GATEKEEPER AI AGENTS
Business Continuity Plan Review Agent.
A business continuity plan is only useful if it is current, tested and covers the service you rely on.
The Business Continuity Plan Review Agent checks every plan as it arrives, so your team sees the gaps before signing off the vendor.
See it in action.
HOW IT WORKS
How the Business Continuity Plan Review Agent works
Plan submitted.
A vendor attaches its business continuity plan, disaster recovery plan or test report to the card in Gatekeeper’s workflow.
Document checked.
The agent records the document type, owner, version and last review date, and flags a plan not reviewed in the last 12 months or a policy statement supplied in place of a plan.
Scope and recovery targets checked.
The services, sites and systems covered are checked alongside the recovery time objective (RTO) and recovery point objective (RPO), flagging targets that are missing or vague.
Scenarios and testing reviewed.
The agent checks the plan addresses loss of a site, people, IT, a key third party and cyber attack or ransomware, and when it was last tested, with the results and fixes.
Resilience arrangements reviewed.
Roles, escalation, customer communication, critical dependencies and backups, including off-site or immutable copies and restore testing, are each assessed.
Structured output.
Findings are summarised with a verdict, a table of all certificates reviewed, and a list of issues to raise with the vendor.
FAQ
Frequently asked questions.
What does the Business Continuity Plan Review Agent review?
The Business Continuity Plan Review Agent reviews a vendor’s business continuity plan, disaster recovery plan or test report, checking that the plan is current, owned, tested and covers the service you are buying. It covers:
-
Document owner, version and last review date
-
Services, sites and systems in scope
-
Recovery time and recovery point objectives
-
Scenarios, including cyber attack and ransomware
-
Testing, results and whether issues were fixed
- Roles, customer communication, dependencies and backups
What counts as a significant gap?
The Business Continuity Plan Review Agent returns Significant gaps when the plan has no RTO or RPO, has not been tested in the last 12 months, does not cover the service you are buying, or does not address cyber attack or ransomware. Any other gap returns Needs attention.
Can it review a disaster recovery test report?
Yes. The Business Continuity Plan Review Agent reviews business continuity plans, disaster recovery plans and test reports.
Where the attachment is a policy statement or brochure rather than a plan, the agent says so in the verdict and reviews what the document contains.
Which scenarios does it check?
The Business Continuity Plan Review Agent checks the plan addresses five scenarios: loss of a site, loss of people, loss of IT or systems, loss of a key third party, and cyber attack or ransomware. Each scenario the plan leaves out is flagged by name.
How does it check the plan covers our service?
Where the card describes the service being bought, the Business Continuity Plan Review Agent checks the services, sites and systems in the plan’s scope include that service. A plan that does not clearly cover the service returns a verdict of Significant gaps.
Does it replace the risk team’s review?
No. The Business Continuity Plan Review Agent handles the first-pass review and structures the findings. Your risk team reviews the output and decides whether the vendor’s resilience arrangements are acceptable as part of your vendor risk and compliance process.
What are the configuration options?
Tailor the Agent to your organisation’s resilience requirements rather than a generic checklist, including:
-
Review age and testing thresholds.
-
Required scenarios.
-
RTO and RPO requirements.
-
Verdict rules.
-
Review outputs.
How does Agent automation compare with a manual process?
Without Agent automation, teams read each continuity plan in full to find recovery targets, test dates and the scenarios it covers.
-
Plans are read end to end to find RTO, RPO and test results.
-
Missing scenarios are hard to spot in a long document.
-
Out-of-date plans can pass unnoticed.
With Agent automation, continuity plans are reviewed automatically as soon as they reach the card.
-
Recovery targets and testing are checked immediately.
-
Missing scenarios are flagged by name.
-
Teams focus on gaps that need a response from the vendor.
With Gatekeeper’s Agentic AI, routine tasks are completed up to 95% faster.
Is there an audit trail?
Every Agent action is recorded in Gatekeeper with a timestamp, including the criteria applied, decision made, supporting evidence and reasoning where applicable.
This creates a searchable record of how each outcome was reached, supporting compliance verification, internal review and audit requirements.
How is my data kept secure and compliant?
Your data stays within Gatekeeper while the Agent performs its work. Actions, decisions and supporting evidence are logged, creating a clear audit trail.
The Agent operates within the permissions, playbooks and authority controls you configure.
Data handling follows Gatekeeper’s enterprise security standards, including SOC 2 Type II compliance and GDPR requirements.
one unified record
Every capability, unified.
One system of truth.
Customer and vendor contracts, obligations, and renewals in one record.
See spend against contract.
Contract value sits next to what is actually being spent.
No single point of failure.
Contract knowledge lives in the platform, so nothing is lost when someone changes role or leaves.
Draft from approved templates.
Every agreement starts from language Legal already trusts.
Keep control of the clause library.
Guard-railed templates keep off-policy wording from going out.
Nothing renews unnoticed.
Every renewal date tracked, with owners and reminders set automatically.
Expert insight & opinion
Related AI agents.
Gatekeeper's agents work as a single, connected team, handing off to one another across the lifecycle rather than running in isolation like bolted-on point tools.
