How to Create a Business Continuity Plan

To remain competitive in today's market, businesses in all industries must maintain strict production regulations to decrease downtime and critical errors that could negatively impact their reputations. Organizations can't afford to wait until an event occurs to devise a problem-solving strategy.

Your business provides critical products or services to its customers. Any interruption in that service could mean that your customers will seek ways to meet their needs elsewhere.

The term business continuity describes the way an organization maintains or quickly resumes business functions in the event of a disaster. By creating an effective business continuity plan, you're more likely to avoid downtime and the loss of critical data and infrastructure in the event of a major business disruption.

In the past, business continuity planning was largely based on physical events like a natural disaster, building fire, tornadoes, or a long-term power outage. However, as technology becomes more advanced, cyberattacks have become a major threat to businesses large and small.

This is why it's essential for all businesses to get a firm understanding of the importance of cybersecurity as a part of business continuity and how to integrate cybersecurity into your updated continuity plan before disaster strikes.

What is a Business Continuity Plan?

A business continuity plan (BCP) is a specific set of preventive and recovery actions that key individuals will take in the event of a threat to your organization.

A typical BCP covers:

• Business processes
• Assets
• Human resources
• Business partners/suppliers/third-party vendors

Essentially, the plan should be a template or rule book to describe the best way to keep essential functions up and running during a disaster and to recover with as little downtime and damage as possible.

The goal of a business continuity plan is to predict how various disasters would affect your business and the best way to react to such an event. Unpredictable events that your plan addresses may include extreme weather conditions, fires, natural disasters, disease outbreaks, and cyberattacks.

The absence of such a plan could lead to more than a financial loss and a lower competitive edge — it could actually mean closing your doors permanently. Federal Reserve economists estimate that around 600,000 businesses close permanently each year, but due to the global pandemic, an additional 200,000 businesses closed in 2020.

Reasons for business failures are often listed as lack of funds, poor management, or ineffective marketing. Business continuity planning is a way to address such potential issues before they arise.

How to Create a Business Continuity Plan

Your business continuity plan should be in place before disaster strikes. By investing time and effort into building a team and creating a comprehensive plan, you'll be ready to respond to threats when they arise.

Take these steps to create an effective business continuity plan.

• Form a business continuity management team.
• Write a mission statement that states the objectives of the plan.
• Conduct a business impact analysis to determine the potential risks to your company.
• Write the plan procedures and details about the required tools, infrastructure, and software required.
• Test your plan and make improvements as needed.

Why Cybersecurity is an Important Part of an Effective Business Continuity Plan

A cyberattack is one of the most relevant threats faced by businesses of all sizes, across all industries. Practically all businesses store sensitive information. This may include information technology, customer contact information, personal data, and phone numbers. Due to a variety of factors, cybercrime saw explosive growth in 2021.

• 50% more cyberattacks per week on corporate networks were reported in 2021, compared to 2020.
• Ransomware damage costs reported in 2021 reached a whopping $20 billion with an attack occurring every 11 seconds. The cost is estimated to reach $265 billion in 2031 with an attack occurring every 2 seconds.
• According to IBM's Cost of a Data Breach Report 2021, the average total cost of a data breach increased from 3.86 million in 2020, to 4.24 million in 2021. For the 11th year in a row, healthcare organizations experienced the highest average cost of a data breach.

While the media and the public continue to recognize the impact of cybercrime on government agencies, major corporations, and critical infrastructure, many business owners fail to recognize the potential impact of cybercrime on a small business. Yet, data shows that 43% of all data breaches involve small to medium businesses and 61% of all SMBs have reported at least one cyberattack during the previous year.

These numbers make one thing clear, cyberattacks are a clear and present threat to every business. If you hope to maintain critical business functions in the event of a cyberattack, it's essential to make cybersecurity a pivotal part of your business continuity planning process.

5 Ways to Incorporate Cybersecurity into Your Business Continuity Plan

Your business continuity plan should be a changing, growing document that is continually updated to offset new and growing potential threats to your business. Adding critical steps to address cybersecurity risks is a crucial part of updating your plan to reflect potential risks that are most likely to affect your business. Consider the ways these actions can help you be more prepared in the event of a cybersecurity attack.

1. Perform a Risk Assessment and Business Impact Analysis

If you have an existing business continuity plan in place, you've likely identified certain vulnerabilities and assessed the likelihood of business interruptions due to specific threats. The addition of cybersecurity to your BCP requires your business continuity team to perform a risk assessment by identifying specific assets that could be in danger and predicting the types of threats that are most likely to affect those assets. After effectively identifying specific threats, it's important to conduct a business impact analysis (BIA) to determine the financial and operational impacts such an attack would cause.

For most companies, an effective risk assessment and BIA will require identification and documentation of all devices owned by the organizations, the business areas where devices are located, and the current cybersecurity methods in place to protect each device. More detailed documentation may be necessary that categorizes devices by the level of sensitive data that is stored or transported with the device. Once you have a comprehensive view of your current cybersecurity posture, you can determine the steps that need to be taken to develop a strong cybersecurity defense.

2. Assess Third-Party and Supply Chain Risks

Your cybersecurity efforts are only as strong as the weakest link. Unfortunately, when it comes to cybersecurity, protecting the devices in your organization isn't enough. Every member of your supply chain has the potential to provide a point of access for cybercriminals seeking a way into your network.

These third parties can introduce risks to your system by failing to meet compliance standards, introducing of breaches through third-party software, or sharing corrupted data. Supply chain attacks in the US rose by 42% in the first quarter of 2021. Yet many companies fail to recognize such threats.

If you work with third-party vendors and distributors, you likely already practice some third-party risk management strategies. This may include checking the creditworthiness or compliance history of third-party service providers.

By cataloging cybersecurity risks that vendors could expose your organization to, you can begin to assess the risks that your current business relationships bring to your network. Your BCP can also include preventive steps to take when forming new partnerships, like a vendor due diligence process that considers risks before a partnership begins.

A vendor risk management checklist can help you perform a complete vendor management audit to assess potential risks third parties pose to your network.

3. Devise an Incident Response Plan

The old advice that "an ounce of prevention is worth a pound of cure" holds true in the cybersecurity world. However, even the most stringent defense won't ensure you never face an attack. An incident response plan is a set of written instructions that outline your organization's preparedness to respond to an emergency that could lead to expensive downtime or damage to the organization.

Your cybersecurity response plan should include step-by-step instructions that describe how your organization should respond to data breaches, data leaks, cyber-attacks, and cybersecurity incidents. For many businesses, an incident response plan is designed to follow certain compliance regulations, such as NIST or SANS guidelines. Critical parts of your incident response plan may include data backup protocol for a complete disaster recovery plan, emergency management processes that include a communication plan, and recovery time objectives.

4. Test Your Incident Response Plan

Your incident response plan is based on data and facts that lead to the best practices for business continuity management. Yet, without tests, it's impossible to know how well your methods will work.

Once you have a clearly documented plan in place, it's important to create tests that simulate real attacks to put your plan to the test. NIST Special Publication 800-84 defines tests and two types of exercises to evaluate response policy and procedures.

• Tabletop Exercises: This exercise generally includes your business continuity team and stakeholders gathering around a table to run through a mock security event. Discussions may include roles, responsibilities, coordination, and decision-making regarding a given scenario.

• Functional Exercises: By creating a simulated environment, your business continuity team can validate their emergency response by actually performing the duties outlined in the incident response plan.

• Tests: With the use of specific software and tools, tests can use quantifiable metrics to validate the operations of an IT system or cybersecurity software in an operational environment. Tests can also be used to acquaint new cybersecurity software and tools to your network's normal environment to set parameters for effective automated alerts.

5. Continually Assess Incoming Risks and Update Practices

As technology continues to evolve, cyberattacks will become more advanced and sophisticated to generate new methods of attack. Consider how Ryuk ransomware took advantage of an exposed vulnerability to launch a devastating zero-day attack or the way the SolarWinds attack utilized discreet lateral movement to go undetected for months. Modern cybercriminals will stay on top of technology to continually search for new vulnerabilities companies aren't prepared to defend against.

Your BCP shouldn't be considered a "set it and forget it" tool that will always be ready when you need it. A review should be scheduled at least once a year to discuss any areas that need to be modified. Such changes may include key personnel changes, methods, and recovery strategies to improve your security posture. In the event of a disaster, your BCP should be thoroughly reviewed in light of new information provided by the incident.