Business Continuity Planning - Surviving Disruptions

About 2 min read

A Business Continuity Plan (BCP) is a comprehensive plan and framework for keeping critical business activities running without interruption, or for resuming them as quickly as possible, even under crisis conditions such as natural disasters, pandemics, and cyberattacks. ISO 22301 is widely referenced as the international standard for business continuity management systems. As of 2025, with the increase in ransomware attacks and supply chain disruptions, the number of companies developing and reviewing their BCPs is rapidly growing.

Fallback Procedures That Keep Work Moving While Systems Are Down

The role of a BCP becomes easier to see if you picture core systems brought down by ransomware or a similar event. Restoring the IT systems and keeping the business running in the meantime are separate problems, and one established approach is to define in advance fallback procedures that do not depend on the systems — such as handling core work like order intake and shipping on paper forms. A fallback procedure that exists only as a document, however, rarely works in a real crisis; only once routine drills have confirmed that it can actually be carried out does it become a viable way to keep operating in parallel with the recovery effort.

The Difference from Disaster Recovery (DR)

Whereas disaster recovery (DR) is a technical plan focused specifically on restoring IT systems, a BCP is a continuity strategy for the entire business, led by executive management. It broadly covers non-IT elements as well, such as securing alternative offices, confirming the safety of employees, establishing communication channels with business partners, and manual procedures for substituting work. DR is an important component of a BCP, but the scope of a BCP is far broader.

Steps for Developing a BCP

Developing a BCP begins with a Business Impact Analysis (BIA). You quantify the impact that the suspension of each business process would have on the business in terms of money and time, and determine recovery priorities. Next, in a risk assessment, you identify anticipated threats and vulnerabilities and devise countermeasures. You document the incident response procedures, communication plan, and recovery procedures, and verify their effectiveness through drills held at least once a year.

Cyberattacks and BCP

Ransomware attacks are one of the triggers for activating a BCP. In cases where all systems are encrypted and operations come to a complete halt, every element of the BCP is put to the test, including not only IT recovery but also continuing operations manually, notifying customers, and reporting to regulatory authorities. Protect access to BCP-related documents and emergency contact lists with strong passwords to prevent attackers from disrupting the recovery procedures.