Business continuity (BCP / DRP)
BCP · DRP · business continuity plan · disaster recovery plan · ISO 22301 · BIA · PCA · PRA
The business continuity plan (BCP) keeps essential activities running during a crisis; the disaster recovery plan (DRP) explains how to restart IT systems and recover data after a disaster.
In practice
Everything starts with a business impact analysis (BIA): which processes are vital, how long can they stop, how much data loss is tolerable (RTO and RPO). The BCP provides degraded modes (paper orders, fallback site, on-call rotas), the DRP covers backups, server rebuilds and the restart order. Against ransomware, you must plan for losing the entire information system at once, directory and email included, hence offline backups and fallback means of communication. A plan that has never been tested is only a hypothesis: run at least one exercise a year. The reference standard is ISO 22301.
Fictional case: a haulier is hit by ransomware at 6 a.m. on a Monday. Thanks to its BCP, drivers set off with rounds printed the day before; thanks to its DRP, tested in March, the operations software is restored from an offline backup within 30 hours.
