Business Continuity Plan
A documented plan for keeping essential operations running during and after a disruption.
Definition
A business continuity plan (BCP) is a documented set of arrangements that allow an organisation to keep delivering its essential functions during and after a disruption, covering people, premises, processes, suppliers and technology.
A BCP is broader than disaster recovery. Disaster recovery answers how IT systems come back; a BCP answers how the organisation keeps serving customers even while they are down. That includes manual workarounds, alternative premises, delegated authority when decision-makers are unreachable, and how you communicate with customers and regulators.
The foundation is a business impact analysis (BIA), which identifies the organisation's essential functions and how quickly each must resume before the consequences become unacceptable. Without a BIA, continuity planning tends to protect whatever is most visible rather than whatever matters most, and recovery priorities get argued about during the incident instead of before it.
The document is the least important part. What determines whether a BCP works is whether people have practised it: whether staff know their role without reading it, whether the call tree reaches real people, and whether delegated authority is understood. Plans that exist only to satisfy an audit reliably fail at the moment they are needed.
At a glance
- Type
- Resilience plan
- Also known as
- BCP, business continuity planning, rencana keberlangsungan bisnis
How it works
- 1
Business impact analysis: identify essential functions and the maximum tolerable outage for each
- 2
Risk assessment: determine what could disrupt those functions
- 3
Strategy: decide how each function continues, including manual and alternative-site options
- 4
Documentation: record roles, decision authority, contacts and communication paths
- 5
Exercise and review: test the plan, correct what failed, and refresh it after significant change
Key points
- A BCP covers the whole organisation; disaster recovery covers IT restoration within it
- A business impact analysis is the foundation, because it sets recovery priorities in advance
- Manual workarounds matter, since technology may be unavailable for longer than expected
- Delegated authority must be explicit, as decision-makers may be unreachable
- An unexercised plan is a document, not a capability
Best practices
- Base priorities on a BIA rather than on organisational politics
- Exercise at least annually, including at least one scenario where the primary technology is unavailable
- Keep an offline copy of the plan, since a plan stored only on the affected network is inaccessible when needed
- Include third-party and supplier failure, which is increasingly the more likely disruption
- Brief staff on how to verify identity during a disruption, because that is when impersonation succeeds
Real-world example
An Indonesian government agency exercises its BCP and discovers the plan is stored on the file server it assumes has failed, the emergency contact list is two years old, and nobody outside IT knows who may authorise a manual process. All three are fixed in a week. None would have been found by reviewing the document.
How Claro helps
Continuity plans assume staff behave correctly under pressure, which is exactly when social engineering succeeds. Attackers exploit disruption because urgency and broken systems make bypassing verification feel reasonable. Claro rehearses that pressure specifically, including vishing scenarios where a caller poses as IT during an outage.
Frequently asked questions
What is a business continuity plan?
A BCP is a documented set of arrangements that let an organisation keep delivering essential functions during and after a disruption. It covers people, premises, processes, suppliers and technology, not just IT.
What is the difference between BCP and disaster recovery?
Disaster recovery is the IT restoration component: how systems and data come back. A BCP is broader, covering how the organisation keeps operating even while systems are down, including manual workarounds and alternative premises. DR sits inside BCP.
What is a business impact analysis?
A BIA identifies the organisation's essential functions and how quickly each must resume before consequences become unacceptable. It is the foundation of a BCP because it sets recovery priorities in advance rather than during an incident.
How often should a BCP be tested?
At least annually, and after any significant change to systems, premises, suppliers or structure. Include at least one exercise where primary technology is assumed unavailable, since that is the scenario documents most often fail to survive.
Related terms
Disaster Recovery
The plans and capabilities that restore IT systems and data after a disruptive event.
Incident Response
The structured process an organization follows to detect, contain, investigate, and recover from a security incident.
Ransomware
Malware that encrypts an organisation's files or locks its systems, then demands a payment to restore access.
Human Risk Management
A security discipline that identifies, measures, and reduces the risk that people introduce through their everyday behavior.
Reduce your human risk
Claro measures and lowers the risk these terms describe, in English and Bahasa Indonesia.
Request a demo