Incident Response · Topic 4 of 4
BCP, DRP, BC/DR Standards and Crisis Management
Learn how a business continuity plan differs from a disaster recovery plan, key BC/DR standards such as ISO 22301 and NIST SP 800-34, and crisis handling.
- 4 min
- BCP covers the whole business, DRP covers IT recovery.
- ISO 22301 is the BCMS standard, and NIST SP 800-34 is the contingency planning guide.
- The BIA drives both plans.
What it is
A business continuity plan (BCP) describes how the whole organization keeps critical functions running during a disruption. A disaster recovery plan (DRP) describes how IT systems, data and facilities are restored.
Crisis management (CM) is the leadership and communication effort that handles a serious event as it unfolds. Standards give a common structure for all three.
How it works
Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP)
| Aspect | BCP | DRP |
|---|---|---|
| Scope | Whole business: people, processes, sites, suppliers | IT systems, networks and data |
| Goal | Keep critical functions running | Restore technology to a working state |
| Driven by | Business impact analysis | RTO and RPO from the BIA |
| Typical content | Roles, alternate work sites, manual workarounds, supplier and customer communication | Recovery steps per system, backup locations, failover, contact lists |
| Owner | Business leadership | IT leadership |
A good BCP includes:
- Purpose, scope and the approval of senior management
- Critical functions and their recovery priorities
- Team roles and a call tree
- Alternate locations and work arrangements
- Communication plans for staff, customers, regulators and media
- Supplier dependencies
- Testing and maintenance schedule
A good DRP includes the asset list, recovery order, backup and restore procedures, alternate site details, vendor contacts and the step by step recovery runbooks.
Plans are tested in increasing depth.
| Test | What it involves |
|---|---|
| Read through (checklist) | Owners review the plan for gaps |
| Tabletop exercise | The team talks through a scenario in a meeting |
| Walkthrough or simulation | Roles act out the steps without changing live systems |
| Parallel test | Recovery systems are brought up while production keeps running |
| Full interruption | Production is switched to the recovery site. Highest risk and highest proof |
Plans must be reviewed after every test, incident or major change.
BC/DR standards
| Standard | What it provides |
|---|---|
| ISO 22301 | Requirements for a business continuity management system (BCMS). Can be certified |
| ISO 22313 | Guidance on using ISO 22301 |
| ISO/IEC 27031 | Guidelines for information and communication technology readiness for business continuity |
| ISO/IEC 27001 | Information security management system, which includes information security continuity controls |
| NIST SP 800-34 | Contingency Planning Guide for Federal Information Systems |
| NFPA 1600 | Standard for disaster, emergency management and business continuity |
The older British standard BS 25999 was replaced by ISO 22301.
NIST SP 800-34 outlines seven steps of contingency planning:
- Develop the contingency planning policy
- Conduct the business impact analysis
- Identify preventive controls
- Create contingency strategies
- Develop the information system contingency plan
- Ensure plan testing, training and exercises
- Ensure plan maintenance
Crisis Management (CM)
A crisis is a serious event that threatens the organization's reputation, people or survival, and goes beyond a normal incident. A large data breach, a fire or a ransomware outage that stops operations can become a crisis.
| Element | Purpose |
|---|---|
| Crisis management team | Senior leaders with authority to decide quickly |
| Crisis plan | Defined roles, triggers and decision paths |
| Communication | One accurate voice to staff, customers, regulators and media |
| Command center | A place or channel where the team coordinates |
| Link to BCP and DRP | The crisis team activates and oversees these plans |
Crisis management moves through stages: preparedness before, response during, recovery after, and review to learn. Fast, honest and consistent communication protects trust. Incident response handles the technical event, and crisis management handles the organization wide consequences.
A worked example
A ransomware attack takes down order processing across the company. The incident response team contains the malware. The crisis management team, led by executives, decides to activate the BCP, so staff take orders by phone using a manual process. The IT team runs the DRP to restore systems from offline backups in the agreed order.
The communications lead briefs customers and the regulator with one consistent message. After recovery, the company reviews the lessons and updates all three plans.
How the exam asks about this
- "Which plan focuses on restoring IT systems and data after a disaster?" → The disaster recovery plan.
- "Which ISO standard specifies a business continuity management system?" → ISO 22301.
- "Which test has the team discuss a scenario without touching systems?" → A tabletop exercise.
What to remember for the exam
- BCP covers the whole business, DRP covers IT recovery.
- ISO 22301 is the BCMS standard, and NIST SP 800-34 is the contingency planning guide.
- The BIA drives both plans.
- Tests range from read through and tabletop to parallel and full interruption.
- Crisis management provides leadership and communication above the technical response.
A full interruption test can cause a real outage. Run it only after lighter tests succeed and with management approval.
Common mistakes
Treating the BCP and DRP as one document. They have different scope and owners and must be consistent.
Writing a plan and never testing it. Plans decay as systems change.
Leaving communication out. Silence or mixed messages during a crisis do more damage than the outage.
Check yourself
What is the main difference between a BCP and a DRP?
A BCP keeps the whole business functioning, while a DRP restores IT systems and data.
Which standard replaced BS 25999?
ISO 22301.
What does a tabletop exercise test?
Whether people understand their roles and the plan, through a talked-through scenario without changing live systems.
Topic 4 of 4 in Incident Response
Test yourself on Incident Response
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.