business-continuity

name	business-continuity
description	Develop business continuity plans and impact analysis. Implement BCP testing and communication procedures. Use when building organizational resilience.
license	MIT
metadata	{"author":"devops-skills","version":"1.0"}

Business Continuity Planning

Develop and maintain business continuity capabilities including Business Impact Analysis, communication plans, recovery procedures, and testing schedules for organizational resilience.

When to Use

• Developing a formal Business Continuity Plan (BCP) for the organization
• Conducting a Business Impact Analysis (BIA) to prioritize recovery efforts
• Establishing communication plans for crisis scenarios
• Defining recovery procedures for critical business processes
• Scheduling and conducting BCP exercises and tests
• Meeting compliance requirements for continuity planning (SOC 2, ISO 27001, HIPAA, FedRAMP)

BCP Framework

bcp_phases:
  1_governance:
    actions:
      - Obtain executive sponsorship and funding
      - Assign BCP coordinator and team
      - Define BCP scope and policy
      - Establish BCP committee with cross-functional representation
    deliverables:
      - BCP policy statement
      - BCP team charter and roster
      - Scope document

  2_analysis:
    actions:
      - Conduct Business Impact Analysis (BIA)
      - Perform risk assessment for continuity threats
      - Identify critical business processes and dependencies
      - Determine recovery priorities and resource requirements
    deliverables:
      - BIA report
      - Risk assessment report
      - Critical process inventory

  3_strategy:
    actions:
      - Select recovery strategies for each critical process
      - Identify alternate work arrangements (remote, alternate site)
      - Define technology recovery strategies (DR plan)
      - Establish vendor and supply chain contingencies
    deliverables:
      - Recovery strategy document
      - Technology recovery plan
      - Alternate site arrangements

  4_plan_development:
    actions:
      - Write detailed recovery procedures
      - Develop communication plans (internal and external)
      - Create emergency response procedures
      - Document roles, responsibilities, and contact information
    deliverables:
      - Business Continuity Plan document
      - Communication plan
      - Emergency response procedures
      - Contact lists and call trees

  5_testing:
    actions:
      - Develop test plan and schedule
      - Conduct exercises (tabletop, functional, full-scale)
      - Evaluate results and identify gaps
      - Update plans based on lessons learned
    deliverables:
      - Test plan
      - Exercise reports
      - Updated BCP based on findings

  6_maintenance:
    actions:
      - Review and update BCP annually (minimum)
      - Update after significant organizational changes
      - Refresh BIA when business processes change
      - Maintain training and awareness program
    deliverables:
      - Annual BCP review record
      - Updated BIA (if changes occurred)
      - Training completion records

Business Impact Analysis Template

bia_template:
  process_assessment:
    process_name: ""
    process_owner: ""
    department: ""
    description: ""

    criticality_classification:
      mission_critical:
        max_tolerable_downtime: "0-4 hours"
        description: "Failure causes immediate, severe impact to customers or revenue"
        examples:
          - Payment processing
          - Authentication and authorization
          - Core API serving customer requests
          - Order fulfillment

      essential:
        max_tolerable_downtime: "4-24 hours"
        description: "Failure causes significant degradation but not complete loss"
        examples:
          - Customer support systems
          - Reporting and dashboards
          - Email and notifications
          -   

      
         
         
        
             
              
             
            

      
         
         
        
              
            
            

    
      
         
         
         

      
         
         
         
         

      
         
         
         

      
         
         
         

    
      
          
           
           
           
      
          
           
           
      
          
           
           
           
      
          
           

    
       
       
       
       

Communication Plan

communication_plan:
  activation_criteria:
    - Event affecting multiple critical systems
    - Physical facility unavailable
    - Pandemic or workforce availability crisis
    - Major vendor/partner outage
    - Cybersecurity incident with operational impact

  internal_communication:
    executive_notification:
      who: "CEO, CTO, CFO, VP Engineering, VP Operations"
      when: "Within 15 minutes of BCP activation"
      method: "Phone call (primary), SMS (secondary)"
      message_template: |
        BUSINESS CONTINUITY EVENT ACTIVATED
        Incident: [Brief description]
        Impact: [Systems/processes affected]
        Status: [Current state]
        Next update: [Time]
        Bridge call: [Number/link]

    team_notification:
      who: "All affected department leads and their teams"
      when: "Within 30 minutes of BCP activation"
      method: "Slack/Teams (primary), Email (secondary), SMS (tertiary)"
      message_template: |
        BCP ACTIVATED - [Event Type]
        What happened: [Description]
        What is affected: [Systems/services]
        What to do: [Immediate actions for your team]
        Status updates: [Channel/frequency]
        Questions: Contact [BCP coordinator]

    
       
       
       
       

    
       
       
       

  
    
       
       
       
       
    
       
       
       

    
       
       
       
       

    
       
       
       

  
     
     
    
               
        
        
         
        
        
        
        

Recovery Procedures

recovery_procedures:
  immediate_response:
    step_1: "Incident commander assesses situation and declares BCP activation"
    step_2: "Notify BCP team and establish command structure"
    step_3: "Activate communication plan"
    step_4: "Assess damage and determine scope of disruption"
    step_5: "Initiate appropriate recovery procedures based on scenario"

  scenario_specific:
    data_center_or_region_outage:
      - Activate DR failover procedures
      - Redirect traffic to DR region
      - Verify service restoration
      - Communicate status to stakeholders
      - Plan return to primary when available

    cybersecurity_incident:
      - Engage incident response team
      - Contain the threat (isolate  
            
         
            
            

    
          
            
            
            
             

    
            
          
           
           
           

    
           
           
          
           
           

  
        
        
          
       
         

  
       
           
         
        
       
          

Testing Schedule and Types

testing_schedule:
  tabletop_exercise:
    frequency: "Quarterly"
    duration: "2-3 hours"
    participants: "BCP team, department leads, executive sponsor"
    format: "Facilitated discussion of a scenario"
    scenarios_to_rotate:
      - Major cloud provider region outage
      - Ransomware attack on production systems
      - Key employee unavailability (bus factor scenario)
      - Critical vendor goes out of business
      - Office building inaccessible
    output: "Exercise report with findings and action items"

  functional_exercise:
    frequency: "Semi-annually"
    duration: "4-8 hours"
    participants: "BCP team, IT operations, affected departments"
    format: "Execute specific recovery procedures without full disruption"
    
       
       
       
       
     

  
     
     
     
     
    
       
       
       
       
       
     

  
     
     
     
     
     
     
     

BCP Maintenance Checklist

bcp_maintenance_checklist:
  quarterly:
    - [ ] Contact lists verified and updated
    - [ ] Tabletop exercise conducted
    - [ ] BCP team roster reviewed
    - [ ] Vendor contact information verified
    - [ ] Communication channels tested

  semi_annually:
    - [ ] Functional exercise conducted
    - [ ] Recovery procedures reviewed for accuracy
    - [ ] Technology dependencies verified
    - [ ] Vendor continuity capabilities confirmed

  annually:
    - [ ] Full-scale exercise conducted
    - [ ] Business Impact Analysis refreshed
     [ ]   
     [ ]      
     [ ]     
     [ ]       
     [ ]      

  
     [ ]     
     [ ]   
     [ ]   
     [ ]   
     [ ]   
     [ ]     

Best Practices

• Secure executive sponsorship: BCP without leadership commitment will not be taken seriously
• Base recovery priorities on Business Impact Analysis, not assumptions or technical preferences
• Test the communication plan independently: it fails more often than the technology recovery
• Maintain contact lists as if your primary systems are unavailable (offline copies, mobile access)
• Conduct tabletop exercises quarterly at minimum: they are low-cost and high-value for identifying gaps
• Include non-IT scenarios in planning (pandemic, facility loss, key personnel unavailability)
• Define clear activation criteria so there is no ambiguity about when to invoke the BCP
• Keep the BCP document practical and actionable, not a shelf document written for auditors
• Update the BCP after every significant organizational or technology change
• Review and incorporate lessons from every exercise and every real event into the plan