Implementation of the business continuity plan involves each of the following steps EXCEPT

Business continuity planning is a crucial part of cyber security, but does your organisation have a system that accounts for its four phases?

The threat of data breaches looms over all organisations. A significant incident could cause irreparable damage and attract the attention of regulatory authorities. This is why all organisations need a BCP (business continuity plan). It contains a set of processes that helps organisations respond to disruptive incidents, including cyber attacks and other relevant threats such as power outages and adverse weather.

An organisation’s BCP should contain four phases:

Initial response
Relocation
Recovery
Restoration

Initial response

The first thing you must do after discovering a disruption is work out the severity of the damage. What systems and locations are inaccessible? Has any sensitive information been compromised?

Your BCP will list the actions that need to be taken in different scenarios, so all you need to do is align the damage with the appropriate response measures.

Relocation

The next step is to move affected areas of your business out of harm’s way. For example, if your infrastructure is damaged, you need to move equipment into another part of your office. The same is true for employees: if their workspaces are unavailable, you must find somewhere else for them to work.

As with the initial response, your BCP should include specific details based on each scenario. This will probably include things such as setting up temporary offices, or asking employees to share desks or work from home.

Recovery

With the affected area of your organisation isolated, it’s time to fix the problem. You can deal with some disruptions yourself, but there are times when you might need to bring in experts (as will be the case with fires, floods or disruptive weather events).

On other occasions, the recovery process might be out of your hands. For example, an electrical outage will probably need to be dealt with by the local power provider, and when disruption is caused by snow, you will simply have to wait for the weather to pass.

Restoration

Once the recovery process is complete, your organisation can return to business as usual. You first need to confirm that the recovery was successful, which can be done by performing a test. If that goes well, you can move everything and everyone back onto the premises and resume work.

Want to know more?

You can learn more about how to successfully respond to disruptions by reading our free green paper: Business Continuity Management – The nine-step approach. This guide explains:

How you can implement a BCP;
What you need to consider at each step of the process;
How to measure, monitor and review your plans;
The roles your staff will play; and
How you can conduct a business impact analysis.

Download now >>

About The Author

Luke Irwin

Luke Irwin is a writer for IT Governance. He has a master’s degree in Critical Theory and Cultural Studies, specialising in aesthetics and technology.

What Is a Business Continuity Plan (BCP)?

A business continuity plan (BCP) is a system of prevention and recovery from potential threats to a company. The plan ensures that personnel and assets are protected and are able to function quickly in the event of a disaster.

Key Takeaways

Business continuity plans (BCPs) are prevention and recovery systems for potential threats, such as natural disasters or cyber-attacks.
BCP is designed to protect personnel and assets and make sure they can function quickly when disaster strikes.
BCPs should be tested to ensure there are no weaknesses, which can be identified and corrected.

Understanding Business Continuity Plans (BCPs)

BCP involves defining any and all risks that can affect the company's operations, making it an important part of the organization's risk management strategy. Risks may include natural disasters—fire, flood, or weather-related events—and cyber-attacks. Once the risks are identified, the plan should also include:

Determining how those risks will affect operations
Implementing safeguards and procedures to mitigate the risks
Testing procedures to ensure they work
Reviewing the process to make sure that it is up to date

BCPs are an important part of any business. Threats and disruptions mean a loss of revenue and higher costs, which leads to a drop in profitability. And businesses can't rely on insurance alone because it doesn't cover all the costs and the customers who move to the competition. It is generally conceived in advance and involves input from key stakeholders and personnel.

Business impact analysis, recovery, organization, and training are all steps corporations need to follow when creating a Business Continuity Plan.

Benefits of a Business Continuity Plan

Businesses are prone to a host of disasters that vary in degree from minor to catastrophic. Business continuity planning is typically meant to help a company continue operating in the event of major disasters such as fires. BCPs are different from a disaster recovery plan, which focuses on the recovery of a company's IT system after a crisis.

Consider a finance company based in a major city. It may put a BCP in place by taking steps including backing up its computer and client files offsite. If something were to happen to the company's corporate office, its satellite offices would still have access to important information.

An important point to note is that BCP may not be as effective if a large portion of the population is affected, as in the case of a disease outbreak. Nonetheless, BCPs can improve risk management—preventing disruptions from spreading. They can also help mitigate downtime of networks or technology, saving the company money.

How to Create a Business Continuity Plan

There are several steps many companies must follow to develop a solid BCP. They include:

Business Impact Analysis: Here, the business will identify functions and related resources that are time-sensitive. (More on this below.)
Recovery: In this portion, the business must identify and implement steps to recover critical business functions.
Organization: A continuity team must be created. This team will devise a plan to manage the disruption.
Training: The continuity team must be trained and tested. Members of the team should also complete exercises that go over the plan and strategies.

Companies may also find it useful to come up with a checklist that includes key details such as emergency contact information, a list of resources the continuity team may need, where backup data and other required information are housed or stored, and other important personnel.

Along with testing the continuity team, the company should also test the BCP itself. It should be tested several times to ensure it can be applied to many different risk scenarios. This will help identify any weaknesses in the plan which can then be identified and corrected.

In order for a business continuity plan to be successful, all employees—even those who aren't on the continuity team—must be aware of the plan.

Business Continuity Impact Analysis

An important part of developing a BCP is a business continuity impact analysis. It identifies the effects of disruption of business functions and processes. It also uses the information to make decisions about recovery priorities and strategies.

FEMA provides an operational and financial impact worksheet to help run a business continuity analysis. The worksheet should be completed by business function and process managers who are well acquainted with the business. These worksheets will summarize the following:

The impacts—both financial and operational—that stem from the loss of individual business functions and process
Identifying when the loss of a function or process would result in the identified business impacts

Completing the analysis can help companies identify and prioritize the processes that have the most impact on the business's financial and operational functions. The point at which they must be recovered is generally known as the “recovery time objective.”

Business Continuity Plan vs. Disaster Recovery Plan

BCPs and disaster recovery plans are similar in nature, the latter focuses on technology and information technology (IT) infrastructure. BCPs are more encompassing—focusing on the entire organization, such as customer service and supply chain.

BCPs focus on reducing overall costs or losses, while disaster recovery plans look only at technology downtimes and related costs. Disaster recovery plans tend to involve only IT personnel—which create and manage the policy. However, BCPs tend to have more personnel trained on the potential processes.

Frequently Asked Questions

Why Is Business Continuity Plan (BCP) Important?

Businesses are prone to a host of disasters that vary in degree from minor to catastrophic and business continuity plans (BCPs) are an important part of any business. BCP is typically meant to help a company continue operating in the event of threats and disruptions. This could result in a loss of revenue and higher costs, which leads to a drop in profitability. And businesses can't rely on insurance alone because it doesn't cover all the costs and the customers who move to the competition.

What Should a Business Continuity Plan (BCP) Include?

Business continuity plans involve identifying any and all risks that can affect the company's operations. The plan should also determine how those risks will affect operations and implement safeguards and procedures to mitigate the risks. There should also be testing procedures to ensure these safeguards and procedures work. Finally, there should be a review process to make sure that the plan is up to date.

What Is Business Continuity Impact Analysis?

An important part of developing a BCP is a business continuity impact analysis which identifies the effects of disruption of business functions and processes. It also uses the information to make decisions about recovery priorities and strategies.

FEMA provides an operational and financial impact worksheet to help run a business continuity analysis.

These worksheets summarize the impacts—both financial and operational—that stem from the loss of individual business functions and processes. They also identify when the loss of a function or process would result in the identified business impacts.

The Bottom Line

Business continuity plans (BCPs) are created to help speed up the recovery of an organization filling a threat or disaster. The plan puts in place mechanisms and functions to allow personnel and assets to minimize company downtime. BCPs cover all organizational risks should a disaster happen, such as flood or fire.

What are the steps of business continuity plan?

6 Steps for Developing a Business Continuity Plan.

Assess Your Risks. Regardless of your company's size or structure, you need to understand where your risks lie so you can reduce or eliminate them. ... .

Perform a Business Impact Analysis. ... .

Identify Critical Systems. ... .

Back Up Your Data. ... .

Plan for Recovery. ... .

Test Your Plan (Regularly).

What are the 5 components of a business continuity plan?

In order to achieve this, every business continuity plan needs to incorporate five key elements..

Risks and potential business impact. ... .

Planning an effective response. ... .

Roles and responsibilities. ... .

Communication. ... .

Testing and training..

What are the 7 steps of continuity management?

7 Steps to Create a Business Continuity Plan + Webinar Replay.

Step 1: Regulatory Review and Landscape. ... .

Step 2: Risk Assessment. ... .

Step 3: Perform a Business Impact Analysis. ... .

Step 4: Strategy and Plan Development. ... .

Step 5: Create an Incident Response Plan. ... .

Step 6: Plan Testing, Training and Maintenance. ... .

Step 7: Communication..

What are the 3 elements of business continuity?

A business continuity plan has three key elements: Resilience, recovery and contingency. An organization can increase resilience by designing critical functions and infrastructures with various disaster possibilities in mind; this can include staffing rotations, data redundancy and maintaining a surplus of capacity.