Business Continuity Plans: Why They’re Hard, Why They Matter, and How to Build One
Tanner and Anthony discuss why business continuity plans (BCPs) are often one of the last cybersecurity “baseline” goals organizations complete, largely due to documentation burdens and the fear of committing to recovery metrics. They clarify how a BCP differs from an incident response plan, emphasizing that BCPs define how to maintain or restore operations after major disruptions using recovery time objectives and acceptable data loss. They outline practical ways to build a plan using NIST guidance, peers, and industry templates, and cover key components including defined roles with backups, tiering critical systems, backup/retention details, known alternatives, recovery strategies with dependencies and workarounds, communication plans with update cadence and message templates, and regular testing and review. They also note tailoring plans to each organization and avoiding unnecessary separate documents.
00:00 Intro & Why Business Continuity Planning Matters
01:59 Recovery Time Objectives and Metrics
03:56 Why Put Metrics on Paper: Fears and Benefits
06:07 Why Build a BCP: Reasons, Structure, and Tiers Overview
13:17 Risk Assessment and Incident Levels
16:10 Defining System Criticality Tiers
26:55 Building Known Alternatives into Each Tier
36:14 Wrap-up
ABOUT OFF THE WIRE
Off the Wire is a podcast on cybersecurity and IT leadership for the electric cooperative and small business world. Real operations, real tradeoffs, and the decisions that actually keep the lights on. Hosted by Anthony Kent and Tanner.
Subscribe for new episodes, and if this was useful, leave a comment with how your team handles continuity planning.
#BusinessContinuity #ElectricCooperative #ITLeadership #Cybersecurity #DisasterRecovery
