A business continuity plan answers a simple question: how do we keep working when something important stops? It could be a cyber attack, a power outage, a fire or the loss of a key supplier.
Start with the business impact analysis
The business impact analysis (BIA) shows which processes are critical and how long they can stay down before the damage becomes unacceptable. Without it, the plan protects everything equally, which means nothing well.
Two numbers to know
- RTO (Recovery Time Objective): how quickly a process or system must be restored.
- RPO (Recovery Point Objective): how much data you can afford to lose, measured in time. This number decides how often backups must be taken.
What the plan contains
- Who declares a crisis and who decides.
- Contact lists for staff, suppliers and key customers.
- Alternative ways of working for each critical process.
- The steps to recover systems and data.
- How to communicate with staff, customers and authorities.
Test it
A plan that has not been tried is only a document. Start with a tabletop exercise, where the team talks through a scenario step by step, then move on to technical tests such as restoring data from backups.
Review the plan at least once a year and after any major change to systems, offices or suppliers. The international standard for this field is ISO 22301.
