Emergency Preparedness includes planning and training and taking proactive action to be ready to do what needs to be done to ensure survival and safety, in case of an unplanned emergency or disaster.  Emergency Preparedness is important for families and communities as well as organizations. 
Business Continuity Planning (BCP) focuses on taking proactive steps to ensure the viability of a business during and after a time of unplanned emergency or disaster.  This a goes above and beyond IT disaster recovery, as the focus of IT disaster recovery is to restore IT systems and data but does not address other aspects of the business.
The bottom line is that without Emergency Preparedness for people, families and communities, effective Business Continuity Planning is not possible.  If people are faced with serious challenges threatening their survival and/or their family, these resources are not available to support BCP.  For the vast majority of human resources (i.e. people / employees) supporting a business, their first commitment will be to their families, households and communities.  The human issues relating to Business Continuity and Disaster Recovery should never be overlooked.  These must be proactively addressed as part of a comprehensive strategy to mitigate risks of unforeseen events.
To ensure the viability of your BCP, it is critical that the human factors are considered in the form of Emergency Planning for the people, families and communities potentially impacted.  More information is available at: http://emergencyplanguide.org/

An effective Business Continuity Plan (BCP) typically includes IT disaster recovery plus contingency/backup plans for critical business operations.  Most BCPs focus on restoring key business functions in terms of relocating facilities, machinery, people or equipment so that the operations necessary to keep the business alive can be carried on even if the business is hit with a flood, fire, blizzard, etc.  This is all very important to have in place.  But what many BCPs do not consider is loss of key people in the organization.  The BPC may have answers to “what happens when the warehouse is under water?”  or “what happens when the online order system goes down?”; this presumes the disruptive vent will be some sort of physical “disaster”.  But what about the question “what happens when the only person in the company who knows how to make product X leaves?  or gets sick?”.  What happens if the CEO / owner of a company leaves or passes on?  Then what?

​Years ago when I got involved in what was then called “Business Assurance Planning”, the top threats to sustain business operations were fire, power outage, and natural disasters like floods, bad weather, earthquake.  All of the contingency planning centered around finding another location work out of and making sure IT systems were backed up with copies stored off site.  Then Y2K brought awareness of the vulnerabilities of all the IT systems we rely upon, even in the absence of a natural disaster, and we started to think about how we would operate if our IT systems stopped functioning.

ISO 22301, “Societal security – Business continuity management systems – Requirements” , is a standard for a business continuity management system. The system specifies that the performance of the business continuity plan be measured using defined metrics which assess the ability of the business continuity plan to meet predefined targets. These targets are defined based on specific goals of the organization to protect their prioritized operations and activities, as approved by the top management.

BCP stands for Business Continuity Planning.  BCP is a process of identifying the potential risks to your business and then evaluating how to prepare for these so that if they do happen, you have a working plan to enable your business to continue to be viable.  This means that you are still able to operate at some level needed to meet customer needs and to be able to resume normal operations at a defined point in the future.  Lack of adequate BCP means that a disaster could put you out of business permanently.

​The simple answer is “yes” and “yes”.  While there are many advantages to keeping BCPs and other business critical information on line (allows for remote accessibility, the cloud adds redundancy should your primary site be unavailable), it is not advisable to be completely dependent on electronic resources for recovering time sensitive critical information.  Hurricane Sandy taught me a very valuable lesson in this which I will never forget.  Recent incidents where cyber-attacks and randsomware have shutdown online systems also reinforce this lesson. 

Business Continuity Plan (BCP) is a valuable tool for being prepared in the event of an unforeseen disaster which impacts your business.  Most organizations will readily agree with this fact that a BCP is needed.  However there is great disagreement within organizations when the question arises “how much planning is enough?”. 

Here are the top reasons why Business Continuity Plans are not effective and how to avoid them.

There are important differences between what is  covered in a Disaster Recovery plan versus a Business Continuity Plan.  Make sure your organization fully understands this before it's too late.