Business continuity management is the combination of analyses, plans, and exercises that allows a company to keep essential functions running during a major incident and return to normal within a timeframe the business can tolerate. In cybersecurity, the most likely scenario is an attack that makes systems unavailable.
In the 2026 Cyber Risk Landscape, a Vultus study of 132 organizations, only 23% had a structured business continuity process. Even among them, outdated or never-tested plans were common.
Why continuity belongs on the security agenda
The same study recorded an average impact of 8.28 on a scale from 0 to 10 in simulated attacks: after getting in, adversaries usually advance far. Preparation must therefore also cover what the company does on the day of an incident.
Without a plan, the first hours are lost figuring out who decides, who has backup access, and the restoration order.
CISA's public ransomware guidance reinforces preparation before an incident, with protected backups, recovery tests, and a response plan the team can execute.
BIA, BCP, and DRP: what each document answers
A business impact analysis (BIA) identifies the processes that sustain the company, their dependencies on systems, people, and suppliers, and how much downtime each can tolerate. Without it, the plan protects what IT considers important, which does not always match what the business needs.
The business continuity plan (BCP) defines how to keep essential operations running while systems are down, for example through a manual sales process. The disaster recovery plan (DRP) defines how to restore systems, in what order, from which backup, and with whom.
MTPD, RTO, and RPO
The BIA defines three numbers per process. MTPD is the maximum tolerable period of disruption before unacceptable damage. RTO is the time within which the process must resume. RPO is the amount of data loss that can be accepted.
A billing system with an MTPD of 24 hours, an RTO of 8 hours, and an RPO of 2 hours needs a data protection strategy that meets the two-hour RPO and a recovery process proven to meet the eight-hour RTO. With daily backups and a restore process that has never been tested, the plan fails to meet its own targets.
Fictional example: the simulation that found the gaps
A network of clinics has had an approved BCP and DRP for two years. In a tabletop exercise involving ransomware, leadership discovers within ninety minutes that half the crisis committee members have left the company, that the alternative scheduling procedure depends on a system that would also be down, and that no one knows who decides how to communicate with patients and regulators.
Remediation includes reviewing the BIA with process owners, appointing backups for each role, and establishing periodic exercises. The tabletop exercise tests leadership decisions, and the Cyber Wargame tests technical execution.
The stages of a continuity system
The Vultus methodology, supported by ISO 22301, organizes implementation into four stages:
- Strategy: objective, scope, budget, continuity policy, and roles.
- BIA: value chain, critical processes, threat scenarios, and definition of MTPD, RTO, and RPO.
- BCP and DRP: crisis activation criteria and continuity and recovery procedures.
- Simulation and governance: metrics, review forums, and exercises that refine the plans.
The last stage is most often cut. An untested plan tends to fail on first use because of an outdated phone number, a backup on the same attacked network, or someone who has already left.
Continuity through periodic exercises
Vultus implements continuity systems with BIA, BCP, DRP, governance, and drills, so the plan's first execution does not happen during a real incident. Explore Vultus crisis management and business continuity and read about the first 48 hours of a ransomware attack.
