A business continuity plan (BCP) — known in French as a PRA, plan de reprise d’activité — is the documented setup that lets a company restart its critical systems after a disaster (failure, fire, cyberattack, outage) within a defined time. It rests on three pillars: tested backups, a standby infrastructure, and a written procedure with named owners.
In practice, two indicators drive everything: RTO (acceptable downtime) and RPO (acceptable data loss).
How does a business continuity plan work? Short answer
A BCP works in four stages: identify critical systems, replicate their data to a standby site or cloud, document the failover procedure with owners, then test the restart regularly. Without testing, a BCP does not exist — it is a document, not a capability.
RTO and RPO: the two numbers that define your BCP
| Indicator | Meaning | SME example |
|---|---|---|
| RTO | Maximum acceptable downtime | 4 hours for ERP, 1 day for email |
| RPO | Maximum acceptable data loss | 15 minutes for invoicing, 24 h for files |
| MTTR | Actual average restore time | Measured in tests, must stay under RTO |
The 5 stages of building a BCP
Stage 1 — Map critical systems. List applications, servers and databases, and identify what halts the business when unavailable.
Stage 2 — Set RTO and RPO per application. Not all applications share the same criticality: payroll tolerates 24 h, invoicing does not.
Stage 3 — Implement replication. Backups following the 3-2-1 rule (three copies, two media, one off-site) and continuous replication to a standby site or cloud.
Stage 4 — Write the procedure. Who does what, in what order, with which emergency credentials. Backup credentials must be reachable outside the failed system.
Stage 5 — Test and correct. A full restore test at least twice a year, with a written report and corrective actions.
BCP, DRP and backup: do not confuse them
| Discipline | Purpose | Typical target |
|---|---|---|
| Backup | Copy data so it can be restored | All businesses |
| BCP / PRA (IT recovery) | Restart IT systems after a disaster | SMEs with ERP / production |
| Business continuity (PCA) | Keep the business running during the outage (sites, people, procedures) | Industry, healthcare, logistics |
Mistakes that make a BCP useless
1. Backing up without testing restore. The leading cause of failure: discovering during the disaster that the archive is unreadable.
2. Keeping the backup in the same building. A fire or ransomware encrypts both copies.
3. Not documenting emergency access. If the server password lives on the server, you have nothing.
4. Ignoring cloud dependency. Check your provider’s commitments and your ability to extract your data.
5. Naming no owner. A BCP without a designated lead is triggered too late.
What we deploy
NETREGIA runs the criticality audit, sizes RTO/RPO, implements 3-2-1 backups and replication, writes the BCP, trains your teams, then runs periodic tests. See our data backup and recovery and cloud computing pages.
In short: a BCP is tested backups + standby infrastructure + a written procedure with named owners. RTO = tolerated downtime, RPO = tolerated data loss. Without a restore test twice a year, you have no BCP.
Are you actually protected?
Devis gratuit sous 24 h. Casablanca et tout le Maroc.
