Material Changes

The outcome of the process is no longer framed only as a Business Continuity Plan (BCP). The broader program is Business Continuity Management (BCM), and your recovery plan is one part of it.

The revised guidance places resilience ahead of response and recovery. Resilience is the ability to prepare for changing conditions, withstand disruption, and recover rapidly from deliberate attacks, accidents, or naturally occurring events. Most established BCPs already contain recovery procedures. The additional work is documenting the measures that may prevent an interruption or reduce its effect before recovery begins.

Fire suppression, data backups, redundant circuits, succession plans, and alternate vendors are examples of resilience measures. You can account for them when comparing a threat’s inherent impact with the residual impact that remains after controls are applied. That gives your leadership a clearer view of what your institution can withstand and where exposure still needs a decision.

How the Development Process Changed

The previous handbook used a four-step approach:

1. Business impact analysis
2. Risk assessment
3. Risk management, including recovery procedures
4. Risk monitoring and testing

The revised guidance uses a broader process:

1. Risk management: Business impact analysis and risk/threat assessment.
2. Continuity strategies: Interdependency resilience, continuity, and recovery.
3. Training and testing: Exercises that prepare people and tests that verify capabilities.
4. Maintenance and improvement: Documented follow-up that keeps the program current.
5. Board reporting: Clear information on risks, priorities, test results, and unresolved issues.

Next Steps

A search-and-replace from Business Continuity Plan to Business Continuity Management will not address the substance of the guidance. Start by checking whether your current program covers the expanded process and gives leadership usable evidence of resilience.

Use the following questions to evaluate the work already in place. Answer each one with Yes, completely; Yes, somewhat; or No.

• Have you completed a formal, business-process-based business impact analysis that identifies critical interdependencies?
• Does the business impact analysis establish recovery point objectives, prioritized recovery time objectives for each business process, and maximum tolerable or allowable downtime?
• Does your risk/threat assessment measure both impact and likelihood, including low-probability, high-impact scenarios?
• Have you identified existing resilience measures, including cyber controls, for the assets and vendors supporting each critical business process?
• Do you use the business processes, interdependencies, and recovery priorities identified in the business impact analysis to guide documented testing?
• Do exercises prepare employees to understand recovery priorities and carry out assigned procedures?
• Do you track and resolve issues found during exercises and tests, then document how those lessons improve the program?
• Does your board report provide the business impact analysis, risk assessment, recovery plan, exercise and test results, and identified issues?
• Do you assess pandemic impact and likelihood alongside other threats rather than treating it as a separate planning exercise?

If more than five of your nine responses are No or Yes, somewhat, the broader program may need reevaluation. If at least six are Yes, completely or Yes, somewhat, targeted adjustments may be enough. The score is a starting point, not a substitute for judgment. A single weakness involving a critical process or provider may still require immediate attention.

Summary

Every continuity program will need some adjustment. Use your regular BCM review cycle to assign the work, set a timeline, and decide what evidence auditors, examiners, senior management, and the board will receive.

The revised structure gives you a practical direction: understand the business processes, identify the dependencies behind them, document what makes those processes resilient, test the people and systems involved, and keep unresolved issues visible until they are closed.