What is a business continuity plan?
A business continuity plan (BCP) is the approved document that tells an organization how to keep its most important work going when something disrupts it: a fire, a flood, a pandemic, a failed supplier or a cyberattack. It covers people, workplaces, business processes, suppliers and communications as well as technology. Its goal is not to restore everything at once but to keep critical functions running at an acceptable level until normal operations return.
The disaster recovery plan (DRP), which restores IT systems and data, is one part of the wider continuity effort. U.S. federal agencies call their version a continuity of operations plan (COOP). NIST SP 800-34 and ISO 22301 are common references for building these plans.
The business impact analysis comes first
A BCP is built on a business impact analysis (BIA). The BIA identifies critical business functions, what each one depends on (systems, data, people, facilities and suppliers) and how the harm from an outage grows over time. From it come the maximum tolerable downtime for each function and the recovery time objective (RTO) and recovery point objective (RPO) for the systems behind it. Without a BIA, a continuity plan has no basis for deciding what comes back first.
What a business continuity plan contains
- Scope and assumptions, such as the loss of one site but not two.
- Activation criteria and who has the authority to invoke the plan.
- Roles, each with a named primary and at least one alternate: crisis management team, continuity coordinator, business unit leads.
- Contact lists and call trees, including personal numbers in case company phones are part of the outage.
- Recovery priorities for business functions, with the minimum staffing each one needs.
- Manual workarounds, such as paper order forms while systems are unavailable.
- Alternate workspaces and remote work arrangements.
- A communication plan for staff, customers, regulators and media, with one spokesperson and pre-approved templates.
- Return-to-normal criteria and an after-action review.
A business continuity example
A hospital hit by ransomware loses its electronic health records. Under the BCP, clinicians switch to paper charts and documented downtime procedures so patients are still admitted and treated, and the communications lead updates staff on a fixed schedule through a mass notification service. Meanwhile, under the DRP, IT rebuilds the records servers from clean backups, and the incident response team contains the attacker. All three plans run at once and refer to each other.
Testing and maintaining the plan
A plan that has never been exercised describes what someone believed on the day it was written. Continuity plans are tested with walkthroughs, tabletop exercises and simulations, and the technology side with parallel processing and failover tests. They are reviewed on a schedule, usually at least yearly, and after any significant change: a reorganization, an office move, a new supplier, turnover in a named role, or a real activation. Copies must be reachable when the systems they describe are down, so printed or offline copies are kept with role holders.
Business continuity plan vs. disaster recovery plan
| Business continuity plan | Disaster recovery plan | |
|---|---|---|
| Goal | Keep critical functions running | Restore IT after a disruption |
| Scope | People, sites, processes, suppliers, technology | Systems, data, networks |
| Typical owner | Business continuity manager | IT leadership |
| Example content | Alternate workspace, manual workarounds | Restore order, failover runbooks |
Business continuity plan on the CompTIA Security+ exam
The BCP appears in SY0-801 objective 5.1 as one of the governance documents an organization maintains, and continuity concepts and plan testing also appear under objective 3.4 on resilience and recovery. When people, facilities or business processes are at the center of a scenario, such as staff relocating to another office or working from paper forms while systems are down, the answer is the business continuity plan. When the focus is restoring servers and data, the answer is the disaster recovery plan. If the question asks what determines recovery priorities or tolerable downtime, the answer is the business impact analysis. A plan that is out of date, untested or stored only on the systems that failed is the flaw many scenarios want you to spot.