$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill business-continuityDevelop business continuity plans and impact analysis. Implement BCP testing and communication procedures. Use when building organizational resilience.
| 1 | # Business Continuity Planning |
| 2 | |
| 3 | Develop and maintain business continuity capabilities including Business Impact Analysis, communication plans, recovery procedures, and testing schedules for organizational resilience. |
| 4 | |
| 5 | ## When to Use |
| 6 | |
| 7 | - Developing a formal Business Continuity Plan (BCP) for the organization |
| 8 | - Conducting a Business Impact Analysis (BIA) to prioritize recovery efforts |
| 9 | - Establishing communication plans for crisis scenarios |
| 10 | - Defining recovery procedures for critical business processes |
| 11 | - Scheduling and conducting BCP exercises and tests |
| 12 | - Meeting compliance requirements for continuity planning (SOC 2, ISO 27001, HIPAA, FedRAMP) |
| 13 | |
| 14 | ## BCP Framework |
| 15 | |
| 16 | ```yaml |
| 17 | bcp_phases: |
| 18 | 1_governance: |
| 19 | actions: |
| 20 | - Obtain executive sponsorship and funding |
| 21 | - Assign BCP coordinator and team |
| 22 | - Define BCP scope and policy |
| 23 | - Establish BCP committee with cross-functional representation |
| 24 | deliverables: |
| 25 | - BCP policy statement |
| 26 | - BCP team charter and roster |
| 27 | - Scope document |
| 28 | |
| 29 | 2_analysis: |
| 30 | actions: |
| 31 | - Conduct Business Impact Analysis (BIA) |
| 32 | - Perform risk assessment for continuity threats |
| 33 | - Identify critical business processes and dependencies |
| 34 | - Determine recovery priorities and resource requirements |
| 35 | deliverables: |
| 36 | - BIA report |
| 37 | - Risk assessment report |
| 38 | - Critical process inventory |
| 39 | |
| 40 | 3_strategy: |
| 41 | actions: |
| 42 | - Select recovery strategies for each critical process |
| 43 | - Identify alternate work arrangements (remote, alternate site) |
| 44 | - Define technology recovery strategies (DR plan) |
| 45 | - Establish vendor and supply chain contingencies |
| 46 | deliverables: |
| 47 | - Recovery strategy document |
| 48 | - Technology recovery plan |
| 49 | - Alternate site arrangements |
| 50 | |
| 51 | 4_plan_development: |
| 52 | actions: |
| 53 | - Write detailed recovery procedures |
| 54 | - Develop communication plans (internal and external) |
| 55 | - Create emergency response procedures |
| 56 | - Document roles, responsibilities, and contact information |
| 57 | deliverables: |
| 58 | - Business Continuity Plan document |
| 59 | - Communication plan |
| 60 | - Emergency response procedures |
| 61 | - Contact lists and call trees |
| 62 | |
| 63 | 5_testing: |
| 64 | actions: |
| 65 | - Develop test plan and schedule |
| 66 | - Conduct exercises (tabletop, functional, full-scale) |
| 67 | - Evaluate results and identify gaps |
| 68 | - Update plans based on lessons learned |
| 69 | deliverables: |
| 70 | - Test plan |
| 71 | - Exercise reports |
| 72 | - Updated BCP based on findings |
| 73 | |
| 74 | 6_maintenance: |
| 75 | actions: |
| 76 | - Review and update BCP annually (minimum) |
| 77 | - Update after significant organizational changes |
| 78 | - Refresh BIA when business processes change |
| 79 | - Maintain training and awareness program |
| 80 | deliverables: |
| 81 | - Annual BCP review record |
| 82 | - Updated BIA (if changes occurred) |
| 83 | - Training completion records |
| 84 | ``` |
| 85 | |
| 86 | ## Business Impact Analysis Template |
| 87 | |
| 88 | ```yaml |
| 89 | bia_template: |
| 90 | process_assessment: |
| 91 | process_name: "" |
| 92 | process_owner: "" |
| 93 | department: "" |
| 94 | description: "" |
| 95 | |
| 96 | criticality_classification: |
| 97 | mission_critical: |
| 98 | max_tolerable_downtime: "0-4 hours" |
| 99 | description: "Failure causes immediate, severe impact to customers or revenue" |
| 100 | examples: |
| 101 | - Payment processing |
| 102 | - Authentication and authorization |
| 103 | - Core API serving customer requests |
| 104 | - Order fulfillment |
| 105 | |
| 106 | essential: |
| 107 | max_tolerable_downtime: "4-24 hours" |
| 108 | description: "Failure causes significant degradation but not complete loss" |
| 109 | examples: |
| 110 | - Customer support systems |
| 111 | - Reporting and dashboards |
| 112 | - Email and notifications |
| 113 | - Billing and invoicing |
| 114 | |
| 115 | important: |
| 116 | max_tolerable_downtime: "1-3 days" |
| 117 | description: "Failure causes inconvenience and workarounds are available" |
| 118 | examples: |
| 119 | - Internal collaboration tools |
| 120 | - Analytics and BI platforms |
| 121 | - HR self-service systems |
| 122 | - Knowledge base |
| 123 | |
| 124 | non_essential: |
| 125 | max_tolerable_downtime: "3-7 days" |
| 126 | description: "Failure has minimal operational impact" |
| 127 | examples: |
| 128 | - Development and test environments |
| 129 | - Training platforms |
| 130 | - Archive systems |
| 131 | |
| 132 | impact_categories: |
| 133 | financial: |
| 134 | revenue_loss_per_hour: "" |
| 135 | penalty_or_fine_risk: "" |
| 136 | recovery_cost_estimate: "" |
| 137 | |
| 138 | operational: |
| 139 | affected_employees: "" |
| 140 | affected_customers: "" |
| 141 | workaround_available: "yes/no" |
| 142 | workaround_description: "" |
| 143 | |
| 144 | reputational: |
| 145 | customer_visibility: "high/medium/low" |
| 146 | media_attention_risk: "high/medium/low" |
| 147 | regulatory_reporting_required: "yes/no" |
| 148 | |
| 149 | legal_regulator |