An incident response plan describes how to react to an incident. Business continuity management goes further: it asks how the business keeps running while IT is not yet restored, and how long the company can withstand an outage.
Business impact analysis
It starts with which processes are critical and what an outage costs over hours, days and weeks, financially, legally and reputationally. From this follow, for each critical process, the maximum tolerable downtime and the recovery objectives RTO and RPO for the underlying systems.
Strategies and plans
For each critical process it is set how it continues during an outage: manual fallback procedures, alternative sites, alternative providers or prioritised recovery. Plans name owners, contact lists reachable without email and the order of recovery.
Exercising
A plan never exercised rarely works in an emergency. Tabletop exercises show with little effort where assumptions fail, and technical restore tests show whether backups meet the objectives.
Swiss context
The Federal Office for National Economic Supply has published the ICT minimum standard, a practical basis aimed especially at critical infrastructure operators but also useful for SMEs. Under NIS2, business continuity is explicitly among the measures covered entities must implement. The steps to a first plan are in our business continuity plan checklist.