Business Continuity Planning
Business Continuity Planning (BCP) is the broader discipline of keeping the BUSINESS running through major disruption — not just IT systems. Where Disaster Recovery (DR) restores technology, BCP keeps revenue, customer service, payroll, supplier payments, and regulatory commitments operating during the disruption itself.…
The trap
The trap is treating BCP as IT's responsibility. BCP is a business discipline that requires Finance (alternate payment paths), HR (workforce continuity), Legal (regulatory obligations), Operations (supplier redundancy), Communications (customer + employee + media messaging), and IT (systems recovery). When IT 'owns BCP,' the resulting plan addresses systems and ignores everything else — meaning when a non-IT disruption hits (key supplier bankruptcy, executive incapacitation, regulatory shutdown), the org has no playbook. The other trap: BCPs that exist as binders and have never been exercised cross-functionally. Like DR plans, untested BCPs fail on contact with reality.
What to do
Run a Business Impact Analysis (BIA) every 18 months: identify the 10-20 critical business processes, their RTOs in business-impact terms (revenue loss, regulatory penalty, customer harm), and dependencies (people, systems, suppliers, locations). For each, document a continuity strategy: what happens in hour 1, hour 8, day 1, day 7. Run a cross-functional tabletop exercise quarterly with a realistic scenario (ransomware that locks payroll for 5 days; key supplier files for bankruptcy with 30-day notice; a regional pandemic that takes 40% of the workforce offline). Update the plan based on what the tabletop revealed. Tie executive bonuses to BCP exercise completion and demonstrated readiness, not just plan documentation.
Formula
In practice
The COVID-19 pandemic in 2020 was the largest BCP stress test in modern history. Organizations that had previously invested in remote-work capability, distributed operations, and digital-first processes (Atlassian, Stripe, GitLab) transitioned in days. Organizations whose BCPs assumed disasters were physical and localized (single building, single region) struggled for months. Post-2020, regulators in financial services (UK FCA, US Fed/OCC, EU DORA) mandated 'operational resilience' frameworks that go beyond traditional BCP — requiring named tolerance levels for disruption to important business services and proof through scenario testing. The lesson: BCPs designed for the last disaster don't work for the next one; the discipline is continuous scenario refresh.
Pro tips
- 01
The single most important BCP question: 'If our HQ became inaccessible tomorrow, could we run the business in 4 hours from anywhere else?' If the answer is no, you don't have BCP — you have a recovery plan that depends on the building being available.
- 02
Run an 'inverse BCP' once a year: ask each business unit what would happen if THEY were unavailable to the rest of the company for 2 weeks. The dependencies and bottlenecks surfaced are usually different (and worse) than what top-down BIA produces.
- 03
BCP for suppliers and partners is often weaker than BCP for internal functions. Map your top 20 suppliers' BCPs — for each, do they have one? When was it last tested? Who's responsible at their org? This is where most enterprises discover concentration risk they didn't know existed.
Myth vs reality
Myth
“BCP and DR are the same thing”
Reality
DR is a subset of BCP focused on IT systems. BCP is the broader discipline covering people, processes, suppliers, locations, communications, and IT. A great DR plan with no BCP means you can restore systems but can't actually run the business when it matters. A great BCP without DR means you have plans but no systems.
Myth
“Cloud and SaaS adoption eliminate the need for BCP”
Reality
Cloud removes some failure modes (datacenter loss) but introduces others (provider region outage, account compromise, vendor bankruptcy, SaaS provider acquired and discontinued). Modern BCP needs to address: what happens if our primary SaaS vendor for [payroll / CRM / ERP] is unavailable for 7 days? Most enterprises have no answer.
Try it
Run the numbers.
Pressure-test the concept against your own knowledge — answer the challenge or try the live scenario.
Knowledge Check
An enterprise's BCP focuses heavily on physical disasters (fire, flood, earthquake) at HQ. A ransomware attack encrypts the customer-facing platform for 9 days. The BCP turns out to be useless. What's the structural problem?
Industry benchmarks
Is your number good?
Calibrate against real-world tiers. Use these ranges as targets — not absolutes.
BCP Maturity Levels (operational resilience perspective)
Enterprise operational resilience benchmarks (cross-industry)Leading: scenario library current, quarterly cross-functional exercises, regulator-grade
Top 10%
Strong: BIA current, annual exercises, named owners for top processes
Next 25%
Adequate: BCP exists, last exercised in past 24 months
Middle 40%
Weak: BCP exists as document, never exercised cross-functionally
Bottom 15%
Absent: no formal BCP, IT-only DR plan
Bottom 10%
Source: Hypothetical: ClarWorks synthesis from public regulator publications (UK FCA, EU DORA, US Fed/OCC operational resilience guidance).
Real-world cases
Companies that lived this.
Verified narratives with the numbers that prove (or break) the concept.
Hypothetical: Global Insurer Post-COVID BCP Overhaul
Hypothetical illustration based on 2020-2023 industry pattern
Hypothetical: A $25B global insurer entered 2020 with a BCP focused on physical-site disruption (their primary scenarios were Tokyo earthquake, London Tube terrorist attack, NYC hurricane). When COVID-19 hit, their BCP provided no playbook for: (a) 100% remote workforce within 72 hours, (b) policy issuance dependent on physical signatures and notarization, (c) call centers in three countries simultaneously offline due to lockdowns. Recovery took 8-12 weeks of improvisation. Post-2020, they invested $40M over 3 years in a complete BCP overhaul: digital signature adoption, distributed call center architecture, work-from-anywhere capability for 35,000 employees, and a quarterly cross-functional tabletop program covering ransomware, pandemic-2.0, supplier collapse, and regulatory shutdown scenarios. The 2023 ransomware attempt on the firm was contained within 11 hours because the new BCP had an exercised playbook.
Pre-COVID BCP Focus
Physical site disruption only
COVID Recovery Time
8-12 weeks of improvisation
Post-2020 Investment
$40M over 3 years
2023 Ransomware Containment
11 hours (vs 5+ days industry avg)
Hypothetical demonstrates: BCPs designed for the last disaster don't survive the next one. The discipline isn't 'write a plan' — it's continuous scenario refresh. Post-COVID, physical-disaster-only BCPs are obsolete.
Hypothetical: Mid-Market Manufacturer with No BCP for Supplier Risk
Hypothetical illustration based on common 2022-2024 pattern
Hypothetical: A $400M industrial manufacturer had a comprehensive IT DR plan (RTO 4 hours, tested annually) but no BCP for supplier disruption. Their primary semiconductor supplier was sanctioned in 2022 due to geopolitical events with 30-day effective notice. The manufacturer had no qualified backup supplier, no inventory buffer beyond 45 days, and no playbook for supplier substitution. Production halted for 87 days while they qualified an alternative supplier. Revenue impact: ~$45M lost. Customer trust impact: 3 major customers shifted 60% of their orders to competitors. The CFO's post-mortem identified the missing BCP for supplier concentration risk — a gap their excellent IT DR plan obscured because 'we have continuity planning' had become shorthand for 'we have IT recovery.'
Production Halt Duration
87 days
Revenue Loss
~$45M
Customer Order Loss
3 customers, 60% of their volume
BCP Gap
Supplier concentration risk unplanned
Hypothetical demonstrates the danger of equating IT DR with BCP. An A+ DR plan with a missing supplier BCP still means the business stops. BCP must cover suppliers, workforce, and operations — not just systems.
Related concepts
Keep connecting.
The concepts that orbit this one — each one sharpens the others.
Beyond the concept
Turn Business Continuity Planning into a live operating decision.
Use this concept as the framing layer, then move into the matched diagnostic — or have us scope the build.
Typical response time: 24h · No retainer required
Turn Business Continuity Planning into a live operating decision.
Use Business Continuity Planning as the framing layer, then move into diagnostics or advisory if this maps directly to a current business bottleneck.