Business Processes and Resilience (BCP and DRP)

What it is

A business process is a set of activities that delivers a product or service, such as order to cash or loan approval. IT risk becomes business risk when a system failure, breach or error disrupts one of these processes.

Resilience is the ability to keep critical processes running, or restore them quickly, when something goes wrong. The business continuity plan (BCP) keeps the business operating; the disaster recovery plan (DRP) restores the IT that the business depends on.

How it works

Understanding processes

The practitioner maps critical processes and their dependencies: people, sites, applications, data, suppliers and other processes. A process is only as resilient as its weakest dependency. A payments process may depend on a core banking system, a network link, a cloud provider and three key staff.

Process maps also show where controls sit and where a failure would cascade. This is why process owners, not IT, define what "critical" means.

BCP versus DRP

The DRP is a part of continuity, not a replacement for it. A perfect IT recovery does not help if staff have nowhere to work or customers are not told what is happening.

Related plans include the crisis management plan for senior decision making and communication, the incident response plan for security events, and crisis communication for media, regulators and customers. ISO 22301:2019 is the international standard for business continuity management systems.

Recovery objectives

Recovery objectives come from the business impact analysis (covered in the Risk Assessment chapter). The recovery time objective (RTO) is how quickly a process or system must be restored. The recovery point objective (RPO) is how much data loss, measured in time, is acceptable.

The maximum tolerable downtime is the point after which the damage becomes unacceptable; the RTO must sit inside it.

Testing and tabletop exercises

The job practice asks the practitioner to facilitate tabletop exercises to verify risk scenarios, capabilities and responses and to find gaps. A good tabletop uses a realistic scenario from the risk register, includes decision makers, injects new information as the scenario unfolds, and ends with documented gaps, owners and dates.

The practitioner's role

The practitioner does not write the BCP for the business. The practitioner checks that continuity risk is identified, that recovery objectives match business needs and appetite, that plans are tested, and that gaps found in tests are tracked to closure.

A worked example

An insurer runs a tabletop exercise based on a ransomware scenario from its risk register. Two hours in, the team discovers that the DRP restores the claims system in 8 hours, but the claims payment process also needs a document service that has no recovery plan at all.

The practitioner records the gap, the process owner accepts ownership, and IT is asked to add the document service to the DRP with an RTO that matches the claims process. The scenario's risk rating is reviewed because the response capability was weaker than assumed.

How the exam asks about this

• "What should drive the recovery priorities in a DRP?" The business impact analysis, not IT's view of system importance.
• "What is the PRIMARY benefit of a tabletop exercise?" It finds gaps in plans, roles and decisions without disrupting operations.
• "A DRP was tested successfully but the BCP has never been tested. What is the GREATEST risk?" The business may not be able to operate even when systems are recovered.