A Business Continuity Plan (BCP) outlines how a process will continue during a disruption. A Disaster Recovery Plan (DRP) details how the necessary resources will be restored. Both plans address different questions and must reference each other: What process performance do we need by when – and how do we provide the necessary technology, infrastructure, or other resources?
Table of Contents
Starting Point BIA
From which target times and resources are derived
What belongs in a BCP
Components and their purposes
When a DRP is needed
Restoring resources and resource groups
How to use the templates
From process to resource group
Further Reading
In-depth information at NOVELEDGE
Sources
Standards and guidelines
Starting Point BIA
From which target times and resources are derived
The starting point is the Business Impact Analysis (BIA). It shows the consequences of a process failure as its duration increases. From this, the time requirements and necessary resources are derived. The BSI describes this connection between business processes, resources, and recovery planning in Standard 200-4.[1]
What belongs in a BCP
Components and their purposes
A BCP should be quickly readable in an event. Therefore, it contains the decisions and information needed to continue the process, not every technical detail.
| Component | What is it needed for? |
|---|---|
| Process and Scope | To clarify which service is disrupted, for whom the plan applies, and what it regulates. |
| Consequences of Disruption by Time Stages | To ensure decisions are based on specific consequences. Operational, financial, legal, and reputational impacts, as well as potential harm to people and the environment, can be considered separately. The organisation must define and explain the assessment scale. |
| MTPD and RTO | The MTPD refers to the maximum tolerable period of disruption. The RTO is the earlier target for resuming the required process performance. |
| Minimum Operation | Measurable sub-goals describe the minimum performance that must be achieved despite disruption. This minimum operational level is also known as MBCO. |
| Resources and Dependencies | For each sub-goal, it must be clear which resources are needed, why they are needed, and which alternatives are truly viable. |
| Organisational Continuation | Prepared measures such as work relocation or a manual procedure can bridge time. Their prerequisites and limitations are included. |
| Responsibility and Decisions | The plan specifies who activates it, who is informed, and who confirms the return to normal operations. |
Escalate Early
A BCP should enable early escalation. If it becomes apparent that the RTO will not be met, the information must be communicated to the responsible management before the target time expires. A detailed exercise scenario, observation tasks, and test results should be documented separately.
When a DRP is Needed
Restoring Resources and Resource Networks
A DRP is advisable when restoring a critical resource requires more than a simple, well-known routine. This can involve IT infrastructure, but also technical facilities, building services, or a network of interdependent resources. In this article, we use „DRP“ for such a resource network. In other organisations, the term „recovery plan“ may be more appropriate.
What a DRP Records
The DRP identifies the resources included, their prerequisites, and the order of restoration. It records which security clearances are necessary before interventions, who performs the work, how the restored function is recognised, and how it is returned to process operation. In cases of danger to people or the environment, protective measures take precedence over a target time. For complex IT systems, NIST also recommends a comprehensible sequence and verifiable recovery steps.[2]
Tailoring the Plans
Not every single resource requires its own DRP. Related resources can be included in one plan if their dependencies, responsibilities, and restoration can be meaningfully described together. Conversely, a DRP can support multiple BCPs. Therefore, it should explicitly mention the affected processes and minimum operational goals.
How to Use the Templates
From Process to Resource Network
Start with a clearly defined process and its temporal disruption consequences. Then formulate the minimum operation as verifiable sub-goals. Assign the required resources, contacts, and prepared alternatives to these goals. Only from these requirements does it become clear which resource networks need a DRP and what target time their restoration must meet.
Review and Exercise the Plans
Subsequently, review both plans with the responsible departments and in an exercise: Are the contacts reachable? Are alternative routes possible under the described conditions? Do approval and restoration take longer than assumed? Record the results in a separate review or exercise log and update the plans. A completed template does not replace a professional review or applicable safety instructions.
Templates for BCP and DRP
General working templates to be customised for your own organisation. They are not certified and not ready-to-use emergency plans without adaptation.
Further Reading
In-depth Topics at NOVELEDGE
- Business Impact Analysis at NOVELEDGE – how to determine impact consequences and time requirements
- BCM Terms RTO, MTPD and MBCO – target times and minimum operation in context
Sources
Standards and Guidelines
The terms and contexts in this article are based on the following freely available sources.
- Bundesamt für Sicherheit in der Informationstechnik: BSI-Standard 200-4 – Business Continuity Management. Version 1.0, 2023. Referenced: Business Impact Analysis as well as Business Continuity and Recovery Planning. Freely available at BSI. ↑
- National Institute of Standards and Technology: NIST Special Publication 800-34 Rev. 1 – Contingency Planning Guide for Federal Information Systems. 2010. Referenced: Recovery Phase. Freely available at NIST. ↑
