At 9:40 on a Tuesday, a burst pipe floods the server room at a distributor's headquarters, and the phone system, the ERP and the file shares go dark together. The company has a thorough continuity plan, and its only copy is on the file share that just went offline.
On the CompTIA Security+ SY0-801 exam, business continuity and disaster recovery plans sit under objective 5.1 next to policies and standards, as governance documents whose importance you are expected to explain. This lesson covers what each plan is for, what goes into it, from roles and contact lists to recovery priorities and communications, and how a plan is kept current and reachable.
Continuity and recovery plans are approved documents with different jobs
A plan records decisions made in advance for a specific kind of situation: who does what, in what order, with which resources. A policy usually requires the plans to exist and be tested, leadership approves them, and each has a named owner, a version number and a review date. Plans stay at the level of roles, priorities and sequence, and point to procedures and runbooks for the technical steps.
The business continuity plan (BCP) keeps the organization's critical functions running at an acceptable level during and after a disruption, whatever the cause: fire, flood, pandemic, a failed supplier or a cyberattack. It covers people, workplaces, processes and suppliers as well as technology. The disaster recovery plan (DRP) is narrower. It restores IT systems, data and infrastructure after a disruption, and it is one part of the continuity effort, not a substitute for it.
| Business continuity plan | Disaster recovery plan | |
|---|---|---|
| Goal | Keep critical functions running | Restore IT after a disruption |
| Scope | People, sites, processes, suppliers, technology | Systems, data, networks |
| Typical owner | Business continuity manager | IT leadership |
| Sample contents | Alternate workspace, manual workarounds, backup suppliers | Restore order, backup locations, failover runbooks |
Other plans sit beside these two. The incident response plan handles a security incident itself, such as containing an intruder, and a crisis management plan guides executives through decisions about reputation and strategy. In a ransomware attack all of them run at once, so each plan refers to the others. U.S. federal agencies call their version a continuity of operations plan (COOP), and NIST SP 800-34 and ISO 22301 are the common references for building these plans.
Every plan names who decides, who acts and how to reach them
The first thing a plan settles is activation: what event triggers it and who has the authority to declare it. Vague triggers cost hours, as teams try to fix the primary site while nobody makes the call. A DR plan's activation section might read:
| Element | Example entry |
|---|---|
| Trigger | Primary data center down, or expected to be down, for more than 2 hours |
| Declares | CIO; alternates VP Infrastructure, then IT Director |
| First notice | Crisis team alerted by mass notification within 15 minutes |
| Assembly | Conference bridge number and PIN, printed in the plan |
Roles come next. A typical structure has a crisis management team of executives who set priorities, approve spending and sign off external statements; a continuity coordinator who runs the plan; a DR lead; recovery teams for network, identity, databases and applications; business unit leads who run workarounds; and representatives from communications, legal, HR and facilities. Every role has a named primary and at least one alternate, because the disaster may affect the people too.
Contact lists and call trees make the roles reachable. The plan lists staff, the recovery site provider, internet carriers and hardware vendors with contract and support numbers, insurers, key customers and regulators. A call tree spreads the work: the coordinator calls four team leads, and each calls their own team. Since company phones and chat may be part of the outage, lists include personal mobile numbers, which makes them sensitive data in their own right, so distribution is limited to role holders.