The method
The approach starts with the business impact analysis (BIA): identify essential activities, estimate the consequences of their interruption over time (financial, regulatory, reputational), and derive a maximum tolerable period of disruption.
For each activity and the systems supporting it, a recovery time objective (RTO — how long to restart) and a recovery point objective (RPO — how far back data loss is tolerable) are set.
These objectives guide the choice of continuity strategies (backup site, redundancy, remote work, service contracts) and the drafting of crisis procedures. ISO 22301 governs the business continuity management system; in France, the SGDSN guide is a widely used methodological reference.
When to use it
- Setting up a continuity arrangement for the first time, or reviewing it after an organisational or IT change.
- Regulatory or contractual requirement (DORA for financial services, NIS2, a client’s requirements).
- After an incident, to draw lessons and adjust the plan.
Watch out for
- A plan that is never tested gives false confidence: schedule regular exercises, including tabletop ones.
- A BCP often depends on external suppliers or providers: check their own continuity commitments.
- Prioritise RTO/RPO by real impact, not by how technically easy they are to meet.
Steps
- Identify the organisation’s essential activities and their dependencies (systems, suppliers, people, premises).
- Perform the BIA: estimate the impact of interrupting each activity over time.
- Set RTO and RPO for each critical activity and system.
- Choose continuity and recovery strategies, and draft crisis procedures.
- Test the plan regularly (exercises, technical tests) and keep it updated.
BCP guides and references
List from the Aurorisk catalogue, links checked on 2026-09-26. Confirmed free access is listed first; unknown information is labelled.
| Tool | Source · licence · access | Scope | Description |
|---|---|---|---|
| Ready.gov — Business Continuity ↗ | Public bodyFree | United States | Continuity plan template (FEMA). |
| SGDSN — guide PCA ↗ | Public bodyFree | France | Official guide with 27 practical sheets. |
Standards and references
- ISO 22301 — Continuité d’activité
- SGDSN — Guide pour réaliser un plan de continuité d’activité (2013)