Business Continuity Plan: What It Is and How to Build One
A business continuity plan (BCP) is a documented set of instructions for how an organization keeps its critical business processes running during and after a significant disruption. NIST SP 800-34 Rev. 1 defines it that way, and separates it from a disaster recovery plan, which restores specific information systems. You build one by finding which processes matter most (a business impact analysis), setting how long each can be down and how much data it can lose, choosing recovery strategies, writing the procedures, and testing them.
Last reviewed 3 November 2026. This guide follows the public NIST publication and does not reproduce the paid ISO 22301 text. General information, not legal advice; US federal guidance is used as the reference.
Updated 3 November 2026
BCP, disaster recovery and incident response
These three plans overlap but answer different questions. NIST SP 800-34 distinguishes the first two directly; the third is the security-incident side that PlayCISO covers elsewhere.
| Plan | Focus | Example question |
|---|---|---|
| Business continuity plan | Sustaining mission and business processes during and after a disruption | How do we keep taking orders and paying staff while the system is down? |
| Disaster recovery plan | Restoring an information system or facility, usually at an alternate site | How do we bring the order system back, and where? |
| Incident response plan | Detecting, containing and eradicating a security incident | Who declares the incident, and how do we stop the spread? |
A ransomware event touches all three, which is why the plans should name each other and share contact lists. See the incident response plan builder and the incident response playbook guide.
The seven-step process
NIST SP 800-34 Rev. 1 defines a seven-step contingency planning process for information systems. It is written for US federal systems, but the sequence is a sound skeleton for any organization.
- Develop the contingency planning policy statement. A formal policy gives the authority and guidance to develop an effective plan.
- Conduct the business impact analysis. Identify and prioritize the systems and components that support critical processes.
- Identify preventive controls. Measures that reduce the effect of disruptions can increase availability and reduce recovery cost.
- Create contingency strategies. Recovery strategies so the system can be recovered quickly and effectively after a disruption.
- Develop the contingency plan. Detailed guidance and procedures for restoring the damaged system.
- Ensure plan testing, training and exercises. Testing validates recovery capabilities, training prepares recovery personnel, and exercises find gaps.
- Ensure plan maintenance. Keep the plan a living document, updated as systems and the organization change.
The business impact analysis, RTO and RPO
The BIA is the step everything else depends on. NIST describes three typical activities: determine the business processes and their recovery criticality; identify the resources needed to resume them, such as facilities, people, equipment, software, data and vital records; and identify recovery priorities for system resources so recovery can be sequenced.
The BIA produces the numbers that drive technology choices, using these NIST definitions:
- Maximum Tolerable Downtime (MTD): the total time the system owner or authorizing official is willing to accept for a business process outage.
- Recovery Time Objective (RTO): the maximum time a system resource can remain unavailable before there is an unacceptable impact. The RTO must normally be shorter than the MTD, because recovery work and reprocessing take time.
- Recovery Point Objective (RPO): the point in time to which data can be recovered after an outage, given the most recent backup. It reflects how much data loss the process can tolerate and, unlike the RTO, is not part of the MTD.
Practise setting these with the Business Impact Analysis Lab, which drills critical services, RTO and RPO and single points of failure.
Choosing recovery strategies
Match the strategy to the RTO and RPO the BIA produced, not to what a vendor sells. For facilities, NIST describes the common alternate site types from basic to advanced:
- Cold site: space and basic infrastructure such as power, telecommunications and environmental controls to support recovery.
- Warm site: partially equipped space with some or all of the hardware, software, telecommunications and power.
- Hot site: a facility sized and configured with the necessary hardware, infrastructure and support personnel.
- Mobile and mirrored sites: variations. A mirrored site is fully redundant with automated real-time mirroring and is the most expensive; NIST notes cold sites are the least expensive.
Backups are the floor under every strategy. Check yours with the backup 3-2-1-1-0 checker and make sure restores are actually tested with the restore test policy builder.
Test the plan
An untested plan is an assumption. NIST describes two basic exercise types. Tabletop exercises are discussion-based: personnel meet to talk through roles, responsibilities, coordination and decision making in a scenario. Functional exercises let personnel validate their operational readiness by performing their roles in a simulated event. NIST's sample policy and plan language calls for plans to be tested and reviewed annually; set your own cadence and retest after major changes. Run your first tabletop with the tabletop facilitation lab.
Where ISO 22301 fits
ISO 22301:2019, Security and resilience, Business continuity management systems, Requirements, is the international standard for a business continuity management system. It is a paid standard, so this guide does not reproduce its text; the public ISO publication page describes it. NIST SP 800-34 is free and a practical way to learn the mechanics before deciding whether certification is worth it.
Frequently asked questions
What is a business continuity plan?
NIST SP 800-34 Rev. 1 defines a business continuity plan (BCP) as the documentation of a predetermined set of instructions or procedures that describe how an organization’s mission and business processes will be sustained during and after a significant disruption. It focuses on keeping the business running, such as payroll or customer service, not only on restoring computers.
What is the difference between a BCP and a disaster recovery plan?
A BCP is about sustaining business processes through a disruption. In NIST SP 800-34, a disaster recovery plan (DRP) is an information-system-focused plan to restore a system, application or computer facility, usually at an alternate site, after an emergency. The DRP supports the BCP; neither replaces the other.
What is a business impact analysis (BIA)?
A BIA correlates systems with the business processes they support and characterizes the consequences of a disruption. NIST SP 800-34 describes three typical steps: determine business processes and recovery criticality, identify resource requirements, and identify recovery priorities for system resources. The results decide which processes are recovered first.
What are RTO, RPO and MTD?
NIST SP 800-34 defines Maximum Tolerable Downtime (MTD) as the total time the owner is willing to accept for a process outage. Recovery Time Objective (RTO) is the maximum time a system resource can stay unavailable before the impact becomes unacceptable, and it must normally be shorter than the MTD. Recovery Point Objective (RPO) is the point in time to which data can be recovered, which sets how much data loss is tolerable.
What does a business continuity plan include?
At minimum: the scope and policy, the BIA results with recovery priorities, the strategies chosen to meet them, activation and notification steps, recovery procedures, roles and contact lists, and a schedule for testing and maintenance. NIST’s seven-step process lists policy, BIA, preventive controls, strategies, plan development, testing and training, and maintenance.
How often should a business continuity plan be tested?
NIST SP 800-34 describes tabletop exercises (discussion-based) and functional exercises (staff perform their roles), and its sample policy and plan language calls for annual testing and review. Treat that as a starting point, and retest after major system, vendor or organizational changes.
Is ISO 22301 required?
No law requires it by itself. ISO 22301 is an international management system standard for business continuity (ISO 22301:2019, Security and resilience, Business continuity management systems, Requirements). Organizations adopt it by choice or because customers ask. Some sectors and contracts have their own continuity rules, so check what binds you.
Do small businesses need a BCP?
Any organization that depends on a few systems or suppliers benefits from knowing which processes it cannot do without and how long it can wait. A small business can start with a one-page version: critical processes, who to call, where backups are, and a restore test.