# Business Continuity Plan

## Purpose

This plan tells Your Organization what to do in the first hours and days of a disruption that threatens the organization's ability to deliver critical business processes — not just its IT systems. It works alongside the Business Continuity and Disaster Recovery Policy (which sets the program's objectives and tiering) and the Disaster Recovery Plan (which covers technical system recovery in detail).

## Scope

This plan applies to every critical business process identified by the Business Impact Analysis (BIA), and to the workforce members, facilities, and third parties those processes depend on. It covers non-technical continuity — people, process, facilities, and communications — leaving system-level recovery procedure to the Disaster Recovery Plan.

## Business Impact Analysis and priorities

The BIA is the plan's foundation. It identifies, for each business process: the maximum tolerable period of disruption (MTPD) before the impact becomes unacceptable, upstream and downstream dependencies (systems, suppliers, personnel, facilities), and the minimum resources needed to resume the process at a reduced level of service.

Processes are prioritized for recovery using the BIA's output, not by department size or visibility. A process with a four-hour MTPD is recovered before one with a five-day MTPD regardless of which team owns it. The BIA is refreshed at least annually and after any material change to how a critical process operates.

## Activation criteria

The BCM Lead or Incident Commander may recommend activation; only the Executive Sponsor (or their named delegate) may declare the plan active. Activation is considered when a disruption is expected to exceed 4 hours AND affects a process the BIA rates Tier 1 or Tier 2, or when a facility, region, or key system is confirmed unavailable with no immediate restoration path. A declared security incident that meets these criteria hands off from the Incident Response Plan to this plan without waiting for the incident to be fully resolved — the two run in parallel, coordinated through the Incident Commander.

## Roles

- **Executive Sponsor.** Declares and stands down the plan; makes cross-functional tradeoff decisions during activation.
- **BCM Lead.** Owns this plan's content and currency; coordinates the response across process owners during activation.
- **Process Owners.** Execute their process's continuity procedure (defined in the BIA) and report status to the BCM Lead.
- **Communications Lead.** Owns all internal and external messaging during a declared event (see Communications below).
- **Incident Commander.** Coordinates with the BCM Lead when activation follows a declared security incident.

## Communications

The Communications Lead issues the first internal status update within 1 hour of activation and at a cadence the Executive Sponsor sets thereafter (no longer than every 4 hours during an active event). External communications — customers, regulators, partners — follow the same approval chain as the Incident Response Plan's notification obligations: no external statement goes out without Communications Lead and Executive Sponsor sign-off. A single point of contact prevents conflicting statements from reaching the same audience.

## Alternate operations

Where a Tier 1 or Tier 2 process cannot run from its normal location or system, its BIA entry names the alternate arrangement (remote operation, a secondary facility, a manual workaround, or a designated backup vendor). Alternate arrangements are validated during the annual exercise, not assumed to work the day they are needed.

## Return to normal operations

Returning to normal operations is a deliberate, verified step, not an automatic one. Before the BCM Lead recommends stand-down to the Executive Sponsor: each activated process owner confirms their process is operating at full capacity on its primary systems and location, any data or transactions handled under the alternate arrangement have been reconciled against the primary system, and the Communications Lead has issued a close-out message to the same audiences that received the activation notice. The Executive Sponsor declares stand-down; the BCM Lead documents the timeline and opens remediation items for anything that did not go to plan.

## Testing and maintenance

This plan is tested at least annually via a tabletop exercise, and BIA-tier assumptions are re-validated whenever a covered process changes materially. Exercise and real-activation findings both feed remediation items tracked to closure by the BCM Lead.

## Review cadence

This plan is reviewed annually by the BCM Lead and the Executive Sponsor, or sooner following a real activation, a material change to a Tier 1 or Tier 2 process, or a significant BIA finding.

*Effective date: [the date this policy takes effect]*