Everything US Organizations Need to Build, Test, and Maintain a BCP That Actually Works — With a 35-Item Checklist, BIA Template, and 90-Day Roadmap

A business continuity plan (BCP) is one of those documents that most organizations know they need, but fewer than half have actually tested.

According to FEMA, roughly 40 percent of small businesses never reopen after a disaster — and many of those that fail had a plan on paper but had never rehearsed it.

This guide gives you more than a template. It walks you through the entire BCP lifecycle: understanding what a BCP actually covers, conducting a business impact analysis, building recovery strategies, developing the plan document itself, testing it, and maintaining it over time.

You will find a 35-item compliance checklist, a BIA template with real-world examples, a regulatory mapping for US industries, and a 90-day roadmap to get your BCP from concept to Board-approved. Whether you are starting from scratch or overhauling an outdated plan, this guide gives you the tools to do it properly.

1. What Is a Business Continuity Plan and Why Does It Matter?

A business continuity plan is a documented set of procedures that tells your organization how to maintain or quickly restore critical business functions when something goes badly wrong.

That something could be a hurricane knocking out your primary office, a ransomware attack locking down your systems, a critical supplier suddenly going out of business, or a pandemic forcing an extended period of remote operations.

The BCP is not a crisis communications brochure or a vague statement of intent. It is an operational playbook with specific actions, named owners, and realistic timelines.

It is worth separating a BCP from closely related plans that organizations sometimes conflate. The table below clarifies the distinctions.

Table 1: BCP vs. Related Plan Types — Definitions and Scope

In practice, these plans overlap and reference each other. Your BCP will point to your IT Disaster Recovery Plan for system recovery timelines.

It will reference your Crisis Management Plan for the decision chain. But they serve different purposes and should be maintained separately.

An organization that has only a DRP and calls it a BCP is missing the human, process, and vendor dimensions of continuity — and those gaps tend to surface at exactly the wrong moment.

The gold standard for BCP frameworks in the US and globally is ISO 22301:2019 — the international standard for Business Continuity Management Systems (BCMS).

ISO 22301 provides a Plan-Do-Check-Act lifecycle that structures the entire program, from policy and BIA through to testing, review, and continual improvement.

The NIST SP 800-34 Contingency Planning Guide is the US government’s parallel reference and is widely used by federal contractors and regulated industries.

For a broader view of how BCPs fit into enterprise risk management, see our guide on business continuity management and our post on operational resilience versus business continuity — two concepts that are related but distinct.

2. Business Impact Analysis: The Foundation Everything Else Is Built On

Every BCP practitioner eventually learns the same lesson: a plan is only as good as the BIA behind it.

The Business Impact Analysis (BIA) is the analytical process that tells you which functions are truly critical, how long the organization can survive without them, and what resources are needed to recover them. Without a rigorous BIA, recovery time objectives become guesswork and recovery strategies become misallocated budget.

What a BIA Actually Measures

A BIA is not a risk assessment. It does not focus on the likelihood of disruption. It focuses entirely on the consequence of disruption to each business function, regardless of cause. For each critical function, you are trying to answer three questions:

• What is the Maximum Allowable Outage (MAO) — sometimes called Maximum Tolerable Period of Disruption (MTPD)? This is the longest the business can survive without this function before the damage becomes irreversible.
• What is the Recovery Time Objective (RTO)? This is the target time to restore the function after a disruption. It must be less than the MAO.
• What is the Recovery Point Objective (RPO)? For data-dependent functions, this is how much data loss (measured in time) is acceptable. An RPO of 4 hours means you can tolerate losing up to 4 hours of transactions.

The BIA also quantifies the impact of disruption in financial, operational, regulatory, and reputational terms.

This gives you the evidence base to justify recovery investment — if a function generates $50,000 in revenue per day, you can make a rational business case for spending $20,000 on a hot site backup arrangement.

BIA Template: Worked Example

The table below shows a worked BIA for a mid-sized US financial services firm. Adapt the function list and impact estimates for your own organization. MAO, RTO, and RPO values are illustrative and should be set based on actual operational and regulatory constraints.

Table 2: Business Impact Analysis Template — Worked Example for a US Financial Services Firm (MAO = Maximum Allowable Outage; RTO = Recovery Time Objective; RPO = Recovery Point Objective)

One common BIA mistake is setting RTO equal to MAO, leaving no buffer. In practice, recovery always takes longer than the optimistic estimate. Build in a 25–30% buffer between your RTO target and your MAO. For a detailed walkthrough of BIA methodology, see our post on business impact analysis templates and workshops.

3. Risk Assessment: Identifying What Could Cause the Disruption

The BIA tells you what you need to protect. The risk assessment tells you what threatens it. These two processes are complementary, not interchangeable, and should be conducted in sequence rather than combined into a single exercise.

For BCP purposes, the risk assessment focuses on threats and hazards that could disrupt your critical functions. The standard taxonomy for US organizations covers four broad threat categories:

Natural Hazards

• Hurricanes, tropical storms, and storm surge — particularly relevant for Gulf Coast and Atlantic Coast organizations
• Earthquakes — Pacific Coast and New Madrid Seismic Zone organizations carry elevated exposure
• Tornadoes — Midwest and Southeast firms should assess seasonal tornado season impacts
• Winter storms, ice, and extreme cold — affects data center cooling, employee access, and supply chains
• Flooding — increasingly relevant given NOAA data on changing precipitation patterns across the US

Technological and Cyber Threats

• Ransomware attacks — the FBI’s Internet Crime Complaint Center (IC3) recorded over $4.2 billion in ransomware losses in 2023; financial services, healthcare, and manufacturing are top targets
• System failures and unplanned outages — hardware failure, software bugs, and cloud provider outages
• Telecommunications failures — internet, phone, and network connectivity loss
• Data breaches and unauthorized access — triggering regulatory notifications and operational disruption
• Third-party ICT failures — when a critical vendor’s systems go down and take yours with them

Human and Operational Threats

• Key person dependency — a single employee holding critical knowledge or access that no one else has
• Industrial action and labor disputes — particularly relevant for logistics, healthcare, and manufacturing
• Supplier or vendor bankruptcy — sudden loss of a critical service provider with no transition period
• Workplace incidents and accidents — fires, chemical spills, or physical security breaches

Pandemic and Health Threats

COVID-19 demonstrated that a health crisis can simultaneously affect staff availability, supply chains, customer demand, facility access, and regulatory requirements — all at once, and for an extended period.

A BCP that only addresses short-term disruptions will fail in a prolonged pandemic scenario. Your pandemic procedures should cover remote work infrastructure, health screening protocols, succession planning for leadership absences, and communication with public health authorities.

For a structured approach to risk identification, see our guide on risk assessment methodology and the companion post on enterprise risk management frameworks.

For organizations in financial services, our post on operational risk management covers the specific risk taxonomy that feeds into FFIEC BCP requirements.

4. Recovery Strategies: Deciding How You Will Actually Respond

A recovery strategy is the practical decision about how a specific critical function will be maintained or restored when a disruption occurs.

Recovery strategies cost money, and the right strategy for each function depends on the RTO you have established in your BIA, the nature of the threat, and the cost of the strategy relative to the impact of downtime.

Work Location Strategies

When your primary facility becomes unavailable, you need an alternative. The four main options range in cost and recovery speed:

• Hot site: A fully equipped, immediately available backup facility with live data replication. Recovery measured in minutes to hours. Highest cost. Appropriate for functions with RTOs under 4 hours.
• Warm site: A partially equipped facility that can be activated within hours to a day. Requires some setup time. Mid-range cost. Appropriate for functions with RTOs of 4–24 hours.
• Cold site: A shell facility with power and connectivity but no pre-installed equipment. Activation measured in days. Lowest cost. Appropriate for functions with RTOs exceeding 48 hours.
• Work-from-home / remote work: COVID-19 proved that for many knowledge worker functions, remote work is a viable primary continuity strategy — provided your IT infrastructure, VPN capacity, and device policy are built for it.

IT and Data Recovery Strategies

Your recovery strategies for technology-dependent functions must be technically achievable within your RPO and RTO targets. This means your IT team needs to validate backup frequency, restore times, and failover procedures against the BIA targets — not just document them.

• Cloud-based redundancy: Geographic distribution across multiple cloud availability zones (AWS, Azure, Google Cloud) provides built-in failover for most modern applications.
• Data backup and restore: Traditional backup regimes (full plus incremental) need to be tested regularly. A backup that has not been successfully restored is not a backup.
• Database replication: For transaction-intensive systems (payment processing, trading), real-time or near-real-time database replication is typically required to meet tight RPO targets.
• Disaster Recovery as a Service (DRaaS): Third-party providers that manage the replication and failover of your entire IT environment. Growing rapidly as an alternative to maintaining your own DR site.

For detailed IT recovery architecture guidance, see our post on IT disaster recovery plans, which covers RTO/RPO alignment, DR site selection, and backup strategy design.

Supply Chain and Vendor Continuity Strategies

Single-supplier dependency is one of the most common and most overlooked continuity risks in US organizations. If your only raw material supplier, cloud provider, or payroll processor goes down, your BCP needs a credible answer.

For critical suppliers, this means maintaining approved alternate sources, reviewing vendor BCPs annually, and including BCP requirements in procurement contracts.

For a detailed framework, see our guide on third-party risk management. The OCC’s Third-Party Risk Management guidance requires banks to assess whether critical vendors have adequate BCPs, and this expectation is increasingly standard across regulated industries.

5. Business Continuity Plan Checklist Template: 35 Items Across Six Phases

Use this checklist as your working BCP compliance inventory. It covers all phases from governance initiation through regulatory alignment.

Assign a status and an owner for every item. Priority colors: Critical (regulatory breach or operational failure risk if not addressed), High (material gap), Medium (best practice gap).

Table 3: BCP Compliance Checklist — 35 Items with Priority, Owner, and Status Tracker (ISO 22301 aligned)

A few items on this checklist deserve special emphasis. The BIA (items 6–11) is the most commonly undercooked phase in practice — organizations frequently set RTOs by gut feel rather than by structured analysis.

The testing phase (items 29–32) is the most commonly skipped, especially in smaller organizations.

And the regulatory alignment phase (items 33–35) is the most commonly forgotten by organizations that are not in heavily regulated industries but still have legal and contractual BCP obligations.

6. The BCP Document: What to Include and How to Structure It

Once you have completed your BIA, risk assessment, and recovery strategy decisions, you need to consolidate them into a single, usable BCP document.

A BCP that is organized clearly and written for operational use will actually be picked up and followed in a crisis. One that reads like a legal compliance document will sit in a drawer.

Recommended BCP Document Structure

• Section 1 — Purpose, Scope, and Objectives: What the plan covers, which locations and functions are included, and what the plan is intended to achieve.
• Section 2 — Governance: BCP ownership, the Business Continuity Management Team (BCMT) roster with names, titles, and contact details, and the Board/leadership approval record.
• Section 3 — Plan Activation: The criteria that trigger BCP activation, the authority to activate (who can declare an incident and activate the plan), and the immediate notification chain.
• Section 4 — Emergency Response Procedures: Evacuation plans, assembly points, first aid procedures, emergency service contacts (911, local fire department, building management), and immediate safety protocols.
• Section 5 — Business Impact Analysis Summary: A summary of critical functions, MAO/RTO/RPO targets, and dependency maps. The full BIA is typically an appendix.
• Section 6 — Recovery Procedures by Function: For each critical function, a step-by-step recovery procedure specifying: who does what, in what sequence, using what resources, and by when.
• Section 7 — Crisis Communications Plan: Internal escalation scripts, external stakeholder messaging templates (customers, regulators, media), and the communications owner.
• Section 8 — Third-Party and Vendor Contacts: A current list of critical vendor contacts, their BCP contacts, and alternate supplier details.
• Section 9 — Return to Normal Operations: Criteria for declaring the incident resolved, steps to return to normal operations, and the post-incident review process.
• Section 10 — Plan Maintenance Schedule: Annual review dates, test schedule, and the process for updating the plan after organizational changes.

Two practical tips on the document itself. First, keep recovery procedures in Section 6 written at the level of someone who has never performed that recovery before. Write them for a backup person, not the expert.

Second, maintain a version-controlled ‘go bag’ — a short laminated or offline printed summary of critical contacts, activation criteria, and immediate actions that does not require system access to use.

For crisis communication guidance that integrates with your BCP, see our posts on key risk indicators for operational risk and our broader guide to risk appetite statement development, which frames the tolerance thresholds that drive BCP activation decisions.

7. Testing and Exercising: The Step Most Organizations Skip

Testing is where BCPs either prove their value or expose their gaps. A plan that has never been tested is a hypothesis about what your organization might do — not evidence of what it can do. The FFIEC’s BCP booklet is direct on this point: testing is a supervisory expectation for banks, not optional best practice.

The five main exercise types differ in cost, realism, and what they can validate. The table below summarizes them.

Table 4: BCP Exercise Types — Comparison of Scope, Duration, and Testing Value

Most organizations should be running at minimum one tabletop exercise and one IT recovery test annually. For regulated entities in financial services, insurance, and healthcare, the FFIEC and ISO 22301 both expect functional testing that goes beyond tabletop discussion.

After each exercise, you need three things: a written findings report documenting what worked and what did not, a corrective action register with owners and due dates, and a revised BCP that incorporates the lessons learned.

How to Run a Tabletop Exercise

A good tabletop exercise follows a structured scenario. You present the BCMT with a disruption event (ransomware attack, hurricane, key system failure), then walk them through time-phased injects: what is happening now, what has developed two hours later, what has happened by end of day.

At each stage, you ask: who does what, who authorizes what, what resources do you need, and who do you notify? The goal is to surface assumptions, gaps, and coordination issues in a low-stakes environment.

For more guidance on exercise design aligned to ISO 22301 and the NIST Cybersecurity Framework testing requirements, see our post on BCM exercise programs.

8. Regulatory Requirements: Your BCP Obligations by Industry

In the US, BCP is not voluntary for most regulated industries. The table below maps BCP requirements by sector and regulator.

If your organization operates across multiple sectors — a healthcare system with a captive finance company, for example — you need to satisfy multiple regulatory frameworks simultaneously.

Table 5: US BCP Regulatory Requirements by Industry Sector

For financial institutions specifically, the FFIEC Business Continuity Management Booklet is the definitive supervisory guidance. It covers the full BCM lifecycle from BIA through testing and goes into specifics on pandemic preparedness, third-party dependency management, and cyber resilience that many organizations have not yet fully addressed.

For broker-dealers and investment advisers, FINRA Rule 4370 requires a written BCP addressing customer access to funds, communications during an emergency, and data backup — and FINRA examiners routinely ask to see evidence that the plan has been tested.

For organizations subject to HIPAA, the HHS has published contingency planning guidance that specifies the five required components of a HIPAA security contingency plan: data backup plan, disaster recovery plan, emergency mode operations plan, testing and revision procedures, and applications and data criticality analysis. All five map directly to BCP phases covered in this guide.

For a comprehensive view of how BCP intersects with your broader compliance program, see our posts on compliance risk assessment and COSO ERM framework alignment.

9. External Partnerships: Vendors, Suppliers, and Third Parties in Your BCP

An organization’s BCP is only as strong as the weakest link in its supply chain. Most BCPs document internal recovery procedures in detail but treat external dependencies as an afterthought.

In practice, many of the most disruptive incidents in US business history have been triggered not by internal failure but by a critical third party going down — a cloud provider outage, a logistics network failure, or a financial clearinghouse disruption.

What Your BCP Needs to Address for Third Parties

• A current register of all critical ICT and operational vendors, with BCM contact details for each.
• Annual review of BCPs from your top 10 critical suppliers — not just a questionnaire, but actual review of their plans against your RTO/RPO requirements.
• Concentration risk assessment: how many of your critical functions depend on a single vendor? If your cloud, payroll, and communications all run through one provider, you have a dangerous single point of failure.
• Contract provisions requiring vendors to maintain BCPs, notify you within defined timeframes of incidents affecting your services, and cooperate with your recovery procedures.
• Alternate supplier identification for all critical inputs: you need a credible alternative, not just a theoretical one.

For regulated financial entities, the OCC’s 2023 Third-Party Risk Management guidance explicitly requires assessment of vendor BCPs as part of the due diligence process — before contracting and on an ongoing basis.

This is not a new expectation but supervisory scrutiny around it has intensified significantly since 2020.

10. Plan Maintenance: How to Keep Your BCP Current

A BCP that is two years out of date is arguably worse than no BCP at all. It creates a false sense of preparedness while providing procedures that reference systems, people, and vendors that no longer exist. Keeping a BCP current requires scheduled maintenance and event-triggered updates.

Scheduled Maintenance

• Annual full review: Review every section of the BCP against the current state of the organization. Update all names, titles, contact numbers, and system references.
• Annual BIA refresh: Validate that RTO/RPO targets still reflect current business requirements. Business growth, new regulatory requirements, and technology changes all affect MAO calculations.
• Annual risk assessment update: Add newly identified threats and reassess existing ones. Cyber threat landscapes, supply chain risks, and climate risks all evolve year to year.

Event-Triggered Updates

• After a major organizational change: merger, acquisition, new office, significant headcount change, or shift to a new IT platform.
• After a real activation: every actual BCP activation should result in a post-incident review and plan update within 30 days.
• After a test or exercise: formal exercise findings must be incorporated into the plan within 60 days.
• After a regulatory change: new rules, supervisory guidance, or enforcement actions against peers that reveal gaps in your approach.

Assign a named individual as BCP Document Owner who is accountable for scheduling and completing these updates. Without a named owner, maintenance gets deferred indefinitely.

11. Seven BCP Mistakes US Organizations Make — and How to Avoid Them

Mistake 1: Writing the BCP in Isolation

BCPs written by a single person — typically the Risk Manager or Compliance Officer — without input from department heads consistently fail the ‘could someone actually follow this in a crisis’ test.

The people writing recovery procedures for the billing department need to be the people who actually run billing. Build the BCP through workshops, not solo authorship.

Mistake 2: Setting RTOs by Assumption

RTOs that are set without a BIA — ‘we’ll say 24 hours for everything’ — almost always underestimate recovery complexity for some functions and over-engineer recovery for others. The BIA process is not a formality.

It is the mechanism by which business leaders actually commit to how long they can operate without each function. That commitment changes the conversation about recovery investment.

Mistake 3: Confusing a BCP with a DRP

The BCP is for the business; the DRP is for IT. Organizations that have a solid DRP but no BCP are missing recovery procedures for the human, process, and vendor dimensions of a disruption.

When the power comes back on and the systems restart, how do you manage the customer backlog? How do you reconcile the transactions that occurred during the outage? Those are BCP questions, not DRP questions.

Mistake 4: Forgetting the Communication Plan

In a real crisis, communication failures compound the damage. Employees do not know whether to come to work.

Customers call in a panic and nobody has a script. Regulators are left uninformed and issue their own statements.

A BCP without a detailed crisis communications plan — with pre-drafted messages, approved spokespersons, and a clear escalation chain — is operationally incomplete.

Mistake 5: Skipping Pandemic Scenarios

Pre-2020, most US BCPs focused on single-site disruptions: a fire, a flood, a power outage. COVID-19 demonstrated that a pandemic creates a fundamentally different recovery challenge because every site is affected simultaneously, remote work infrastructure is stressed at scale, and the disruption lasts for months rather than days. Your BCP needs a dedicated pandemic scenario that is distinct from your standard emergency response procedures.

Mistake 6: Not Testing Data Restores

Many organizations have robust data backup processes. Fewer have actually timed a full restore to validate that it meets their RPO.

A backup that has never been successfully restored is a hypothesis. Schedule at least one annual full restore test and document the actual time against the RPO target.

Mistake 7: Treating the BCP as a Compliance Document

BCPs written to satisfy an auditor rather than to guide actual operations tend to be long on policy language and short on operational detail.

The test of a good BCP is not whether it satisfies a checklist — it is whether a person with no prior knowledge of the plan could pick it up at 2 AM during an incident and know exactly what to do. Write for the user, not the auditor.

12. 90-Day BCP Development Roadmap

Building a BCP from scratch is a manageable project if approached in phases. The roadmap below is sequenced to produce an approved, tested BCP within 90 days. Adjust timelines based on your organization’s size, complexity, and existing documentation.

Table 6: BCP Development — 90-Day Roadmap with Owners and Outputs

A practical note on the BIA workshop in Phase 1: allow a minimum of 90 minutes per department and more for complex functions. Department heads frequently underestimate how dependent their function is on other parts of the business until you walk them through a dependency mapping exercise. Budget for facilitation time accordingly.

For a detailed roadmap specifically for ISO 22301 certification, which adds a management system layer on top of the plan itself, see our post on ISO 22301 implementation.

13. What Is Changing in BCP: AI, Climate Risk, and Operational Resilience

Artificial Intelligence and BCPs

AI systems are creating new BCP challenges that traditional frameworks did not anticipate. When an AI-driven process (automated underwriting, algorithmic trading, AI-powered customer service) fails or behaves unexpectedly, what is the manual fallback? Who owns the recovery?

 How long can you operate without it? These questions need to be built into your BIA for any function that now relies on AI-driven decision-making.

See our post on AI and machine learning risk management for KRI frameworks that can support BCP monitoring for AI-dependent functions.

Climate Risk and Physical Disruption

NOAA data shows that billion-dollar weather events in the US are increasing in frequency. The National Oceanic and Atmospheric Administration recorded 28 separate billion-dollar climate disasters in 2023. For organizations in high-exposure geographies, physical disruption scenarios need to be stress-tested more rigorously and recovery strategies need to account for extended infrastructure failures beyond the traditional 72-hour window.

Operational Resilience Regulation

The regulatory direction in financial services is moving from BCPs as standalone documents toward operational resilience as a systemic program. The UK’s PS21/3, the EU’s DORA, and evolving US guidance from the OCC and Federal Reserve are all pushing toward impact tolerance testing — proving not just that you have a plan but that critical services can actually be maintained within defined tolerances. Our post on operational resilience frameworks covers this shift in detail.

Key External References and Standards

• ISO 22301:2019 — Business Continuity Management Systems: Requirements (iso.org)
• NIST SP 800-34 Rev 1 — Contingency Planning Guide for Federal Information Systems (nvlpubs.nist.gov)
• FFIEC Business Continuity Management Booklet (June 2019) — ffiec.gov
• OCC Third-Party Risk Management Guidance (2023 Bulletin 2023-17) — occ.gov
• FINRA Rule 4370 — Business Continuity Plans and Emergency Contact Information — finra.org
• HHS HIPAA Contingency Planning Guidance — hhs.gov/hipaa
• NIST Cybersecurity Framework 2.0 — nist.gov/cyberframework
• FEMA Ready Business Program — ready.gov/business
• BCI Good Practice Guidelines (2023 Edition) — thebci.org
• CISA Cybersecurity Performance Goals — cisa.gov
• NAIC Model Regulation for BCM in Insurance — naic.org
• SEC Regulation SCI for Market Infrastructure Entities — sec.gov
• NOAA Billion-Dollar Weather and Climate Disasters Database — ncei.noaa.gov

Ready to Build or Upgrade Your Business Continuity Plan?

Start with the BIA. Everything else in your BCP — recovery strategies, recovery procedures, testing schedule, resource requirements — flows from the BIA. If your current BCP does not have a documented, department-head-validated BIA behind it, that is the first thing to fix.

Browse our full library of practitioner-ready BCM templates, BIA workbooks, risk register formats, and exercise programs at riskpublishing.com. Each tool is designed for working practitioners who need to produce credible, auditable outputs without starting from a blank page.

Related Resources on RiskPublishing.com

Business Continuity Management (ISO 22301) Guide | Full BCM lifecycle from policy to certification

Business Impact Analysis: Templates and Workshop Guide | BIA methodology, worked examples, and facilitation tips

IT Disaster Recovery Plan Guide | DRP templates with RTO/RPO design and DR site guidance

Operational Resilience vs Business Continuity | Impact tolerance, PS21/3, and DORA in context

ISO 22301 Implementation Guide | Certification roadmap and documentation requirements

BCM Exercise Programs: Design and Facilitation | Tabletop, simulation, and full-scale exercise templates

Risk Assessment Methodology | Threat identification and risk matrix design

Third-Party Risk Management Framework | Vendor BCP review, register, and contract provisions

Operational Risk Management | Process-level risk identification feeding into BIA

Enterprise Risk Management Framework | Integrating BCM into your ERM architecture

Risk Appetite Statement Development | Downtime and data loss tolerances that drive BCP thresholds

Compliance Risk Assessment Guide | Mapping BCP to FFIEC, HIPAA, FINRA, and other regulatory requirements

COSO ERM Framework Guide | Aligning BCM to the COSO enterprise risk architecture

AI and Machine Learning Risk Management | KRIs for AI-dependent functions in your BIA

Key Risk Indicators: Complete Framework | KRI library for monitoring BCM program effectiveness

References

1. International Organization for Standardization. (2019). ISO 22301:2019 Security and Resilience — Business Continuity Management Systems: Requirements. ISO.

2. National Institute of Standards and Technology. (2010). NIST SP 800-34 Rev 1: Contingency Planning Guide for Federal Information Systems. NIST.

3. Federal Financial Institutions Examination Council. (2019). Business Continuity Management IT Examination Handbook Booklet. FFIEC.

4. OCC, Federal Reserve, FDIC. (2023). Interagency Guidance on Third-Party Relationships: Risk Management (Bulletin 2023-17). OCC.

5. FINRA. Rule 4370: Business Continuity Plans and Emergency Contact Information. FINRA.

6. HHS Office for Civil Rights. (2012). HIPAA Security Rule Contingency Plan Guidance. HHS.

7. NIST. (2024). Cybersecurity Framework 2.0. National Institute of Standards and Technology.

8. FEMA. Ready Business: Business Continuity Planning Suite. FEMA.

9. Business Continuity Institute. (2023). Good Practice Guidelines 2023 Edition. BCI.

10. NOAA National Centers for Environmental Information. (2024). Billion-Dollar Weather and Climate Disasters Database. NOAA.

11. Committee of Sponsoring Organizations of the Treadway Commission. (2017). Enterprise Risk Management: Integrating with Strategy and Performance. COSO.

12. FBI Internet Crime Complaint Center. (2024). Internet Crime Report 2023. FBI IC3.

13. CISA. (2023). Cross-Sector Cybersecurity Performance Goals. CISA.

Chris Ekai

Chris Ekai is a Risk Management expert with over 10 years of experience in the field. He has a Master’s(MSc) degree in Risk Management from University of Portsmouth and is a CPA and Finance professional. He currently works as a Content Manager at Risk Publishing, writing about Enterprise Risk Management, Business Continuity Management and Project Management.