# Business Continuity Plan (BCP)

> ISO 22301-aligned + ISO/IEC 27001:2022 A.5.29 (continuity during
> disruption) + A.5.30 (ICT readiness). Write BEFORE the disaster.

| Field | Value |
|-------|-------|
| Document ID | DOC-BCM-001 |
| Owner | Business continuity lead |
| Tested | Exercise date |
| Next review | YYYY-MM-DD |

## 1. Business impact analysis (BIA)

What breaks, how bad, how fast:

| Process | Critical function | Max tolerable downtime (MTPD) | Recovery time objective (RTO) | Recovery point objective (RPO) | Dependencies |
|---------|-------------------|-------------------------------|-------------------------------|--------------------------------|--------------|
| Process | function | N hours/days | N hours | N hours data loss | systems/staff |
| Revenue ops | order processing | 4h | 2h | 15min | payment, DB |
| Support | customer response | 24h | 8h | 1h | CRM |
| Product | service uptime | 1h | 30min | 0 | infra, data |

## 2. Threat scenarios

| Scenario | Likelihood | MTPD impact | Response plan |
|----------|------------|-------------|---------------|
| Office inaccessible | medium | low – remote work | activate WFH |
| Cloud region down | low | high | failover region |
| Key staff unavailable | medium | medium | cross-training + runbooks |
| Vendor outage | medium | per contract | backup vendor |
| Cyber incident | medium | high | IR plan DOC-ISMS-020 |

## 3. Continuity strategies

| Critical function | Strategy | Recovery steps |
|-------------------|----------|----------------|
| Function | workaround/alternate | step-by-step |

## 4. Incident roles & activation

| Role | Person | Backup | Contact |
|------|--------|--------|---------|
| BC coordinator | @name | | phone |
| Operations lead | @name | | |
| Communications | @name | | |

Activation: who declares "business continuity mode" – criteria.

## 5. Recovery procedures per scenario

| Scenario | Immediate actions | Recovery steps | Validation |
|----------|-------------------|----------------|------------|
| Office loss | evacuate, notify | WFH, reroute | ops check |
| System loss | declare incident | failover, restore | verify data |

## 6. Communications plan

- Internal: staff notification tree, status updates
- External: customer comms, media per PR policy
- Escalation: when/how to notify clients per contract SLA

## 7. Exercise & maintenance

- Tabletop: annually
- Live test: annually per scenario
- Review: after every activation + annual