
• A defined role declares the disruption, with named deputies and written criteria.
• We have restored from backup, deliberately, within the last twelve months, with a written result.
• Every alternate supplier named in the plan is qualified, with the approval record on file.
• We have a specimen of every manual fallback record, reviewed against the requirement it substitutes for.
• The re-entry path from paper back into the system is defined, with the reviewing role named.
• We know which regulatory and contractual notifications the disruption triggers, and who owns each.
• We have run an exercise in the last twelve months that produced findings.
• Those findings went through corrective action with effectiveness review, not an action list.
• The plan is re-verified on supplier, site, capacity, system and competence change.

Two related MSI assessments extend this into adjacent territory. The production, service and operational control maturity check scores how well your operational controls hold up under real conditions, and the risk, aspect and job hazard process check scores the risk determination that should be feeding your contingency plan in the first place. Both are free and neither requires an email address to see your result.

FAQ

Frequently asked questions about the contingency plan requirement

Ask. Answer. Act.

Is a contingency plan actually required by ISO 9001?

What is the difference between a contingency plan and a business continuity plan?

Does ISO 13485 require a contingency plan?

How often should a contingency plan be tested?

What does it mean to validate a contingency plan?

Who should own the contingency plan?

Does a cyberattack trigger an FDA notification?

Should a critical medical device manufacturer have a backup manufacturing site?

What does ISO 13485 require for design transfer to a new manufacturing site?

How long does it take to build a defensible contingency plan?