CMP or BCP: what's the difference?
A crisis management plan and a business continuity plan are often confused with each other, or merged into one thick document. Yet they answer different questions. What does each plan cover, how do they fit together, and which one do you need?
Anyone starting out with crisis and continuity management soon comes across two abbreviations: CMP and BCP. They sound similar, and both are about disruptions. So in practice we often see an organisation that has one plan and assumes the other is covered as well. Or both have been crammed into a single document, so that nobody can find anything in it quickly under pressure.
The crisis management plan sets out who steers and decides; the business continuity plan sets out how you get business processes up and running again as quickly as possible.
What actually is a crisis?
The difference between the two plans starts with the difference between an incident and a crisis. Incidents are often foreseeable and lend themselves to an approach worked out in advance, even if you don’t know exactly when and how they will occur. A crisis is of a different order: a rare event with a major impact, which confronts the organisation with strategic questions and therefore calls for a strategic approach. Crises call for a flexible, creative and sustained approach that is rooted in the organisation’s values1.
A server outage is usually an incident: annoying, but you know what to do. A cyberattack in which customer data ends up out in the open and the press starts calling is a crisis: there are no ready-made answers, and senior management has to make choices that affect the organisation’s reputation and its future.
The crisis management plan (CMP)
The CMP describes how your organisation steers through a crisis. It isn’t a playbook that prescribes every step, because a crisis can’t be predicted. It’s a structure that makes sure the right people get together quickly and know how they will make decisions. A good CMP covers at least the following:
- The crisis team: who is on it, in which role, and who their deputy is.
- Escalation: when does an incident become a crisis, and who is authorised to decide that?
- Decision-making: how do you make decisions with incomplete information, and how do you record them?
- Communication: with employees, customers, suppliers, regulators and the press. Who speaks on behalf of the organisation?
- De-escalation and aftercare: when is the crisis over, and how do you evaluate it?
A usable CMP is short. Under pressure you don’t read fifty pages; you pick up an action card with your role and the first steps.
The business continuity plan (BCP)
The BCP focuses on keeping your critical processes going. It is generally described as documented information that helps your organisation respond to a disruption and resume and recover the delivery of products and services, in line with its own continuity objectives2.
The foundation of a good BCP is a business impact analysis (BIA). In it, you determine which activities take priority in order to prevent unacceptable damage during a disruption3. For each activity, you record three key times:
- Maximum tolerable period of disruption (MTPD): the period after which the consequences of a standstill become unacceptable.
- Recovery time objective (RTO): the time, within that maximum tolerable period, by which you have an activity running again at a minimum acceptable level.
- Recovery point objective (RPO): the maximum amount of data you can afford to lose. The RPO is about data, the RTO and MTPD are about time, and the RTO always falls within the MTPD.
The BCP then describes what you need to meet those objectives: people, locations, systems, suppliers and contingency measures. Think of a recovery site, manual workarounds when systems go down, or a second supplier for critical components.
The differences at a glance
| Crisis management plan (CMP) | Business continuity plan (BCP) | |
|---|---|---|
| Main question | Who steers and decides? | How does the work carry on? |
| Level | Strategic | Tactical and operational |
| Users | Crisis team and senior management | Process owners and departments |
| Basis | Scenarios and roles | Business impact analysis |
| Core | Decision-making and communication | Priorities, recovery times and resources |
| Nature | Flexible, for the unpredictable | Worked out in advance, for the foreseeable |
| Standard | ISO 22361 (guidelines) | ISO 22301 (certifiable) |
How they work together
Suppose a fire breaks out in your distribution centre. The BCP tells you that orders must be handled through another location within 24 hours, which systems are needed for that and which employees go there. The CMP makes sure the crisis team comes together, decides whether to switch to that recovery site, informs customers and answers questions from the press.
One can’t do without the other. A BCP without a crisis team is a set of procedures that nobody activates. A crisis team without a BCP has to work out, in the middle of the crisis, which processes take priority.
And sometimes a BCP simply isn’t enough. The pandemic showed this: a continuity plan won’t save a shop in the town centre when nobody is allowed to leave their home. That calls for strategic choices that no plan can contain in advance, and that is what the crisis team is for.
Five common misconceptions
- “Our BCP is our IT recovery plan.” An IT recovery plan covers getting systems back. A BCP is about the whole process: people, locations and suppliers too.
- “Everything in one document is clearer.” Often the opposite is true. Senior management needs different information from the process owner on the shop floor.
- “The more detailed the CMP, the better.” A crisis doesn’t follow a script. Too much detail makes the plan unusable as soon as reality turns out differently.
- “The plans are separate from each other.” If the CMP uses different escalation criteria or contact details from the BCP, confusion arises at the very moment it matters.
- “The plan is done once it has been approved.” You only find out whether a plan works when you exercise it.
Which plan do you need?
In practice, you need both. A few questions to work out where you stand:
- Do you know which processes need to be running again within a day, and is that documented? If not, the first step is a business impact analysis and a BCP.
- Does everyone in senior management know who takes the lead in a crisis, and who speaks on behalf of the organisation? If not, the first step is a CMP.
- Do you work with ISO 22301? Then the standard requires continuity plans and a structure for responding to disruptions. Exercising both is part of that too.
See also: What does ISO 22301 require on exercising and testing? - Do you fall under the Dutch Cybersecurity Act (Cyberbeveiligingswet)? Then the law requires both business continuity and crisis management.
See also: NIS2 and SMEs: what does it mean for your crisis management?
From paper to resilience
At Crisis Dynamics we write or update your crisis management plan and business continuity plan, in line with ISO 22301 and ISO 22361, and make sure they fit together. We then test them in a simulation, so that they match the way your team works.
From paper reality to real resilience.
Sources
- ISO 22361:2022, Security and resilience — Crisis management — Guidelines.
- ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.
- ISO/TS 22317:2021, Guidelines for business impact analysis.
Written by the Crisis Dynamics team