Business Continuity Plan (BCP)
A business continuity plan (BCP) is how the business keeps operating through disruption — people, communication, decision authority, critical processes. Disaster recovery (DR) is its technical subset: how the systems come back — backups, failover, restoration procedures. Frameworks ask for both and auditors sample the seams between them.
What each plan must actually contain
BCP: which business functions are critical, who has decision authority when normal chains break, how you communicate (internally, to customers, to regulators) when primary channels are down, and what triggers activation. DR: system-by-system recovery procedures with RTO/RPO targets, backup configuration and restoration steps, failover architecture, and named runbook owners.
The evidence that matters
Not the documents — the tests. A completed backup restoration (a backup job succeeding proves nothing about restorability), a DR exercise against the stated RTOs, and ideally a tabletop that exercised the BCP’s decision layer. Auditors sample the test records; regulators like MAS go further and expect testing at production-realistic scale for critical systems.
The startup-honest version
At 20 people on managed cloud, your DR is mostly your cloud architecture — document what’s actually true (multi-AZ, automated backups, restoration tested on this date) rather than importing an enterprise template about alternate work sites. A two-page true plan with one test record outperforms a forty-page aspiration in every audit, every time.
Incident Response Plan — An incident response plan defines how you detect, triage, contain, and learn from security incidents — with the records SOC 2 auditors and regulators sample.
RTO vs RPO — RTO is how fast systems must come back; RPO is how much data you can afford to lose. Together they price your disaster recovery architecture.
Tabletop Exercise — A tabletop exercise is a discussion-based rehearsal of your incident response plan — the cheapest strong evidence that the plan actually works.