The auditor asks for your business continuity plan. You hand over a document titled “Disaster Recovery Plan.” The auditor asks: “Where is your BCP?” You point to the same document. The auditor marks both controls as partially implemented.
At Metaluxo we review continuity and recovery planning for SMEs preparing for ISO 27001 and customer audits. The confusion between BCP and DRP is nearly universal in small companies. This post clarifies the difference and what each plan needs to contain.
Business Continuity Plan (BCP)
Purpose: Keep critical business functions running during a disruption.
Scope: People, processes, and locations. Not just IT systems.
Key questions:
- What are our critical business functions? (e.g., customer support, order processing, payroll)
- What is the minimum staffing needed to maintain each function?
- What alternative locations or remote arrangements exist?
- How do we communicate with staff, customers, and suppliers during a disruption?
- What are the escalation thresholds? (When do we invoke the BCP?)
Example: A fire in your office disables your workspace. The BCP covers:
- Staff work from home
- Phones forwarded to mobile numbers
- Customer notifications sent within 2 hours
- Critical orders processed using cloud-based systems
- Non-critical work suspended for 48 hours
Disaster Recovery Plan (DRP)
Purpose: Restore IT systems and data after a failure.
Scope: Infrastructure, applications, and data. Technical focus.
Key questions:
- What are our critical systems? (e.g., email, CRM, production database)
- What is the recovery time objective (RTO) for each system?
- What is the recovery point objective (RPO) — how much data can we afford to lose?
- Where are backups stored? How quickly can they be restored?
- What is the step-by-step recovery procedure for each system?
Example: A ransomware attack encrypts your servers. The DRP covers:
- Isolate affected systems
- Identify the entry point and close it
- Restore from clean backups
- Verify integrity before reconnecting
- Resume operations within the RTO
Why they must be separate
A combined document creates two problems:
-
The business side gets lost. A DRP written by engineers will focus on servers and backups. It will not address customer communication, alternative workspaces, or staffing decisions.
-
The technical side gets shallow. A BCP written by operations will say “restore from backup” without specifying which backup, how long it takes, or the verification steps.
Auditors check both. Customers ask about both. Regulators require both.
A practical approach for SMEs
For a company under 30 people, you do not need 50-page plans. You need:
BCP (2–3 pages):
- List of critical functions and minimum staffing
- Communication tree (who calls whom, in what order)
- Alternative work arrangements
- Customer and supplier notification templates
DRP (3–4 pages):
- List of critical systems with RTOs and RPOs
- Backup locations and restoration procedures
- Step-by-step recovery checklist
- Escalation contacts (internal and external)
Test both annually. A tabletop exercise for the BCP. A restore test for the DRP.
At Metaluxo we write BCPs and DRPs for SMEs as part of our vCISO and incident readiness engagements. If your auditor or a major customer is asking for continuity plans and you are not sure where to start, book a free 30-minute consultation and we will scope exactly what you need.
Common questions
Do small companies need both BCP and DRP?
Yes, if they have audit or contractual requirements. A 10-person company may combine them into one document, but the two functions must be clearly distinguished.
How often should we test business continuity plans?
At least annually. Tabletop exercises every 6 months and full recovery tests annually are the standard for companies handling sensitive data.
What is a recovery time objective (RTO)?
RTO is the maximum acceptable time to restore a system after failure. For critical systems, SMEs typically set RTOs of 4–24 hours.
