NIS2 Article 21(2)(c) and ISO 27001 A.5.29–A.5.30 ask you to keep your business running during a disruption and to recover afterwards. Continuity keeps your plans in one place, together with their impact analysis and exercises. Plans are numbered BCP-1, BCP-2 and so on.
How to add a plan
- In your organization, open Continuity in the menu and click Add plan.
- Enter a Title and choose the Type: business continuity, disaster recovery, crisis management or backup and restore.
- Describe the Activities and systems covered and choose who is Responsible.
- Fill in the Impact analysis: choose the Impact of a disruption (low to critical), and enter the Maximum tolerable downtime, the Recovery time objective, RTO (hours) and the Recovery point objective, RPO (hours) in hours, and what the activity Depends on (people, suppliers, systems). The RTO must not be longer than the maximum tolerable downtime.
- Under The plan, write the Steps, roles and contacts people need in a crisis.
- Set the Status to Approved when the plan is agreed, and click Save plan.
How to record an exercise
- Open the plan and go to Exercises.
- Enter the date of the Last exercise, its Result (passed, partly passed or failed) and the Lessons learned.
- Set the date of the Next exercise and click Save plan.
The next exercise of an approved plan appears in Tasks as a continuity test and gets a reminder once it is overdue. The list shows how many exercises are overdue and which approved plans were never tested.
For members
Members can read every plan, so everyone can find it during a crisis. Changing plans needs an owner, an admin or a role with that permission.
Tips
- Plan texts may hold contact details, so the history only records that the text changed, not its content.
- Set a plan to Retired instead of deleting it when you want to keep it for reference.
- Business continuity is included from the Professional package; your package may limit the number of plans.