Network Trace
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

10) Does your organisation have an approved Business Continuity Plan to ensure the continuity of service in a disaster?

January 30, 2023
Business Resilience
Business Continuity Plan

Answer yes if your organisation has a documented business continuity plan that has been reviewed and approved by senior management in the last year. Please provide the Business Continuity Plan (as a PDF file) as evidence.

A documented Business Continuity Plan (BCP) should provide all the information your business needs in order to manage an immediate incident, continue operations during the incident as far as practicable with the facilities available, and recover critical business activities back to a normal state.

The Business Continuity Plan should define or refer to the context of the business; the client commitments and stakeholders; the critical suppliers, service providers and logistical facilities that underpin normal operations that will help to inform a response to whatever crisis situation is encountered.

A Business Continuity Plan differs from a Disaster Recovery (DR) plan: A Disaster Recovery plan focuses primarily on incident containment, control and recovery of operational activities, IT systems and data. A Business Continuity Plan plan includes a Disaster Recovery plan amongst other plans to help minimise the impact of disrupted business processes, employees, and the organisation as a whole, operating the business in its degraded state while capabilities and services are restored.

Your Business Continuity Plan should define whom within your business can declare a ‘crisis situation’, and once declared, the plan should outline the steps that should be followed to maintain business activities and recovery priorities for each business function. This should include contingency planning for alternative services and operations to enable resilience. For example, the plan may propose alternative communication methods in the event that internet connection disruption makes email and other messaging services inoperable from the desktop.

How to implement the control

To implement this control you will need to design and document a Business Continuity Plan. The plan will need to be tailored to your particular organisation’s process for identifying and responding to a ‘crisis situation’.

Various Business Continuity Plan templates can be found online. It is important that whichever template you choose, it is subsequently tailored to your specific requirements and operational processes. This will require input from many business areas and the plan should be thoroughly tested to ensure its effectiveness.

For larger organisations, or organisations that provide a critical service to their clients, a business continuity expert should be engaged to conduct a full business resilience assessment. As part of the assessment they will evaluate and recommend improvements to your Business Continuity Plan.

The Business Continuity Plan should be reviewed periodically to ensure that the information is maintained in line with business changes and, where practicable, physically rehearsed to confirm the plan remains viable.

If you would like to contribute to this article or provide feedback, please email Contributors will be recognised on our contributors page.

Pattern Trapezoid Mesh

Defend against supply chain attacks with Defend-As-One.

No organisation is an island.