---
title: "Business continuity"
canonical: "https://auditbadger.com/features/business-continuity/"
last-updated: "2026-11-07"
---

# Business continuity

BCP (Business Continuity Plan) documentation, a Recovery Time Objective (RTO) per process, a test cadence per plan, and exercise records. Supports the SOC 2 Availability TSC and ISO 27001 controls A.5.29 and A.5.30.

## What it does

| Capability | Detail |
|---|---|
| **BCP documentation** | Structured plans with a description, recovery steps, an owner and attachments |
| **Critical process identification** | Each business process gets a criticality rating and an owner |
| **RTO targets** | Set a Recovery Time Objective per process |
| **Plan testing** | Each plan has a test cadence (3, 6, 12 or 24 months); schedule and document tabletop exercises and full BCP tests; capture lessons learned |
| **Risk register integration** | Risks linked to the business processes that address them |
| **Plan approval** | An approval sign-off records who approved a plan and when, and resets when the plan changes |

## Standards alignment

| Framework | Reference |
|---|---|
| **ISO 27001:2022** | A.5.29 (Information security during disruption), A.5.30 (ICT readiness for business continuity) |
| **SOC 2** | Supports the Availability Trust Services Criterion (CC9 + A1) when Availability is in scope |

## Common scenarios covered

- Natural disaster recovery
- IT system failure response
- Cybersecurity incident continuity
- Supply chain disruption
- Pandemic / health crisis response

## Workflow

1. **Assess**: identify critical processes, starting from AI-drafted suggestions or your own list
2. **Plan**: write recovery procedures and set an RTO per process
3. **Test**: schedule tabletop or full exercises; document results, lessons learned and action items
4. **Maintain**: run exercises on each plan's test cadence; overdue tests are flagged

## Useful links

- Sign up: [auth.auditbadger.com/signup](https://auth.auditbadger.com/signup)
- All features: [/features](/features)
- Risk assessment (companion module): [/features/risk-assessment](/features/risk-assessment)
- Incident management: [/features/incident-management](/features/incident-management)
- ISO 27001 deep dive: [/compliance/iso27001](/compliance/iso27001)