title: “[03] CISSP Cheatsheet - Business Continuity Planning (BCP)” date: 2026-07-05 authors:
- Your Name
📘 Topic: Business Continuity Planning (BCP)
Domain: D7 – Security Operations
Tags: #cissp #bcp #resilience
🧾 Definition
BCP is the process of preparing the organization to continue critical business functions during and after disruptive events, including development of plans, alternate processes, communications, and recovery strategies.
🔑 Key Points
- Start with Business Impact Analysis (BIA) to identify critical processes and dependencies.
- Define Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical services.
- Maintain and test continuity plans regularly; include personnel, suppliers, and communications.
- Coordinate BCP with DRP for IT recovery specifics.
⚠️ CISSP Insight
- CISSP emphasizes that BCP is a business governance activity; technical recovery (DRP) supports continuity but BCP covers people, processes, and facilities as well.
⚔️ Key Difference / Trap
- BCP vs DRP
- BCP = whole-business continuity (processes, people)
- DRP = technical recovery of IT systems and data
- Trap: Having backup systems but no tested procedures to restore business operations.
🏗️ Example
After a local outage, a company activates its BCP to move staff to alternate work sites, switches to manual processes for critical transactions, and follows communication plans to inform stakeholders.
📚 References
- NIST SP 800-34 — Contingency Planning Guide for Federal Information Systems
- ISO 22301 — Business Continuity Management Systems
- ISO/IEC 27001:2022
🔁 Quick Recall
- BCP = keep business running; DRP = restore IT