5.1.3. Business Continuity and Disaster Recovery Planning
💡 First Principle: Continuity and recovery planning exist to answer two different questions under pressure — how does the business keep operating at all, and how do the specific systems get restored — and conflating them produces a plan that's vague about both.
A Business Continuity Plan (BCP) addresses how critical business functions continue operating during any disruption — a natural disaster, a pandemic, a security incident — often through manual workarounds or alternate sites, independent of how the underlying IT systems get fixed. A Disaster Recovery Plan (DRP) is the more technical companion, focused specifically on restoring IT systems and data to the RTO/RPO targets the BIA established. An incident response plan, in turn, has to integrate with both: a security incident severe enough to take core systems offline should trigger DRP-level system recovery and, if business operations are affected long enough, BCP-level continuity measures — three plans, three distinct scopes, one coordinated response.
⚠️ Exam Trap: BCP, DRP, and IR plans are frequently assumed to be interchangeable or redundant. The correct reasoning treats them as complementary, requiring explicit integration points (which trigger conditions in one plan invoke another) rather than a single merged document.
Reflection Question: A ransomware incident encrypts production systems for 36 hours. Which plan governs restoring the encrypted systems, and which plan governs how the business keeps serving customers manually in the meantime?
