Business Continuity Planning (BCP): Meaning, BIA and Emergency Plan

What Is Business Continuity Planning?

"Business continuity" means keeping the business running. Business continuity planning, BCP for short, makes sure a company can keep working even when something goes wrong.

Many things can cause this: a cyberattack, a fire, a power cut, a flood, a key supplier that fails or a wave of illness. The question is always the same: what must we do so that the most important processes keep running?

An example: a wholesaler is hit by ransomware. The stock system is locked. Thanks to its emergency plan, the company takes orders by phone and on paper for two days. At the same time, IT restores the systems from tested backups. Customers hardly notice anything.

BCP, BCM and Disaster Recovery

• BCM (business continuity management): the whole system with policy, roles, drills and ongoing improvement.
• BCP (business continuity planning): the planning and the concrete plans for an emergency within BCM.
• Disaster recovery: the IT part. It says how systems and data are brought back.
• Incident response: what you do when a security incident, such as an attack, happens. See incident response management.
• Crisis management: leading the company in a severe situation, often through a crisis team.

The Business Impact Analysis

The basis of every emergency plan is the business impact analysis (BIA). It shows which processes matter most and what an outage costs:

• Critical processes: which tasks can the company not do without, such as production, taking orders or paying wages?
• Impact over time: what happens after an hour, a day or a week of outage? In terms of money, law, customers and reputation.
• Maximum downtime: how long may a process stand still at most before the damage is too great?
• What it needs: which people, systems, rooms and suppliers does the process rely on?

Two key figures follow from this:

• RTO (recovery time objective): by when must the process or system be running again?
• RPO (recovery point objective): how much data may be lost at most? An RPO of four hours means: at most the data of the last four hours may be missing. This decides how often backups must be made.

The Process in Six Steps

1. Set the frame: top management adopts a policy, names who is in charge and sets out which areas are covered.
2. Business impact analysis: identify critical processes, downtimes, RTO and RPO.
3. Rate the risks: which threats are likely, and where are the weak spots? See IT risk management.
4. Develop strategies: for example a backup site, remote work, manual fallback steps, a second supplier, spare systems and backups.
5. Write the plans: emergency manual, IT recovery plans, alert list, plan for who tells whom what, and the tasks of the crisis team.
6. Practice and improve: test often, learn from it and update the plans.

What Belongs in an Emergency Plan

• Alerts: who is told, when and how? With phone numbers that work even when email and the network are down.
• Crisis team: who decides? With a deputy for every role.
• Immediate actions: what must be done in the first hours?
• Emergency mode: how do the critical processes keep running in a limited way?
• Restart: in what order are systems and processes brought back?
• Communication: what do staff, customers, authorities and the press learn?
• Contacts: service firms, insurance, lawyers and the authorities.

Important: you must be able to get to the plan even when IT is down, for example as a printout or on a separate system.

Backups as the Foundation

Without working backups, there is no way back. The 3-2-1 rule has proven itself: three copies of the data on two different types of storage, one of them kept off-site. Against ransomware, a copy that cannot be changed or is cut off from the network also helps. Just as important: test that you can restore the data, on a regular basis.

Tests and Exercises

• Plan review: the people involved go through the plan together.
• Tabletop exercise: a scenario is played through at the table, for example a ransomware attack.
• Function test: single steps are really carried out, such as restoring a server.
• Full drill: an emergency is played out as close to real life as possible, such as moving to a backup site.

Exercises should take place at least once a year and after major changes.

Standards and Duties

• ISO 22301: the world standard for business continuity. Companies can get certified against it.
• BSI standard 200-4: describes BCM as part of the BSI IT-Grundschutz.
• ISO 27001: requires information security during disruption in A.5.29 and ICT readiness for business continuity in A.5.30.
• NIS-2: requires companies in scope to take measures for business continuity, such as backup management and disaster recovery, as well as crisis management. See NIS-2.
• DORA: sets its own rules for keeping IT running at banks, insurers and other financial firms.

Common Mistakes

• Only looking at IT: people, buildings and suppliers can fail too.
• Plan in a drawer: a plan that no one has ever tried out rarely works in a real emergency.
• Out of reach: the plan is only stored on the server that has just failed.
• Old contacts: phone numbers and roles change.
• Untested backups: only in an emergency do you find out that the restore does not work.

Software Support

The business continuity and crisis management module of SecTepe.Core covers business impact analysis (BIA), scenarios, crisis team, emergency drills and ISO 22301.

Conclusion

Business continuity planning makes sure a company can still act during cyberattacks, fires or supplier failures. The basis is the business impact analysis with clear goals for RTO and RPO. What counts are plans you can reach even without IT, tested backups and regular drills.