Business Continuity Plan (BCP)
Definition
A document that specifies how an organisation keeps critical business functions operating during a significant disruption. The IR plan and BCP must cross-reference each other because a severe security incident may trigger BCP activation.
- Purpose
- Keeps critical business functions running during a disruption
- Related plan
- Incident response (IR) plan
- Trigger
- A severe security incident may activate the BCP
- Scope
- Broader than IT, covers operations, staffing and facilities
Common questions
How is a BCP different from an incident response plan?+
The IR plan focuses on detecting, containing and eradicating a security incident and restoring affected systems. The BCP focuses on keeping the wider business operating, for example by relocating staff or switching to manual processes, while the IR plan runs in parallel.
Why must the IR plan and BCP cross-reference each other?+
A severe incident, such as a ransomware outage of core systems, can force BCP activation partway through the IR process. Without cross-references, the two plans can issue conflicting instructions about roles, communications and recovery priorities at the moment they are needed most.
Related terms
- Communication Matrix
- A structured table in an IR plan that maps incident severity tiers to mandatory notification recipients, timelines, and communication channels. It removes...
- Disaster Recovery Plan (DRP)
- A plan focused on restoring IT systems and data after a major failure or destructive event. Often a subset of BCP. The...
- IR Plan
- The operational document that translates the policy into specific procedures, roles, severity tiers, communication chains, and recovery criteria. Versioned and reviewed at...
- IR Policy
- A management-approved governance statement that commits the organisation to an incident response programme, defines its scope, and grants authority to designated teams....
- Scope Statement
- The formal declaration at the start of a forensic report that defines what question the examiner was asked to answer. A scope...