# Business Continuity Plan (BCP) Template

## Purpose

This template provides a framework for maintaining critical business operations during and after disruptions. Essential for organizational resilience, E-ITS compliance, ISO 22301/27001, and SOC 2 availability commitments.

## When to Use

- Natural disasters (fire, flood, storm)
- Cyber attacks (ransomware, DDoS)
- IT system failures
- Facility unavailability
- Pandemic/health emergencies
- Key personnel loss
- Supply chain disruptions
- Power/utility outages

## How to Use

1. **Identify Critical Functions**: Determine what must continue
2. **Assess Impact**: Understand consequences of disruption
3. **Define Recovery Objectives**: Set RTO/RPO targets
4. **Plan Recovery Strategies**: Document how to recover
5. **Assign Responsibilities**: Who does what
6. **Test Regularly**: Validate plan works
7. **Update Continuously**: Keep current with business changes

## Official References

- **ISO 22301**: Business continuity management systems
- **ISO 27001:2022**: Annex A 5.29, 5.30 (BC and redundancy)
- **E-ITS**: § 14 Infosüsteemi toimimise järjepidevuse plaan
- **SOC 2**: A1.2 Environmental protections, CC9.1 Business continuity

---

## Key Definitions

| **Term** | **Definition** | **Example** |
|----------|---------------|-------------|
| **RTO (Recovery Time Objective)** | Maximum acceptable downtime | 4 hours |
| **RPO (Recovery Point Objective)** | Maximum acceptable data loss | 1 hour |
| **MTPD (Maximum Tolerable Period of Disruption)** | Point where business viability threatened | 24 hours |
| **Critical Function** | Service/process that cannot stop | Customer transaction processing |
| **Work Recovery Time** | Time to restore full productivity post-recovery | 8 hours |

---

## Business Impact Analysis (BIA)

### Critical Business Functions

| **Function** | **Description** | **RTO** | **RPO** | **MTPD** | **Priority** |
|--------------|-----------------|---------|---------|----------|--------------|
| Customer Orders | Online order processing | 2h | 30min | 8h | P1 - Critical |
| Email | Internal/external communication | 4h | 1h | 24h | P2 - High |
| Accounting | Financial transactions | 8h | 4h | 48h | P2 - High |
| Website | Public-facing website | 1h | 15min | 4h | P1 - Critical |
| CRM | Customer relationship management | 8h | 4h | 72h | P3 - Medium |

### Impact Assessment Matrix

| **Function** | **Financial** | **Operational** | **Reputational** | **Legal/Regulatory** | **Overall Impact** |
|--------------|---------------|-----------------|------------------|----------------------|-------------------|
| Customer Orders | High (€50k/day) | Critical | High | Medium (SLA breach) | Critical |
| Email | Low | High | Low | Low | High |
| Accounting | Medium | Medium | Low | High (tax filing) | High |

**Impact Levels**: Negligible / Low / Medium / High / Critical

---

## Recovery Strategies

### 1. IT Systems & Data

#### Backup Strategy

| **System** | **Backup Type** | **Frequency** | **Retention** | **Location** | **Recovery Method** |
|------------|-----------------|---------------|---------------|--------------|---------------------|
| Production DB | Full + Incremental | Daily full, hourly incremental | 30 days | AWS S3 + Offsite tape | Automated restore |
| File Servers | Snapshot | Every 6 hours | 7 days | Cloud backup | Self-service restore |
| Email | Continuous | Real-time | 90 days | Cloud archive | Mailbox restore |

**Backup Verification**: Weekly restore tests, monthly full recovery drill

#### Redundancy & Failover

| **Component** | **Redundancy** | **Failover** | **SLA** |
|---------------|----------------|--------------|---------|
| Web Servers | Load-balanced (3x) | Automatic | 99.9% |
| Database | Primary + Read Replica | Manual (15min) | 99.95% |
| Network | Dual ISP | Automatic (BGP) | 99.99% |
| Power | UPS + Generator | Automatic (< 1sec) | 99.95% |

### 2. Facilities & Workspace

#### Primary Location

**Address**: _________________________________
**Capacity**: _________ people
**Utilities**: Power, HVAC, Connectivity

**Access**:
- Key holders: _________________________________
- Security codes: [Secure location]
- Backup access: _________________________________

#### Alternative Locations

| **Location Type** | **Address** | **Capacity** | **Setup Time** | **Equipment** | **Purpose** |
|-------------------|-------------|--------------|----------------|---------------|-----------|
| Hot Site | ____________ | ___ people | < 2h | Fully equipped | Critical operations |
| Warm Site | ____________ | ___ people | < 24h | Basic IT | Extended outage |
| Cold Site | ____________ | ___ people | < 1 week | Empty space | Long-term disaster |
| Work-from-Home | Distributed | All staff | < 1h | Employee equipment | Pandemic, facility unavailable |

### 3. Communications

#### Internal Communication

**Primary**: Slack / Microsoft Teams
**Backup**: WhatsApp group (emergency)
**Tertiary**: SMS tree (contact list)

**Crisis Communication Channel**: [Emergency Slack channel/phone tree]

#### External Communication

| **Audience** | **Method** | **Responsible** | **Template** |
|--------------|------------|-----------------|--------------|
| Customers | Email, website banner | Communications Lead | [See templates] |
| Suppliers | Email, phone | Operations Manager | [See templates] |
| Employees | All-hands call, Slack | HR + CEO | [See templates] |
| Regulators | Formal notification | Legal + DPO | [See templates] |
| Media | Press release | PR Firm | [See templates] |

### 4. Critical Dependencies

#### Third-Party Services

| **Vendor** | **Service** | **Criticality** | **SLA** | **Backup Provider** | **Contact** |
|------------|-------------|-----------------|---------|---------------------|-------------|
| AWS | Cloud hosting | Critical | 99.99% | Azure (failover) | support@aws.com |
| Stripe | Payment processing | Critical | 99.99% | Manual invoicing | ____________ |
| SendGrid | Email delivery | High | 99.9% | SMTP backup | ____________ |

#### Key Personnel

| **Role** | **Name** | **Backup** | **Critical Knowledge** |
|----------|----------|-----------|------------------------|
| CEO | _________ | COO | Strategic decisions, board communications |
| CTO | _________ | IT Manager | Infrastructure access, vendor relationships |
| CFO | _________ | Accountant | Banking access, payroll |
| DPO | _________ | Legal Counsel | GDPR compliance, breach notifications |

**Succession Plan**: Document in secure location, update quarterly

---

## Activation Criteria

### When to Activate BCP

The BCP is activated when:

- [ ] Critical system unavailable for > RTO
- [ ] Facility inaccessible for > 4 hours
- [ ] Cyber attack affecting operations
- [ ] Natural disaster declaration
- [ ] Pandemic/health emergency
- [ ] Key personnel unavailable
- [ ] Supply chain failure affecting critical operations

**Authority to Activate**: CEO, CTO, Operations Manager, or Incident Commander

### Activation Decision Tree

```
Is critical business function affected?
├─ YES → Impact > 4 hours?
│   ├─ YES → ACTIVATE BCP
│   └─ NO → Monitor, prepare for activation
└─ NO → Standard incident response, no BCP activation
```

---

## Recovery Procedures

### Phase 1: Immediate Response (0-4 hours)

**Objectives**: Stabilize situation, protect life/safety, assess damage

#### Actions:

1. **Ensure Safety**
   - [ ] Account for all personnel
   - [ ] Evacuate if necessary
   - [ ] Contact emergency services if needed
   - [ ] Secure physical premises

2. **Activate BCP Team**
   - [ ] Notify BCP Coordinator
   - [ ] Assemble crisis management team
   - [ ] Establish crisis communication channel
   - [ ] Set up command center (physical or virtual)

3. **Initial Assessment**
   - [ ] Identify affected systems/processes
   - [ ] Estimate outage duration
   - [ ] Determine scope of disruption
   - [ ] Assess critical function impact

4. **Communication**
   - [ ] Notify senior management
   - [ ] Inform affected staff
   - [ ] Alert key customers (if applicable)
   - [ ] Prepare holding statement for stakeholders

### Phase 2: Business Continuity (4-24 hours)

**Objectives**: Maintain critical operations, prevent further damage

#### Actions:

1. **Implement Workarounds**
   - [ ] Activate backup systems
   - [ ] Failover to alternate facilities
   - [ ] Enable work-from-home
   - [ ] Deploy manual processes (if needed)

2. **Resource Allocation**
   - [ ] Prioritize critical functions
   - [ ] Redeploy staff to critical areas
   - [ ] Activate alternate suppliers
   - [ ] Mobilize emergency budget

3. **Ongoing Communication**
   - [ ] Regular status updates to stakeholders
   - [ ] Update website/status page
   - [ ] Customer service talking points
   - [ ] Media statement (if required)

### Phase 3: Recovery (1-7 days)

**Objectives**: Restore normal operations, rebuild damaged systems

#### Actions:

1. **System Recovery**
   - [ ] Restore from backups
   - [ ] Rebuild infrastructure
   - [ ] Verify data integrity
   - [ ] Test restored functionality

2. **Facility Recovery** (if applicable)
   - [ ] Damage assessment
   - [ ] Cleanup and repairs
   - [ ] Equipment replacement
   - [ ] Safety inspections

3. **Operational Normalization**
   - [ ] Transition from workarounds to normal systems
   - [ ] Catch up on backlog
   - [ ] Verify all functions operational
   - [ ] Return to primary location

### Phase 4: Post-Incident Review (7-30 days)

**Objectives**: Learn from incident, improve resilience

#### Actions:

- [ ] Conduct after-action review
- [ ] Document lessons learned
- [ ] Update BCP based on findings
- [ ] Implement preventative measures
- [ ] Financial impact analysis
- [ ] Insurance claims (if applicable)

---

## BCP Team Roles & Responsibilities

### Crisis Management Team

| **Role** | **Responsible** | **Primary Duties** | **Contact** |
|----------|----------------|-------------------|-------------|
| **BCP Coordinator** | COO / Operations Director | Overall coordination, decision authority | ____________ |
| **Technical Recovery Lead** | CTO / IT Director | IT systems recovery, infrastructure | ____________ |
| **Facilities Manager** | Facilities/Admin | Building, workspace, physical resources | ____________ |
| **Communications Lead** | Marketing / PR | Internal/external communications | ____________ |
| **HR Coordinator** | HR Director | Staff welfare, staffing, safety | ____________ |
| **Finance Coordinator** | CFO | Emergency funding, insurance, financial tracking | ____________ |
| **Operations Lead** | Operations Manager | Critical business processes, workarounds | ____________ |

### Decision Authority Matrix

| **Decision Type** | **Authority** | **Escalation** |
|-------------------|---------------|----------------|
| BCP Activation | BCP Coordinator or any C-level | CEO |
| Emergency Spending (< €10k) | BCP Coordinator | CFO |
| Emergency Spending (> €10k) | CFO | CEO + Board |
| Work-from-Home Order | HR + BCP Coordinator | CEO |
| Customer Communication | Communications Lead | CEO |
| Regulatory Notification | Legal + DPO | CEO |

---

## Testing & Maintenance

### Testing Schedule

| **Test Type** | **Scope** | **Frequency** | **Participants** |
|---------------|-----------|---------------|------------------|
| **Tabletop Exercise** | Walk through scenario, discuss responses | Quarterly | BCP Team |
| **Simulation** | Execute procedures without actual failover | Semi-annually | BCP Team + Key Staff |
| **Full Drill** | Complete failover and recovery | Annually | All staff |
| **Component Test** | Backup restoration, individual systems | Monthly | IT Team |

### Test Scenarios

1. **Ransomware Attack**: Systems encrypted, restore from backup
2. **Facility Unavailable**: Fire/flood, activate alternative location
3. **Key Person Loss**: CEO unavailable, succession plan
4. **Cloud Provider Outage**: AWS down, failover to Azure
5. **Pandemic**: Remote work activation, collaboration tools

### Maintenance Tasks

| **Task** | **Frequency** | **Responsible** |
|----------|---------------|-----------------|
| Review and update contact lists | Monthly | BCP Coordinator |
| Verify backup integrity | Weekly | IT Team |
| Review BCP document | Quarterly | BCP Team |
| Update after organizational changes | As needed | BCP Coordinator |
| Training for new employees | Onboarding | HR + IT |
| External audit of BCP | Annually | CISO + Auditors |

---

## Communication Templates

### Customer Notification - Service Disruption

**Subject**: [Company Name] Service Status Update

Dear [Customer],

We are currently experiencing a service disruption affecting [affected services].

**Current Status**: [Description]
**Estimated Resolution**: [Timeframe]
**Workaround**: [If available]

We sincerely apologize for any inconvenience. We are working to resolve this as quickly as possible.

Updates: [status page URL]
Questions: [support contact]

### Employee Notification - Alternative Work Arrangements

**Subject**: [URGENT] Business Continuity Activation - Action Required

Due to [incident], we are activating our Business Continuity Plan.

**Effective Immediately**:
- [Work arrangement - WFH, alternate location, etc.]
- [Access instructions]
- [Communication channels]

**What you need to do**:
- [Specific actions]
- [Check-in procedure]

**Who to contact**: [BCP Coordinator contact]

Updates every [timeframe] via [channel]

---

## Recovery Checklists

### IT Systems Recovery

- [ ] Assess damage to infrastructure
- [ ] Verify backup integrity and availability
- [ ] Restore critical systems in priority order
- [ ] Verify data integrity post-restore
- [ ] Test application functionality
- [ ] Restore user access
- [ ] Monitor for issues
- [ ] Document recovery actions

### Facility Recovery

- [ ] Safety inspection passed
- [ ] Utilities operational (power, water, HVAC)
- [ ] Network connectivity restored
- [ ] Workstations/equipment operational
- [ ] Physical security reactivated
- [ ] Notify staff of reopening
- [ ] Gradual return to normal occupancy

---

## Financial Considerations

### Emergency Budget

**Pre-Approved Emergency Spending**: € _________

**Eligible Expenses**:
- Alternative facility rental
- Emergency equipment purchase/rental
- Overtime pay
- Expedited shipping
- External expert services (recovery, forensics)
- Temporary staff augmentation

**Approval Process**: BCP Coordinator up to €10k, CFO above

### Insurance

| **Policy Type** | **Provider** | **Policy Number** | **Coverage** | **Contact** |
|-----------------|------------|-------------------|--------------|-------------|
| Business Interruption | _________ | _________ | € _________ | _________ |
| Cyber Insurance | _________ | _________ | € _________ | _________ |
| Property/Casualty | _________ | _________ | € _________ | _________ |

**Claims Process**: Document all expenses, notify insurer within 48h, provide evidence

---

## Compliance & Regulatory Considerations

### E-ITS Requirements

- BCP must be documented and tested
- Recovery procedures for all K2/K3 systems
- Annual testing required
- Incident reporting to CERT-EE if applicable

### ISO 27001

- Annex A 5.29: ICT readiness for business continuity
- Annex A 5.30: ICT redundancy
- Annual review and testing

### GDPR

- Ensure data protection during recovery
- Breach notification if personal data affected (72h)
- Data subject rights maintained during disruption

---

## Additional Resources

### External Contacts

- **Emergency Services**: 112
- **CERT-EE**: +372 663 0298, cert@cert.ee
- **Facility Management**: ____________
- **Primary ISP**: ____________
- **Backup ISP**: ____________
- **Cloud Provider Support**: ____________

### Document Control

**Version**: 1.0
**Last Updated**: _________
**Next Review**: _________
**Approved By**: _________
**Distribution**: Secure location, limited access

---

**Template Version**: 1.0
**Last Updated**: 2024-01-04
**Source**: InfoPol - Free InfoSec Resources