Business Continuity Planning

• The BCP is the umbrella that keeps the business running; the DRP is its IT subset
• Continuity planning protects the business; contingency planning protects the systems
• BCP is a recurring program, and authoring the plan is its midpoint, not its end
• A plan is a living document that must be reviewed on a cadence and on significant change
• Testing, training, and exercises are three distinct activities, not synonyms
• A tabletop exercise is discussion-based only; a functional exercise has staff perform their duties
• An unexercised plan is an untested assumption, so exercising surfaces the gaps
• Train recovery personnel at least annually, and new appointees shortly after appointment
• Store a plan copy at the alternate site and with the backup media so it survives the disaster
• Mark and control distribution because the plan holds sensitive information
• Enforce strict version control by recalling old plan pages when new ones are issued
• Run the BIA before choosing recovery solutions or sites
• The ISCP recovers one system regardless of site; the DRP is site-specific relocation
• Document every exercise in an after-action report and feed lessons learned back into the plan

Unlock with Premium — includes all practice exams and the complete study guide.