What the plan is
A business continuity plan is how the organization keeps its critical services going during a disruption and brings them back. It is broader than disaster recovery, which restores technology. It names the services, the people, the workarounds, and the recovery targets.
The pieces, in order
Start with a risk assessment: what can stop a critical service. The threat-analysis page covers hazards, suppliers, cloud dependencies, single-source concentration, and geopolitical disruption. Then do the business impact analysis: recovery time, recovery point, and the financial and cascade effects of being down. Then choose strategies, including where technology recovers (cold, warm, hot, or cloud). Then write the procedures and the crisis roles. Then test.
Make it runnable
Name who can declare an incident, who covers each critical service, and what the workaround is if the usual site or system is gone. A plan that depends on one person or one untested supplier is a gap, not a plan.
Test and revise
An exercise shows whether the recovery time is real. Record what failed and change the plan, then capture findings in a structured post-crisis review. Do not treat a tabletop that never touched the workaround as proof the service can survive.
What this guide is not
This page is the overview. Detailed methods live on the threat-analysis, business impact, site-selection, and exercise pages. Do not copy those pages into this one.
What the plan is
A business continuity plan is how the organization keeps its critical services going during a disruption and brings them back. It is broader than disaster recovery, which restores technology. It names the services, the people, the workarounds, and the recovery targets.
A business continuity plan is how the organization keeps its critical services going during a disruption and brings them back. It is broader than disaster recovery, which restores technology. It names the services, the people, the workarounds, and the recovery targets.
The pieces, in order
Start with a risk assessment: what can stop a critical service. The threat-analysis page covers hazards, suppliers, cloud dependencies, single-source concentration, and geopolitical disruption. Then do the business impact analysis: recovery time, recovery point, and the financial and cascade effects of being down. Then choose strategies, including where technology recovers (cold, warm, hot, or cloud). Then write the procedures and the crisis roles. Then test.
Start with a risk assessment: what can stop a critical service. The threat-analysis page covers hazards, suppliers, cloud dependencies, single-source concentration, and geopolitical disruption. Then do the business impact analysis: recovery time, recovery point, and the financial and cascade effects of being down. Then choose strategies, including where technology recovers (cold, warm, hot, or cloud). Then write the procedures and the crisis roles. Then test.
Make it runnable
Name who can declare an incident, who covers each critical service, and what the workaround is if the usual site or system is gone. A plan that depends on one person or one untested supplier is a gap, not a plan.
Name who can declare an incident, who covers each critical service, and what the workaround is if the usual site or system is gone. A plan that depends on one person or one untested supplier is a gap, not a plan.
Test and revise
An exercise shows whether the recovery time is real. Record what failed and change the plan. Do not treat a tabletop that never touched the workaround as proof the service can survive.
An exercise shows whether the recovery time is real. Record what failed and change the plan. Do not treat a tabletop that never touched the workaround as proof the service can survive.
What this guide is not
This page is the overview. Detailed methods live on the threat-analysis, business impact, site-selection, and exercise pages. Do not copy those pages into this one.
This page is the overview. Detailed methods live on the threat-analysis, business impact, site-selection, and exercise pages. Do not copy those pages into this one.