Business continuity plan
Also known as: BCP, continuity plan, business continuity, BC/DR
A business continuity plan (BCP) is a documented playbook for keeping essential operations running during a disruption (power outage, fire, cyberattack, key-staff loss) and recovering quickly afterward.
It answers, in advance, who does what, how to reach systems and data, and how to serve customers when normal isn't available.
Business continuity plan, explained at three levels
At home
A business continuity plan is like a family's fire escape plan. Everyone knows the meeting spot, who grabs the dog, and who calls whom, decided before the smoke appears. For a business, the plan covers what happens when the office floods, the internet fails, or ransomware hits: who decides, where people work, and how customers still get served while things are fixed.
At work
A business continuity plan (BCP) is a documented strategy for keeping essential operations running during a disruption and restoring normal service afterward. It covers people, premises, technology, suppliers, and communications, not just IT. For a small business, it means a power outage, cyberattack, or loss of a key person becomes a managed disruption instead of days of improvising, lost revenue, and frustrated customers.
At home
A practical plan has four parts. First, the critical functions: what must keep running, like taking payments or booking appointments. Second, their dependencies: the systems, data, people, and suppliers each one needs. Third, workarounds: what you do if a dependency fails, such as paper forms or a mobile hotspot. Fourth, contacts and roles: who decides, who calls whom, and how staff get updates if email is down.
At work
A BCP is built from a business impact analysis, which ranks functions and sets recovery targets: a recovery time objective (RTO) for how fast each must return, and a recovery point objective (RPO) for acceptable data loss. The plan then lists strategies to meet those targets, such as remote work, a second internet line, or DRaaS. Disaster recovery covers the IT piece; continuity covers the whole business.
At home
A plan is only as strong as its weakest dependency. If invoicing needs the accounting system, which needs the internet, which comes through one provider's line, then invoicing is no more resilient than that line. Plans also need scenarios, because losing the building, losing a key person, and losing a supplier demand different responses. While writing a plan feels like paperwork, in my view the thinking matters more than the document.
At work
Mature continuity management follows ISO 22301: business impact analysis, risk assessment, strategy selection, plan development, exercising, and review. Exercises range from tabletop walkthroughs to full technical failovers. Common failure modes include plans stored only on the systems that are down, out-of-date contact lists, and untested assumptions about suppliers. Plans should be reviewed after any major change and at least annually, with lessons from each exercise fed back in.
Real-world examples
At home
When a citywide power outage hit, Aisha's shop already had a simple continuity plan: staff switched to a mobile hotspot and the cloud point-of-sale kept taking payments on tablets. Competitors closed for the day; Aisha stayed open because she'd planned for it.
At work
After a ransomware scare, Jerome's clinic built a BCP with their MSP covering data recovery, a backup internet line, paper fallback forms, and a phone tree. When a fibre cut later took down their internet for a day, they followed the plan and kept seeing patients with minimal disruption.
Common confusions
- A business continuity plan is just IT disaster recovery — Disaster recovery restores technology; continuity keeps the whole business functioning (people, facilities, communications, and customers) of which IT recovery is one component.
- Only large companies need a BCP — Small businesses are often less able to absorb a prolonged outage. A simple, tested plan can be the difference between a bad week and closing for good.
- Writing the plan is the finish line — An untested plan usually fails under real pressure. Exercising and updating it is what makes it work when it counts.
For analysts
Start small and specific: list your top three critical functions, what they depend on, and the workaround for each if it's unavailable. A one-page tested plan beats a 50-page binder nobody has ever opened.
History & origin
Business continuity planning grew out of disaster recovery and emergency management, maturing after events like natural disasters and major IT outages showed that recovering technology wasn't enough: the whole business had to keep functioning. Pandemics, ransomware, and supply chain shocks broadened BCP from an IT concern to a whole-of-business discipline, and increasingly a customer and regulatory expectation.