Business Continuity Plan (BCP)

BIA (RTO/RPO) + continuity + comms plan

Anleitung: BIA first (MTPD/RTO/RPO are derived, not invented). A BCP that's never exercised is a hypothesis, and auditors ask for exercise records.

Vorschau

ISO 22301-aligned + ISO/IEC 27001:2022 A.5.29 (continuity during disruption) + A.5.30 (ICT readiness). Write BEFORE the disaster.

What breaks, how bad, how fast:

Process	Critical function	Max tolerable downtime (MTPD)	Recovery time objective (RTO)	Recovery point objective (RPO)	Dependencies
Process	function	N hours/days	N hours	N hours data loss	systems/staff
Revenue ops	order processing	4h	2h	15min	payment, DB
Support	customer response	24h	8h	1h	CRM
Product	service uptime	1h	30min	0	infra, data

Scenario	Likelihood	MTPD impact	Response plan
Office inaccessible	medium	low – remote work	activate WFH
Cloud region down	low	high	failover region
Key staff unavailable	medium	medium	cross-training + runbooks
Vendor outage	medium	per contract	backup vendor
Cyber incident	medium	high	IR plan DOC-ISMS-020

Critical function	Strategy	Recovery steps
Function	workaround/alternate	step-by-step

Role	Person	Contact
BC coordinator	@name	phone
Operations lead	@name
Communications	@name

Activation: who declares "business continuity mode" – criteria.

Scenario	Immediate actions	Recovery steps	Validation
Office loss	evacuate, notify	WFH, reroute	ops check
System loss	declare incident	failover, restore	verify data