business-continuity – Data & Science skill for AI agents

Business Continuity Planning

Develop and maintain business continuity capabilities including Business Impact Analysis, communication plans, recovery procedures, and testing schedules for organizational resilience.

When to Use

• Developing a formal Business Continuity Plan (BCP) for the organization
• Conducting a Business Impact Analysis (BIA) to prioritize recovery efforts
• Establishing communication plans for crisis scenarios
• Defining recovery procedures for critical business processes
• Scheduling and conducting BCP exercises and tests
• Meeting compliance requirements for continuity planning (SOC 2, ISO 27001, HIPAA, FedRAMP)

BCP Framework

The example downtime bands, response times and exercise cadence are illustrative, not universal compliance obligations. Have process owners approve maximum tolerable disruption, RTO (restoration target) and RPO (tolerable data-loss interval) based on actual impacts/dependencies; RTO must fit within tolerable disruption. Plan clean restore, reconciliation and failback evidence. Real failover, isolation, contact notifications and drills require explicit scope, change approval, rollback/abort criteria and communications marked as exercise. A document/tabletop alone does not prove recovery capability. Protect contact lists and accessible offline copies without exposing personal data.

bcp_phases:
  1_governance:
    actions:
      - Obtain executive sponsorship and funding
      - Assign BCP coordinator and team
      - Define BCP scope and policy
      - Establish BCP committee with cross-functional representation
    deliverables:
      - BCP policy statement
      - BCP team charter and roster
      - Scope document

  2_analysis:
    actions:
      - Conduct Business Impact Analysis (BIA)
      - Perform risk assessment for continuity threats
      - Identify critical business processes and dependencies
      - Determine recovery priorities and resource requirements
    deliverables:
      - BIA report
      - Risk assessment report
      - Critical process inventory

  3_strategy:
    actions:
      - Select recovery strategies for each critical process
      - Identify alternate work arrangements (remote, alternate site)
      - Define technology recovery strategies (DR plan)
      - Establish vendor and supply chain contingencies
    deliverables:
      - Recovery strategy document
      - Technology recovery plan
      - Alternate site arrangements

  4_plan_development:
    actions:
      - Write detailed recovery procedures
      - Develop communication plans (internal and external)
      - Create emergency response procedures
      - Document roles, responsibilities, and contact information
    deliverables:
      - Business Continuity Plan document
      - Communication plan
      - Emergency response procedures
      - Contact lists and call trees

  5_testing:
    actions:
      - Develop test plan and schedule
      - Conduct exercises (tabletop, functional, full-scale)
      - Evaluate results and identify gaps
      - Update plans based on lessons learned
    deliverables:
      - Test plan
      - Exercise reports
      - Updated BCP based on findings

  6_maintenance:
    actions:
      - Review and update BCP annually (minimum)
      - Update after significant organizational changes
      - Refresh BIA when business processes change
      - Maintain training and awareness program
    deliverables:
      - Annual BCP review record
      - Updated BIA (if changes occurred)
      - Training completion records

Business Impact Analysis Template

bia_template:
  process_assessment:
    process_name: ""
    process_owner: ""
    department: ""
    description: ""

    criticality_classification:
      mission_critical:
        max_tolerable_downtime: "0-4 hours"
        description: "Failure causes immediate, severe impact to customers or revenue"
        examples:
          - Payment processing
          - Authentication and authorization
          - Core API serving customer requests
          - Order fulfillment

      essential:
        max_tolerable_downtime: "4-24 hours"
        description: "Failure causes significant degradation but not complete loss"
        examples:
          - Customer support systems
          - Reporting and dashboards
          - Email and notifications
          - Billing and invoicing

      important:
        max_tolerable_downtime: "1-3 days"
        description: "Failure causes inconvenience and workarounds are available"
        examples:
          - Internal collaboration tools
          - Analytics and BI platforms
          - HR self-service systems
          - Knowledge base

      non_essential:
        max_tolerable_downtime: "3-7 days"
        description: "Failure has minimal operational impact"
        examples:
          - Development and test environments
          - Training platforms
          - Archive systems

    impact_categories:
      financial:
        revenue_loss_per_hour: ""
        penalty_or_fine_risk: ""
        recovery_cost_estimate: ""

      operational:
        affected_employees: ""
        affected_customers: ""
        workaround_available: "yes/no"
        workaround_description: ""

      reputational:
        customer_visibility: "high/medium/low"
        media_attention_risk: "high/medium/low"
        regulatory_reporting_required: "yes/no"

      legal_regulatory:
        compliance_impact: ""
        contractual_sla_breach: "yes/no"
        sla_penalty_details: ""

    dependencies:
      technology:
        - system: ""
          rto: ""
          rpo: ""
          dr_strategy: ""
      people:
        - role: ""
          minimum_staff: ""
          remote_capable: "yes/no"
      vendors:
        - vendor: ""
          service: ""
          sla: ""
          alternative: ""
      facilities:
        - location: ""
          alternative: ""

    recovery_requirements:
      rto: ""
      rpo: ""
      minimum_recovery_level: "Description of minimum acceptable service"
      full_recovery_target: "Time to full normal operations"

Communication Plan

communication_plan:
  activation_criteria:
    - Event affecting multiple critical systems
    - Physical facility unavailable
    - Pandemic or workforce availability crisis
    - Major vendor/partner outage
    - Cybersecurity incident with operational impact

  internal_communication:
    executive_notification:
      who: "CEO, CTO, CFO, VP Engineering, VP Operations"
      when: "Within 15 minutes of BCP activation"
      method: "Phone call (primary), SMS (secondary)"
      message_template: |
        BUSINESS CONTINUITY EVENT ACTIVATED
        Incident: [Brief description]
        Impact: [Systems/processes affected]
        Status: [Current state]
        Next update: [Time]
        Bridge call: [Number/link]

    team_notification:
      who: "All affected department leads and their teams"
      when: "Within 30 minutes of BCP activation"
      method: "Slack/Teams (primary), Email (secondary), SMS (tertiary)"
      message_template: |
        BCP ACTIVATED - [Event Type]
        What happened: [Description]
        What is affected: [Systems/services]
        What to do: [Immediate actions for your team]
        Status updates: [Channel/frequency]
        Questions: Contact [BCP coordinator]

    all_staff_notification:
      who: "All employees"
      when: "Within 1 hour of BCP activation"
      method: "Email, Slack/Teams announcement, intranet"
      content: "Situation summary, impact on work, expectations"

    status_updates:
      frequency: "Every 2 hours during active event, daily after stabilization"
      channel: "Dedicated Slack channel, email distribution list"
      content: "Current status, actions taken, next steps, timeline"

  external_communication:
    customers:
      who: "Affected customers"
      when: "Within 2 hours of BCP activation (if customer-facing impact)"
      method: "Status page update, email, in-app notification"
      message_template: |
        We are currently experiencing [issue description].
        Impact: [What customers may notice]
        Status: We are actively working to resolve this.
        Updates: Follow our status page at status.example.com
        ETA: [Estimated resolution time or "investigating"]

    regulatory:
      who: "Applicable regulatory bodies"
      when: "Legal/privacy counsel determines applicable trigger, recipients, deadline and required content; do not apply a blanket72-hour rule to every disruption"
      method: "Formal notification per regulatory procedure"

    media:
      who: "Press inquiries"
      when: "Only if media attention occurs"
      method: "Prepared statement through communications team"
      rule: "All media inquiries routed to designated spokesperson"

    vendors_partners:
      who: "Critical vendors and business partners"
      when: "Within 4 hours if partner services affected"
      method: "Dire

… (full content is in the download package)