What is BCP (business continuity plan)?

A plan prepared in advance so that critical business activities are not interrupted, or are resumed within an acceptable time if they are, even when natural disasters, large-scale failures, epidemics and the like occur (Business Continuity Plan). A business impact analysis determines the critical activities and the acceptable downtime, and the plan sets out alternative sites and staff, procedures for recovering systems and so on. The whole ongoing effort of drawing up, exercising and reviewing the plan is called business continuity management (BCM).

Japanese name: BCP(事業継続計画)

BCP (business continuity plan) appears in 2 practice questions across 2 topics, including IT Service Management and Systems Audit, System Architecture and Reliability.

Field: IT Service Management and Systems Audit

Try it: questions about BCP (business continuity plan)

Which of the following is an appropriate way to draw up a business continuity plan (BCP)?

  1. ASince every business activity is indispensable, aim to recover all business activities and systems with the same priority and within the same time
  2. BWriting up the plan and distributing it to everyone is enough, so costly exercises and reviews of the plan are not needed
  3. CAnalyze the impact on the business to determine the critical activities to be continued or recovered first and the acceptable downtime, set recovery targets and procedures for the systems that support them, and keep exercising and reviewing the plan
Show answer and explanation

Answer: C. Analyze the impact on the business to determine the critical activities to be continued or recovered first and the acceptable downtime, set recovery targets and procedures for the systems that support them, and keep exercising and reviewing the plan

A BCP is a plan for continuing critical business activities, or resuming them quickly, even when a disaster or large-scale failure occurs. First, the impact on the business is analyzed (business impact analysis) to determine the critical activities and their acceptable downtime, and targets such as the recovery time objective (RTO) and recovery point objective (RPO) are set for the systems that support them. Exercises confirm whether the plan actually works, and it keeps being reviewed as the organization and its systems change. This ongoing cycle of drawing up, exercising and reviewing the plan is called business continuity management (BCM).

In business continuity planning, which describes the RPO (recovery point objective)?

  1. AA target expressing up to what point in time data must be recoverable when a failure occurs (how far back data loss is tolerated)
  2. BA target for the time allowed from the occurrence of a failure until business operations or the system resume
  3. CThe average time from one failure of a system until the next
Show answer and explanation

Answer: A. A target expressing up to what point in time data must be recoverable when a failure occurs (how far back data loss is tolerated)

The RPO (recovery point objective) is a target expressing to what point in time the data must be restorable when a failure occurs. For example, an RPO of 1 hour means the data must be restorable to a point within the hour before the failure, so backups or copies of the data must be taken at least every hour. The time allowed until business resumes is the RTO (recovery time objective), and the shorter the RPO and RTO, the more the required facilities cost.

BCP (business continuity plan) in the explanations

Questions that mention BCP (business continuity plan) (2)

  1. Which of the following is an appropriate way to draw up a business continuity plan (BCP)?
  2. In business continuity planning, which describes the RPO (recovery point objective)?

Books on IT Service Management and Systems Audit Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

RTO (recovery time objective) RPO (recovery point objective) Audit trail CAAT (computer-assisted audit techniques) Change management Configuration management Escalation Incident management Internal control IT governance

Back to the glossary