Business Continuity Planning Explained: BIA, RTO and DRP for Security+

A business continuity plan keeps the organisation operating through a disruption. It is broader than a disaster recovery plan, and the exam tests the distinction directly.

BCP versus DRP

Business continuity planning covers the whole organisation: how does the business keep functioning? That includes people, premises, suppliers, communications and manual workarounds, not just technology.

Disaster recovery planning is the IT subset: how do we restore systems and data?

DRP sits inside BCP. If a building is destroyed, the DRP restores the systems at another site; the BCP covers where staff work, how customers are told, how orders are taken while systems are down, and which functions are restored first.

A clean exam framing: BCP keeps the business running, DRP brings the technology back.

The business impact analysis

The BIA is the foundation, and it comes first. You cannot decide what to protect until you know what losing it costs.

It identifies critical business functions, determines the impact of losing each over time, maps the dependencies each relies on, and sets recovery objectives and priorities.

The time dimension is the part people miss. Losing payroll for an hour is trivial; losing it for two weeks is not. Impact is a curve, not a number — which is exactly what makes the metrics below meaningful.

The recovery metrics

Metric	Measures
RTO — recovery time objective	How long a function may be unavailable
RPO — recovery point objective	How much data loss is acceptable
MTD / MTO — maximum tolerable downtime	The point beyond which the business cannot recover
WRT — work recovery time	Time to verify and resume normal operation after restoration

Two relationships the exam expects. RTO looks forward at downtime; RPO looks backward at data loss. And RTO plus WRT must be less than MTD — restoring a system inside the RTO is no use if reconciling the data afterwards pushes total downtime past what the business can survive.

MTD is set by the business, not by IT, and it constrains everything else.

Recovery sites

Hot site — fully equipped, running, data current. Fastest recovery, highest cost.
Warm site — hardware and connectivity in place, data must be restored. Hours to days.
Cold site — space, power and connectivity only. Cheapest, slowest.
Mobile site — a transportable facility brought to where it is needed.
Reciprocal agreement — two organisations agree to host each other. Cheap, and unreliable in a regional disaster affecting both.

Cloud regions map onto this directly, with the added advantage that capacity can be provisioned on demand rather than sitting idle.

Testing the plan

An untested plan is a document, not a capability. The exercise types run from least to most disruptive, and the exam asks you to identify them.

Read-through or checklist — participants review their sections for accuracy.
Tabletop — a discussion-based walkthrough of a scenario. Cheap, surfaces assumptions and gaps in decision-making.
Walkthrough or structured walkthrough — a more detailed step-by-step review with all teams.
Simulation — a realistic scenario played out without affecting production.
Parallel test — recovery systems are brought up and run alongside production. Validates the recovery environment without risking live service.
Full interruption — production is actually failed over. The only test that proves the plan, and the riskiest.

Tabletop exercises are the most commonly recommended starting point because they find most of the problems at almost no cost.

What plans actually get wrong

Worth knowing because the exam asks about plan maintenance. Contact lists go stale. Dependencies are missed — a system restored without the authentication service it needs. Recovery documentation is stored only on the system that is down. Nobody has tested a restore, only a backup. Key-person dependencies leave a single individual as the only one who knows the procedure. And the plan is not updated after infrastructure changes.

Keep an offline copy of the plan, review it at least annually and after significant change, and cross-train so no single person is a dependency.

What to remember

BCP keeps the business operating; DRP restores technology and sits inside it. The BIA comes first and drives everything. RTO is downtime tolerance, RPO is data loss tolerance, and RTO plus work recovery time must stay inside the maximum tolerable downtime. Hot, warm and cold sites trade cost for speed. Test with tabletops regularly and full interruption rarely.

Related reading: Geographic dispersion of backups · MTBF and MTTF · SLO, SLA and SLI