<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-business-continuity-planning
description: >-
  Develop and maintain business continuity plans ensuring organizational resilience during disruptions. Covers BIA, recovery strategies, and testing.
domain: cybersecurity
subdomain: governance-risk-compliance
tags:
  - bcp
  - business-continuity
  - disaster-recovery
  - resilience
  - iso-22301
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1490"]
---

# Performing Business Continuity Planning

## Overview

Business continuity planning (BCP) ensures critical business functions continue
during and after disruptions. BCP starts with Business Impact Analysis (BIA)
to identify critical processes, then develops recovery strategies, documents
plans, and validates through testing.

## Prerequisites

| Requirement | Install |
|---|---|
| Executive sponsorship | BCP program requires C-level commitment |
| Business process inventory | Documented critical functions |
| Risk assessment results | Identified threats and vulnerabilities |
| Python 3.10+ | For agent tooling |

## Key Concepts

### BIA Components

| Metric | Definition |
|---|---|
| RTO | Recovery Time Objective — max tolerable downtime |
| RPO | Recovery Point Objective — max acceptable data loss |
| MTPD | Maximum Tolerable Period of Disruption |
| MBCO | Minimum Business Continuity Objective |

### Recovery Strategies

- **Hot site** — Fully operational alternate facility (RTO: minutes)
- **Warm site** — Partially equipped facility (RTO: hours)
- **Cold site** — Empty facility (RTO: days)
- **Cloud DR** — Cloud-based failover (RTO: minutes to hours)
- **Mutual aid** — Agreement with partner organization

### Plan Structure

1. **Plan activation** — Triggers, escalation, and authority
2. **Communication** — Notification procedures
3. **Recovery procedures** — Step-by-step for each function
4. **Resource requirements** — People, technology, facilities
5. **Return to normal** — Transition back from recovery

## Workflow

1. **Conduct Business Impact Analysis** — identify critical functions and dependencies
2. **Assess risks** — evaluate threats to critical functions
3. **Develop recovery strategies** — select approach for each critical function
4. **Document BCP** — write recovery procedures and resource requirements
5. **Establish communication plan** — define notification chains and templates
6. **Test the plan** — conduct tabletop, walkthrough, and full exercises
7. **Review and improve** — update based on test results and organizational changes

## Quick Reference

```bash
# Run the agent
node scripts/agent.js analyze --target <scope>
node scripts/agent.js report --target <scope>
```

## Verification

| Check | Method |
|---|---|
| BIA complete | RTO/RPO defined for all critical functions |
| Strategies selected | Recovery strategy documented for each function |
| Plan documented | BCP reviewed and approved by leadership |
| Testing conducted | Annual exercise completed with documented results |
| Plan updated | BCP revised within 30 days of exercise or change |

## References

- [ISO 22301:2019](https://www.iso.org/standard/75106.html)
- [NIST SP 800-34](https://csrc.nist.gov/pubs/sp/800/34/r1/final)
- [BCI Good Practice Guidelines](https://www.thebci.org/)
- [FEMA Continuity Guidance](https://www.fema.gov/emergency-managers/national-preparedness/continuity)
