Business Continuity Plan (BCP)

Management of business continuity and disaster recovery plans, with recovery time and data loss objectives — the Resilience pillar of NIS2.

One record per critical activity

Field	Content
Critical activity	The business process covered
RTO (hours)	Recovery Time Objective — maximum acceptable recovery time
RPO (hours)	Recovery Point Objective — maximum acceptable data loss
Owner	Person responsible for the plan
Continuity strategy	How the activity is kept running or restored

Procedures

Each plan carries its procedures: title, description and a link to the document. They are added after the plan is saved.

Tests

An untested plan is not a plan. Each record carries:

• the date of the last test and its status (Passed / Partial / Failed);
• the date of the next test.

The "Overdue tests" KPI counts plans whose next test date has passed. It is the indicator to watch: the only one that tells a living process apart from a binder of procedures.

Consistency with the risk analysis

The RTO/RPO declared here should be consistent with the availability needs of the business values entered in EBIOS RM (workshop 1) or in ZCR 1. An RTO of 4 h on an activity whose business value is rated "tolerable downtime: 1 week" signals that one of the two ratings needs revisiting.