How to Answer Business Continuity Plan Questions
Your customer asked: “Do you maintain a business continuity plan?”
The short answer
A business continuity plan describes how essential business operations can continue through a disruption. It is not automatically the same as a disaster recovery plan, an emergency contact list, or a backup process.
Educational guidance only. This page does not determine what is true about your company and does not create a security, compliance, testing, or certification claim.
What the customer is really asking
Understand the question before you answer it.
The customer wants to know whether your company has thought through operational disruption that could affect the service they depend on. Topics may include people, facilities, communications, third parties, technology, and recovery priorities.
How to answer accurately
Start with the version that matches reality.
If a current plan exists
Describe that a plan exists and its scope. Mention review or testing only if those activities have actually occurred.
If continuity is handled informally
Do not turn informal knowledge into a written-plan claim. You can explain that practices exist while the formal plan is still being documented.
If you only have disaster recovery
Answer the business-continuity question separately. Technical recovery is one part of resilience, not necessarily the whole business plan.
A useful answer structure
Status → scope → current practice → supporting information. Start with the direct answer, narrow it to what you can verify, explain how the practice works, and reference evidence only when that evidence actually exists.
Evidence that may help
These are examples, not requirements and not proof that your company has the practice. Use only evidence that really exists and is appropriate to share.
- Approved business continuity plan
- Plan review record
- Exercise or tabletop notes
- Contact and escalation procedures
What not to say
- That a backup plan is a complete business continuity plan.
- That the plan is tested if it has only been written or reviewed.
- That all business functions are covered unless the plan scope supports that.
How Oredra handles this
Answer it once. Keep the truth behind the answer.
Oredra can help create a written continuity plan from approved business practices while preserving the distinction between a document and a tested continuity capability.
Inside Oredra, a written policy, stated company practice, implemented control, available evidence, tested control, and independent certification remain distinct. Oredra uses approved information to draft future answers and flags questions that the approved profile cannot support.
Authoritative references
Oredra uses primary guidance where a technical or assurance concept benefits from verification. These references do not determine your company's answer.
Related questionnaire questions
Do you back up critical data?
First determine what your company considers critical data, where it is stored, and what recovery copies actually exist. High availability, file version history, replication, and backups can overlap, but they are not automatically the same thing.
Do you test backup restoration?
A successful backup job does not prove that data can be restored. Answer “yes” to restoration testing only when the company has actually performed a recovery or restore test and can describe what was tested.
Do you maintain a disaster recovery plan?
A disaster recovery plan focuses on restoring technology, systems, and data after a serious disruption. A written plan is not proof that recovery has been tested or that recovery objectives have been achieved.