Lion Cipher Lab
Write a business continuity plan (BCP): from impact analysis to a plan you actually test
- GRC / Compliance
- Intermediate
- ~60 min
- Free · no account required
Why it matters
When a disruption hits -- ransomware, a fire, a dead supplier, a key person out sick, a regional power cut -- the question leadership actually faces is not 'can we restore the server' but 'can we keep serving customers at all.' A Business Continuity Plan (BCP) answers that: it is the written play for keeping the whole business delivering its products and services through a disruption, using workarounds, alternate sites, backup suppliers, and cross-trained people -- not just restored IT. It is broader than a disaster recovery (DR) plan, which restores IT systems specifically, and broader than…
What you'll learn
- what a Business Continuity Plan (BCP) is and where it fits
- telling BCP, disaster recovery (DR), and incident response (IR) apart by scope
- turning BIA outputs (critical functions, RTO, RPO, MTD) into a continuity plan
- reading MTD/MTPD as the ceiling that every RTO must sit under
- setting a Minimum Business Continuity Objective (MBCO)
- choosing recovery strategies per function (workarounds, alternate sites, alternate suppliers, cross-trained staff)
- hot / warm / cold site trade-offs
- building a call tree and naming continuity roles
- structuring the BCP document itself
- exercising a plan: tabletop, walkthrough, and simulation tests
Steps in this lab
- BCP vs DR vs IR: the distinction the whole lab hangs on
- Gather your BIA outputs (or sketch a mini-BIA now)
- Build the critical-function register
- MTD is the ceiling; set RTO under it, and set an MBCO
- Choose a recovery strategy for each function
- Roles, a call tree, and the plan document structure
- Exercise the plan: tabletop, walkthrough, simulation
- Why the tested, signed, cadenced plan is the only real one