Business Continuity (BC) and Disaster Recovery (DR) planning and testing is the safety net for an organisation's most critical operations. For the CC exam, you need to understand how to prepare for and survive disruptions like cyberattacks, power failures, or natural disasters, and why regular testing is just as important as the plan itself.
Jump to a section
A simple way to picture BC/DR Planning and Testing
You spend 3 hours every Sunday preparing meals for the week. You chop a kilo of vegetables, marinate two kilos of chicken, cook a large pot of rice, and portion everything into containers. This is your Business Continuity (BC) plan — prepping for normal operations.
But one Sunday, a power cut hits your area for 6 hours. Your fridge is useless. You can't cook anything. Your meal prep is at risk. So you have a backup plan: a cooler box with ice packs. You also have a camping stove and a can of beans in the cupboard. This is your Disaster Recovery (DR) plan — what you do after a disaster to get back to normal.
During the week, you don't just hope your meal prep works. You smell-test the chicken on Wednesday. You check the fridge temperature on Friday. You replace the ice packs in the cooler every month. This is testing and maintenance. If you never test your cooler box, you might discover on the day the power fails that it leaks. If you never practise using the camping stove, you might not know how to light it in the dark. BC/DR planning is preparing for the disruption before it happens, and BC/DR testing is making sure your preparation actually works.
Business Continuity (BC) and Disaster Recovery (DR) are two related but distinct concepts that work together to keep an organisation running when things go wrong. Let us break them down from the ground up.
Business Continuity (BC) is the overall strategy for keeping essential business functions running during and after a crisis. Think of it as the big-picture plan that covers everything from who makes decisions to how employees communicate if the office is flooded. A Business Continuity Plan (BCP) documents all of this: the critical processes, the people responsible, the resources needed, and the procedures to follow. The goal is to minimise disruption to customers, revenue, and reputation.
Disaster Recovery (DR) is a subset of BC that focuses specifically on restoring IT systems and data after a disaster. A Disaster Recovery Plan (DRP) answers questions like: How do we get our servers back online? How do we restore customer data from backups? Which systems do we bring back first? DR is the technical part of the rescue.
The key difference is that BC is about keeping the business alive — even if that means staff working from a different location with paper records. DR is about getting the technology working again so the business can return to normal operations.
Why do organisations need BC and DR planning? Without it, a single event — a ransomware attack, a fire in the server room, a flood — can shut down operations permanently. The exam uses the term 'single point of failure' to describe a component whose failure would stop everything. BC/DR planning identifies and mitigates these points.
Plans are useless if they do not work. That is where testing comes in. Testing exercises the plan to find gaps. There are several types of tests:
Checklist review: Team members read through the plan and verify that contact information, resource lists, and procedures are up to date.
Tabletop exercise: Key stakeholders sit in a room (or on a video call) and walk through a scenario step by step. They discuss decisions without actually performing any technical actions. This is low-cost and reveals confusion in roles or processes.
Simulation: A realistic scenario is enacted. For example, the IT team might be told, 'The main data centre is offline. What do you do?' They then perform the actual recovery steps in a test environment.
Full interruption test: The organisation deliberately shuts down a production system to test DR procedures. This is high-risk but gives the truest picture of readiness.
Testing reveals problems: missing backups, passwords that no longer work, staff who do not know their roles, dependencies on vendors that are not contactable. Each test should produce a list of improvements. The plan is then updated and the cycle repeats.
Maintenance is the ongoing process of keeping the plan current. Organisations change: new software, new vendors, new staff, new offices. The plan must reflect those changes. Most organisations review their BC/DR plan at least annually, and after any major change or incident.
For the CC exam, you need to remember that planning, testing, and maintenance form a cycle. You write the plan. You test it. You find issues. You fix them. You test again. Without testing and maintenance, a year-old plan is just a document gathering dust — and on the day of a real disaster, it may be worse than useless.
Risk Assessment and Business Impact Analysis
Identify which threats (flood, ransomware, power cut) could affect the organisation and which business functions are most critical. For example, an e-commerce company might decide that the payment processing system must be restored within 2 hours, while the internal chat system can wait 24 hours.
Develop the Business Continuity Plan (BCP)
Write the document that covers the overall strategy for keeping the business operational. Include contact lists, communication procedures, alternative work locations, and decision-making hierarchies. This plan is the high-level playbook for the entire organisation.
Develop the Disaster Recovery Plan (DRP)
Write the technical document that details how IT systems and data will be restored. Include backup locations (on-site, off-site, cloud), restoration priorities, step-by-step recovery procedures, and contact information for IT vendors.
Test the Plans
Run exercises to validate that the plans work. Start with a checklist review or tabletop exercise, then progress to a simulation or full interruption test if resources allow. Each test should be documented, and any discovered issues should be corrected.
Review and Maintain
After each test or real incident, conduct a post-incident review. Update the plans to fix gaps, reflect organisational changes, and incorporate lessons learned. Schedule a regular review cycle (at least annually) to keep the plans current.
Sarah is the IT Manager at a medium-sized accounting firm with 200 employees. The firm stores client tax returns, payroll data, and financial records on a local server in its office basement. One Tuesday morning, a pipe bursts in the ceiling directly above the server rack. Water pours onto the equipment. The server shuts down immediately. No one can access any client data. The phones start ringing.
Here is what Sarah does, step by step, using her BC/DR plan:
Activate the DR plan: Sarah pulls up the Disaster Recovery Plan from a cloud-based document that she can access from her phone — because the server is dead and the local network is down. The plan tells her to contact the CEO and the head of each department. The plan includes a phone tree: a list of who calls whom.
Assess the damage: She goes to the server room. The equipment is wet. She calls the firm's IT support vendor, whose number is in the plan. She also calls the building's facilities manager to shut off the water source.
Restore from backup: The DR plan specifies that backups are taken every evening to an encrypted hard drive stored in a fireproof safe in another building. Sarah's colleague retrieves that drive. The plan also includes a cloud backup service — weekly backups that are encrypted and stored off-site. She initiates recovery from the cloud backup first, since it is accessible immediately.
Communicate with stakeholders: The BC plan includes a template for notifying key clients about the disruption. It also lists which staff members should work from home and how to log in to a remote desktop environment that was set up as a fallback.
Test the restoration: Before she starts the full restore, she tests a small data sample on a spare laptop to confirm the backup is not corrupted. The plan required this step because the last time — before she joined — the team tried a full restore and discovered the backup was corrupted. They lost two days of work.
Document everything: Sarah logs every step she takes: when she contacted the vendor, when the backup was retrieved, which systems were restored in what order. This will be used to improve the plan later.
After the crisis, Sarah runs a 'post-incident review'. She identifies gaps: the phone tree did not include the new receptionist, and the cloud backup service took longer than expected because the firm's internet connection was too slow. She updates the plan, schedules a tabletop exercise with the new phone tree, and upgrades the internet connection. The firm now has a more resilient setup because the incident revealed weaknesses.
For an IT professional, BC/DR is not a one-time project. It is a continuous cycle of planning, testing, updating, and repeating. Real-world tools like backup software, cloud storage, and remote access solutions are part of this, but the plan itself — the document — is what makes everything work together.
The CC exam tests your understanding of what BC and DR are, the difference between them, and the key terms related to testing and maintenance. Here is exactly what you need to know.
Exam topics you must master:
The distinction between Business Continuity (BC) and Disaster Recovery (DR). BC is the broader plan for keeping the business operational; DR is specifically about restoring IT systems after a disaster.
The purpose of testing: to identify gaps and ensure the plan works. The exam will present scenarios and ask which type of test is most appropriate.
The types of tests: checklist review, tabletop exercise, simulation, and full interruption test. You need to know the order of risk and realism. Checklist review is lowest risk and least realistic; full interruption is highest risk and most realistic.
The concept of a 'single point of failure' and why BC/DR identifies it.
The importance of maintenance: plans must be updated regularly and after changes or incidents.
The difference between a backup and a DR plan. A backup is a copy of data. A DR plan tells you how to use that backup and restore the entire system.
Common traps the exam sets:
They might ask which activity belongs to BC versus DR. For example, 'arranging for alternative office space' is BC, not DR. 'Restoring the email server from tape backup' is DR.
They might describe a test scenario and ask for the correct test name. For example, 'A team walks through a scenario without actually performing any technical steps' — this is a tabletop exercise, not a simulation.
They might state that testing is optional. This is false. The exam expects you to know that testing is essential and mandatory for a good BC/DR plan.
They might offer a scenario where a plan is written and never tested. You must recognise that as inadequate.
They might confuse 'recovery point objective' (RPO) and 'recovery time objective' (RTO). RPO is how much data loss is acceptable (e.g., losing one hour of data). RTO is how quickly systems must be restored (e.g., within four hours). These are not explicitly in objective 5.2 but often appear in related questions.
Key definitions to memorise for the exam:
Business Continuity Plan (BCP): A document that outlines how the organisation will continue to operate during and after a disaster.
Disaster Recovery Plan (DRP): A subset of the BCP that focuses on restoring IT systems and data.
Tabletop exercise: A discussion-based test where participants walk through a scenario without taking real action.
Simulation: A hands-on test where participants perform actual recovery steps in a controlled environment.
Full interruption test: A high-risk test where a live system is deliberately shut down to test recovery procedures.
Single point of failure: A component whose failure would stop an entire process or system.
Post-incident review: An analysis after a real incident or test to identify what went well and what needs improvement.
The exam will not ask you to write a full BC/DR plan. Instead, it will test your understanding of the principles and your ability to choose the correct term or action in a given scenario. Focus on the 'why' behind each concept, not just the definition.
Business Continuity (BC) is the overall strategy for keeping the business running during a crisis, while Disaster Recovery (DR) focuses specifically on restoring IT systems and data.
A BC/DR plan must be tested regularly using methods like tabletop exercises, simulations, and full interruption tests to find gaps before a real disaster.
The most common testing methods are checklist review, tabletop exercise, simulation, and full interruption test, listed from lowest to highest risk and realism.
Maintenance of the plan is just as important as creating it — the plan must be updated after any significant change to the organisation or after each test or real incident.
A backup is not the same as a Disaster Recovery Plan; a backup is data, while a DR plan is the set of procedures that tells you how to use that data to restore operations.
Single points of failure are components whose failure could stop critical operations, and BC/DR planning aims to identify and mitigate them.
The CC exam will test your ability to distinguish between BC and DR activities and to identify the correct type of test for a given scenario.
An untested plan is worse than no plan because it creates a false sense of security that will fail in a real crisis.
These come up on the exam all the time. Here's how to tell them apart.
Business Continuity (BC)
Covers the entire organisation, including non-IT functions like HR and facilities.
Aims to keep business operations running during a crisis, possibly with manual or alternative processes.
Includes procedures for communication, alternative workspaces, and decision-making hierarchies.
Disaster Recovery (DR)
Focuses specifically on restoring IT systems and data.
Aims to recover normal IT operations as quickly as possible after a disaster.
Includes step-by-step restoration procedures, backup recovery, and vendor contacts for IT infrastructure.
Tabletop Exercise
Discussion-based — participants talk through a scenario without any technical actions.
Low cost and low risk; can be done in a conference room or over video call.
Reveals confusion about roles, procedures, and decision-making under pressure.
Simulation Test
Hands-on — participants perform actual recovery steps in a test environment.
Moderate to high cost and risk; requires a controlled environment that mirrors production.
Reveals technical gaps like missing passwords, broken scripts, or incompatible backup formats.
Recovery Point Objective (RPO)
Defines the maximum acceptable amount of data loss measured in time (e.g., 1 hour).
Determines how frequently backups must be taken (e.g., every hour to meet a 1-hour RPO).
Focuses on data — how far back in time you must restore.
Recovery Time Objective (RTO)
Defines the maximum acceptable downtime before systems must be operational again (e.g., 4 hours).
Determines how quickly the recovery process must work (e.g., restore within 4 hours).
Focuses on time — how long you can afford to be without the system.
Backup
A copy of data stored on tape, disk, or in the cloud.
Does not include instructions or procedures; it is just raw data.
Can exist without a DRP, but is less useful because no one knows how to use it properly.
Disaster Recovery Plan (DRP)
A document containing step-by-step procedures for restoring systems after a disaster.
Includes contact lists, restoration priorities, and vendor information.
References backups as one component, but also covers communication, testing, and maintenance.
Mistake
A Disaster Recovery Plan is the same as a Business Continuity Plan.
Correct
A Disaster Recovery Plan is a subset of the Business Continuity Plan. BC covers all business functions (people, facilities, communications), while DR focuses specifically on restoring IT systems and data after a disaster.
The terms are often used interchangeably in casual conversation, and many beginners hear 'disaster recovery' used to describe any kind of emergency response, so they assume it covers everything.
Mistake
Once you have written the BC/DR plan, the job is done.
Correct
The plan must be tested regularly and updated after any significant change or incident. An untested plan is likely to fail in a real crisis because it relies on assumptions that may no longer be true.
Writing a document feels like a concrete achievement, so people mistake the creation of the plan for the completion of the process. They do not understand that a plan without testing is just a theory.
Mistake
Testing a BC/DR plan means running a full-scale drill every time.
Correct
There are multiple types of tests with different levels of cost and risk. A tabletop exercise is a valid and useful test, and organisations often start with lower-risk tests before moving to full interruption tests.
In popular culture, 'drills' are always shown as large, dramatic events. Beginners do not realise that the most common and valuable tests are simple discussions or checklist reviews.
Mistake
Backups are the same as a Disaster Recovery Plan.
Correct
A backup is a copy of data. A Disaster Recovery Plan includes backups as one component, but also covers procedures for restoring systems, contacting vendors, communicating with stakeholders, and prioritising which systems come back first.
People often think 'I have a backup, so I am safe.' They do not consider the process of actually using that backup to get everything back online, which is a much more complex task.
Mistake
A Disaster Recovery Plan is only needed for natural disasters like floods or earthquakes.
Correct
DR plans should cover any event that disrupts IT systems, including cyberattacks (ransomware), human error (accidental deletion), hardware failures, and power outages. Any scenario that causes downtime is relevant.
The word 'disaster' makes people think of catastrophic natural events. They forget that a ransomware attack or a corrupted database can be just as damaging and much more common.
Mistake
The IT department owns the entire Business Continuity Plan.
Correct
BC planning is an organisation-wide responsibility. While IT owns the DR portion, the BC plan involves HR (people and communications), facilities (physical space), legal (regulatory obligations), and senior leadership (decision-making and prioritisation).
Because IT is heavily involved in the DR part, people assume they handle everything. They do not consider that a BC plan also covers non-technical functions like payroll, customer service, and logistics.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Business Continuity (BC) is the overall plan for keeping the entire business running during a crisis, including people, facilities, and communications. Disaster Recovery (DR) is a subset that focuses specifically on restoring IT systems and data after a disaster.
No. A good BC/DR plan is flexible and covers a range of scenarios, not just one. The same procedures for restoring a flooded server room can often be applied to a ransomware attack. The plan should focus on the impact (downtime, data loss) rather than the specific cause.
At least once a year, and after any significant change to the organisation (new systems, new office, new critical staff) or after any real incident. Some organisations test quarterly with tabletop exercises and do a full simulation annually.
Your plan is likely to fail in a real disaster. Untested plans often have incorrect contact information, missing passwords, outdated procedures, or dependencies on systems that no longer exist. Testing finds these gaps before they cause real damage.
No. A backup is a copy of your data. A Disaster Recovery plan is a document that includes step-by-step instructions for restoring systems, including how to use those backups. A backup without a plan is just a file; a plan without a backup is just a wish.
Everyone has a role, but the BC plan is owned by senior leadership because it involves organisation-wide decisions. IT is responsible for the Disaster Recovery part, while HR, facilities, and legal all contribute to the overall BC plan.
You've finished BC/DR Planning and Testing. Continue through the CC study guide to build a complete picture of the exam.
Done with this chapter?