How should you approach business continuity planning (BCP) in Annex B?

• A. Identify critical processes, establish RTOs/RPOs, implement redundant systems, and test regularly.
• B. Rely on ad-hoc recovery without defined objectives.
• C. Ignore testing to save resources.
• D. Limit BCP to IT systems only.

Answer: (A)

A solid approach to BCP in Annex B starts by identifying the processes and resources that must keep operating during a disruption, so you know what you’re protecting. Then set clear recovery objectives—RTOs to define how quickly systems and services must be restored, and RPOs to cap how much data could be lost—so priorities and tolerances are explicit. Build in redundancy and alternate arrangements to meet those objectives, and test the plan regularly to verify readiness, train people, and surface gaps before an actual incident. This combination of defined objectives, practical resilience measures, and ongoing validation is what makes the plan actionable and trustworthy.

Relying on ad-hoc recovery without objectives leaves you with no measurable targets or priorities. Skipping testing means you won’t know if the plan works until a real incident hits. Limiting BCP to IT systems ignores the broader business dependencies—people, facilities, suppliers, and processes—that must continue to function for the organization to survive a disruption.