What is continuity of operations?
Continuity of operations, abbreviated COOP, is the effort to make sure an organization's most important functions keep going when something disrupts normal operations: a fire, a flood, a pandemic, a cyberattack or the loss of a headquarters building. The term comes mainly from the US federal government, where executive branch agencies are required to maintain a continuity capability. In the private sector the same idea usually goes by business continuity, and the two are close enough that many people use them interchangeably.
How COOP works
COOP planning starts by identifying the functions that must continue no matter what, such as paying benefits, dispatching emergency services or processing payroll. Federal guidance expects agencies to be able to keep those functions running, or restore them within 12 hours of a disruption, and to sustain them for up to 30 days, often from an alternate location. Everything else in the plan supports those functions:
- Orders of succession: who takes over each key leadership position when the person holding it is unavailable.
- Delegations of authority: written authority for named people to make decisions, approve spending or sign on the organization's behalf during an emergency.
- Continuity facilities: alternate sites, telework arrangements or recovery sites where the critical work continues.
- Continuity communications: channels that still work when normal phones, email or networks don't.
- Vital records: the documents, databases and systems staff need, protected and reachable from the alternate site.
- Devolution: handing critical functions to staff in another region if the primary organization can't operate at all.
- Reconstitution: returning to normal operations at the original site or a replacement once the emergency is over.
Plans are trained on and exercised on a schedule, and updated after every exercise or real activation.
Example: a county office loses its building
A water main break floods the ground floor of a county benefits office, taking out the server room and making the building unsafe. The office's COOP plan names benefit payments and emergency housing referrals as the functions that can't stop. The director is on leave, so the deputy takes charge under the order of succession and activates the plan. Staff with laptops work from a partner office across town, payments run from systems hosted in a state data center, and a pre-arranged text alert tells employees where to report. Lower-priority work, such as annual reporting, waits until reconstitution.
COOP vs. business continuity and disaster recovery
- Business continuity plan (BCP): the private-sector counterpart, covering how critical business processes continue during a disruption. NIST SP 800-34 Rev. 1 lists the two as separate plan types and describes the COOP plan as sustaining an organization's most critical functions at an alternate site for up to 30 days.
- Disaster recovery plan (DRP): restores IT systems and data. It supports COOP by bringing back the technology the critical functions depend on.
- Incident response plan: handles a security incident itself, such as containing an intruder. A destructive cyberattack can set off incident response and COOP at the same time.
Continuity of operations on the CompTIA Security+ exam
Continuity of operations falls under two SY0-801 objectives: business continuity and disaster recovery plans are governance documents under objective 5.1, and keeping operations going through a disruption is part of resilience and recovery under objective 3.4. A question may say continuity of operations or business continuity; for the exam, treat the two as the same concept. Scenario clues include keeping critical services running from another location, staff relocating, leadership succession and manual workarounds while systems are down. If the focus shifts to restoring servers and data, the answer is disaster recovery; if the question asks what determines which functions are critical and how long they can be down, the answer is the business impact analysis.