BC-DR – Part 3: Crafting a Business Continuity Plan — It’s Time to Stop Winging It

Here’s the reality: most Business Continuity Plans (BCP) out there are just pretty documents—files created for show, not for go. You know the type: they get dusted off once a year during a compliance audit, and no one looks at them again until the building’s on fire (literally or figuratively).

If that sounds like your BCP, you’re already in trouble. A real Business Continuity Plan isn’t some afterthought that gets shoved into a drawer. It’s a battle-tested playbook, the kind you don’t just look at—you live by. So if you’ve been winging it, or you’re treating continuity planning like a “we’ll figure it out” scenario, it’s time to wake up.

The Harsh Truth About Most BCPs

Let’s get one thing straight: most BCPs fail because they’re either too vague, too outdated, or nobody knows how to implement them when things go wrong. And when a crisis hits, nobody has time to fumble around with guesswork.

Here’s why most BCPs fall apart:

1. They Aren’t Specific Enough: “We’ll handle any disruption by doing X.” Really? What kind of disruption? For how long? Which systems go down first? Who makes the decisions? If your plan doesn’t answer these questions in detail, you’re toast.
2. They Don’t Prioritize: Not everything in your business is mission-critical. A good BCP clearly defines which operations, systems, and processes must be maintained, and which ones can afford a little downtime. You’ve got to know your priorities—or you’ll waste time scrambling to fix things that don’t matter.
3. Nobody Knows the Plan: A plan that only exists on paper is a failure. If your team doesn’t know what the plan is, who’s in charge, or how to implement it, that plan might as well not exist. Your people need to be trained, and they need to know their roles before disaster hits, not during.
4. The Plan Isn’t Tested: The biggest mistake companies make is assuming that a plan works just because it looks good. You’ve got to test your plan—simulate disasters, run tabletop exercises, and get your hands dirty. A BCP is only as good as the last time it was put to the test.

The Anatomy of a Real BCP: No Fluff, Just Execution

Your Business Continuity Plan isn’t some lofty vision statement. It’s a survival guide. It tells you, step-by-step, how to keep the lights on when things go sideways. It’s not just about survival—it’s about making sure your business can still function while everything around you is falling apart. So how do you make a BCP that doesn’t suck? Start with these core elements:

1. Roles and Responsibilities:
   • Who does what when disaster strikes? Your BCP needs to clearly define who’s in charge and who’s handling what. Think of it like a chain of command in the military. Everyone needs to know their role, and there’s no room for “Who’s responsible for this?” when the fire’s already raging.
   • The Key Players: Your incident response team, your leadership team, your IT recovery crew, and your customer service squad—all these teams need predefined roles. Everyone’s got a job, and everyone knows who to report to.
2. Communication Strategy:
   • When chaos hits, confusion is your worst enemy. Your BCP should include a detailed communication plan. Who do you notify first? How do you keep your employees informed? What’s your plan for keeping customers, suppliers, and partners in the loop?
   • Make sure you have redundancies built into your communication channels. Phone lines might be down. Email might be out. Do you have text alerts? A social media response plan? Backup messaging platforms?
3. Critical Business Functions:
   • This is where the Business Impact Analysis (BIA) comes in handy. Your BCP needs to clearly identify which functions are mission-critical. These are the things you cannot afford to let go down—no matter what. Think of them as the heart and lungs of your business. Everything else? Those are the limbs—you can operate without them for a while.
   • For example, if you’re running an e-commerce business, your website is mission-critical. If your servers go down, you’re losing money every second. That’s a top priority. But your internal marketing tools? Those can wait. Prioritize, or you’ll end up wasting resources on the wrong things.
4. Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO):
   • Your BCP needs to be tied to the hard numbers you calculated during your BIA. What’s your RTO? How long can your business afford to be down before things get catastrophic? What’s your RPO? How much data can you afford to lose before you’re in serious trouble?
   • Your continuity plan needs to be built around these numbers. This isn’t about wishful thinking—it’s about realistic recovery goals. You can’t afford to guess.
5. Backup Systems and Resources:
   • What happens when your primary systems fail? Do you have backups ready to go? Your BCP should lay out exactly how you’ll restore critical systems and data when they go down. This could mean having backup servers, cloud infrastructure, or a failover data center ready to spin up when the primary one goes offline.
   • Don’t Forget the People: It’s not just about systems. What’s your plan for backup personnel? If key people can’t get to the office, are your teams set up for remote work? Can you relocate to another site?
6. Suppliers and Third Parties:
   • Your business doesn’t operate in a bubble. Your suppliers, vendors, and partners are all part of your continuity chain. What happens when your main supplier can’t deliver because they’re dealing with their own crisis? Does your BCP have a plan for alternate suppliers? Do you know how long you can survive if you can’t get those critical materials or services?
   • Make sure your Service Level Agreements (SLAs) with vendors include disaster recovery terms. If they can’t meet their SLAs during a crisis, what’s your plan B?

No Plan Survives Without Testing (And Yours Won’t Either)

If your BCP hasn’t been tested, it’s just a wish list. Let’s be clear: nothing ever goes according to plan in a real disaster. That’s why you’ve got to test your BCP like your business depends on it—because it does.

1. Tabletop Exercises:
   • Gather your team and walk through hypothetical scenarios. What if the building is flooded? What if your systems are hacked? What if there’s a power outage? How does each team respond? What obstacles come up that you didn’t expect? Tabletop exercises force you to think through each step of the plan—and they’ll reveal weaknesses you never thought of.
2. Simulated Disasters:
   • Take it up a notch and simulate real-world scenarios. Shut down systems. Run drills. Make your team act like it’s happening for real. This is where you’ll find out if your RTOs are realistic and if your team can handle the pressure. The goal is to expose the weak links in your plan—before they break in a real emergency.
3. Employee Training:
   • Everyone needs to know their role. Your employees should be trained regularly on the BCP, so they’re not scrambling to figure out what to do when things go wrong. Regular training sessions, refreshers, and even pop quizzes will make sure your team stays sharp and knows the plan by heart.

Case Study: A Global Shipping Giant Hit by Ransomware

Let’s talk about what happens when a Business Continuity Plan gets put to the ultimate test. One of the world’s largest shipping companies faced a devastating ransomware attack in 2017. Their entire IT infrastructure was wiped out in an instant, crippling operations across the globe.

But here’s the twist: because they had tested and refined their Business Continuity Plan ahead of time, they were able to bounce back. Their backup systems kicked in, and within 10 days, they had rebuilt their entire network from the ground up.

Without a battle-tested BCP, this company could’ve been sidelined for months. But because they had prepared, the damage was contained, and they were back in business in record time.

From Paper to Action: How to Build a BCP That Doesn’t Sit on a Shelf

The point of a BCP is simple: keep your business running when the world around you is falling apart. But you can’t do that if your plan is a static document collecting dust. You need to make your plan part of your company’s culture—something that’s alive, constantly updated, (dare I say “Organic?”), and always ready to go.

1. Keep It Current: Update your BCP regularly. Business processes change, new technology gets implemented, and the risks evolve. A BCP written two years ago won’t cut it today.
2. Involve Every Department: This isn’t just an IT plan. It’s a company-wide strategy. Every department, from HR to marketing, needs to have a say in the plan. You need cross-functional input because continuity isn’t just about keeping the servers up—it’s about keeping your whole business functioning.
3. Make It Accessible: Your BCP needs to be readily available. Not buried in a file somewhere. Have physical copies, digital copies, and backups of the plan itself. If your people can’t access the BCP in a crisis, you’re already failing.

What’s Next: Disaster Recovery Plans—When Your Tech Fails, What’s Next?

You’ve built your BCP. Now what? Well, you’re not done. Next up, we tackle Disaster Recovery Plans (DRP)—because your tech is going to fail, and when it does, you need to know how to recover fast. If you thought a BCP was critical, wait until you see how vital your DRP is when your systems go down and your data’s at risk.

A Business Continuity Plan that doesn’t get tested isn’t a plan—it’s a false sense of security. Build it, test it, live it. Your business depends on it