What’s in a Business Continuity Plan?

The Business Continuity Program Lifecycle & Core Business Continuity Plan Components

One in five companies spends no time on business continuity plan maintenance, according to FEMA. Yet, the costs and risks of business disruptions can quickly escalate without an up-to-date business continuity and disaster recovery (BC/DR) plan.

When was the last time your organization exercised and updated your BC/DR plan? Do you know what should be in a comprehensive plan and which elements might be missing from yours?

Whether your team is developing a plan for the first time, needs to update, or could simply use a review of best practices, this overview provides a helpful breakdown of common business continuity plan components.

The Business Continuity Lifecycle

Business continuity planning tasks can be divided into four main phases:

1. Business impact analysis (BIA)
2. Risk assessment
3. Solutions and planning
4. Exercising and maintenance

This business continuity lifecycle is the foundation for both an effective plan and a successful continuity program. Let’s take a closer look at each stage.

Business Impact Analysis (BIA)

The business impact analysis identifies areas that would suffer the greatest financial or operational loss in the event of a disaster or disruption. This step helps organizations rate business processes by criticality to determine the order of restoration and refine their planning and recovery priorities.

Part of the BIA process also involves setting limits on acceptable operation levels following an incident, according to two metrics:

• Recovery Time Objective (RTO): the maximum amount of time a resource can be unavailable
• Recovery Point Objective (RPO): the maximum amount of data an organization can afford to lose or recreate

Learn More | BIA Best Practices: 5 Tips for a Better Business Impact Analysis

Risk Assessment

A location-based risk assessment analyzes threats and vulnerabilities that could lead to business interruptions and projects the likelihood and impact of those risks.

Solutions & Planning

This stage involves defining workarounds and strategies that will be initiated if a process or dependency were unavailable, as well as documenting steps or procedures to take in a disaster situation.

Exercising & Maintenance

Testing, or exercising, your business continuity plan confirms that your procedures will work in practice, not just on paper. This is an opportunity to exercise the higher risks and threats identified during the risk assessment with walkthroughs, tabletop exercises, and other training or workshops.

What does a business continuity plan typically include?

A complete business continuity plan (BCP) helps organizations and/or business units continue to operate during and after an unplanned incident through:

• Ensuring the safety of employees and visitors at your business location(s)
• Coordinating the recovery of critical business functions
• Mitigating threats and/or limiting downtime, data loss, and other damage
• Documenting plans and procedures to guide the efficient execution of recovery strategies

To support these functions, plans typically follow a common structure. Let’s look at core business continuity plan components in three categories:

Initial Response Procedures

What to include:

• Steps to ensure life safety
• Contact information for emergency situations
• Criteria for when involve senior management, declare a disaster, and/or initiate the business continuity process

→ Tip: How to decide if an event should trigger the business continuity process

Here are some questions to consider when documenting your criteria for putting your BCP into action:

• • Would coping with the situation extend beyond normal business/staff capabilities?
  • Will the event result in extended downtime?
  • What is the level of customer impact?
  • What is the local or regional impact (are other businesses or schools closed, etc.)?

When documenting criteria for escalating your response, customize the parameters to your organization and its individual locations, if applicable. In addition to specifying what kind of situations trigger a disaster declaration, make sure to outline the communication flow, including who has the authority to set the process in motion.

Continuity/Recovery Processes & Workaround Strategies

What to include:

• Steps for activating the teams responsible for crisis management and other response/recovery activities and notifying employees and customers
• Instructions for plan owners and other staff members on how to implement continuity and recovery steps
• Processes for assessing impact, resuming business processes or recovering assets, validating dependencies, and returning to normal operations
• Documentation of workarounds and strategies to address down dependencies
• Steps for transitioning from the alternate site for the primary/restored site

Reports & Supporting Documentation

What to include:

• Reports: BIA report, process report, location report, application report, employee detail report
• Other documents or appendices: policies, critical department procedures, location maps, employee and vendor call lists, process/dependency resumption priorities

How to Get Started With Business Continuity Planning & Maintenance

Working on getting internal support for developing or improving your business continuity program? Download our Business Continuity Buy-In Guide.

Then, to make sure all your business continuity plan components are organized and accounted for, download or print a copy of this Business Continuity Plan Checklist.

Plan Maintenance Tip: Organize and update business continuity plan components through data sharing

One of the most beneficial best practices for keeping business continuity plans up to date is to centralize and share data across departments and business units. For most organizations, this involves storing or compiling information in a central database so it can be leveraged across multiple plans. One way to get started is to identify data points that are “global,” or remain the same across plan types — this might include employee contact information or business location data. If you have a business continuity management tool that can then pull this information from a data library into your plan, then your continuity team or plan owners can significantly streamline the update and maintenance cycle.

Discover how Quantivate helps organizations like yours eliminate data silos and simplify workflows to quickly develop a complete business continuity plan: Learn more about our business continuity management software and services.