What must not stop
Essential activities, the customers or users concerned, contractual obligations, regulatory constraints and financial or reputational impacts.
Continuity module · BIA / BCP / DRP
Structure BIA, BCP and DRP around critical activities
The module identifies the activities to maintain, their dependencies, recovery times and acceptable data loss. The continuity and recovery plans are then attached to scenarios, owners, tests and update actions.
Understand the risk. Take back control. Stay the course.
Hosted in France by Scaleway · Mistral AI (EU) · to prepare for and document GDPR, NIS 2 and DORA.
01 · THE SUBJECT
BCP/DRP must answer concrete trade-offs
Cyber business continuity becomes useful when it links business impacts, technical dependencies, responsibilities and recovery conditions. The way in is the decision, not a list of tools.
What makes it possible to carry on
The applications, accounts, providers, flows, backups, emergency access, means of communication and human resources needed to keep a minimum running.
What must be decided
Recovery priorities, activation thresholds, crisis roles, acceptable lead times, degraded modes and the residual risks you choose to accept.
PRINCIPLE
The real plan
is the one that works.
The real business continuity plan is not the one that is written down: it is the one that holds when the usual procedures stop working. A document that has never been tested gives an illusion of control. Galyct Pro equips continuity so that it stays ready to activate, realistic and up to date, not decorative.
02 · BIA · BCP · DRP
Three plans, three functions: stop confusing them
Business continuity, recovery, impact analysis: these terms are often used interchangeably. Clarifying them already tells you where to start: always with the BIA.
BIA, business impact analysis
Identifies critical activities, the impacts of an interruption, dependencies and tolerances. It is the foundation: without a BIA, a continuity plan is built blind. It produces two key benchmarks, the RTO and the RPO.
BCP, business continuity plan
Organises how essential functions are maintained during the crisis: degraded modes, alternative procedures, roles, resources. It goes beyond IT and concerns the whole organisation.
DRP, disaster recovery plan
The technical side: restoring systems and data after a disaster (backups, failover, restart priorities) while meeting the RTO/RPO defined in the BIA.
THE MEASURABLE OBJECTIVES
RTO and RPO: the two limits that management sets
Two benchmarks that come from the BIA and turn a business requirement into a verifiable recovery objective.
RTO, recovery time
The maximum acceptable time to restore a service after an interruption. It determines the investment in redundancy, failover and support.
RPO, data loss
The amount of data the organisation can reasonably lose, expressed in time. It determines how often backups are made and the restoration strategy.
03 · THE TIMELINE
From interruption to continuity, then to recovery
A single timeline links the five concepts. The RPO sets the recovery point in the past, the BCP keeps the essentials running during the crisis, the DRP restores the system, and the RTO sets the limit for the return to normal service.
RPOLast clean backupThe recovery point: up to it, data can be recovered. It sets the limit of acceptable loss.
T0InterruptionThe incident occurs: outage, compromise, disaster. Normal service stops.
BCPContinuityThe essentials are kept running in degraded mode: alternative procedures, roles, backup resources.
→DecisionTrade-offs: what to cut off, what to keep running, what to restore first, what to communicate.
DRPRecoveryTechnical restoration of systems and data: backups, failover, restart priorities.
RTOService restoredThe maximum recovery time is met: return to normal operation, deviations recorded.
04 · TRIGGERS
When should you structure or review your continuity?
A BCP/DRP must be ready to activate before the crisis, but also remain realistic after an audit, an IT transformation, a customer requirement, pressure from insurers or an incident.
Business dependent on digital systems
Email, ERP, invoicing, production, telephony, cloud access or business tools have become bottlenecks.
Audit or risk analysis
Critical dependencies, fragile backups, uncontrolled access or key providers must be translated into a continuity trajectory.
Customer, insurance or market requirement
A third party asks for evidence of resilience, testing, governance, recovery or control of cyber incidents.
Incident or near miss
An outage, a compromised account, a fraud, a leak or a narrowly avoided ransomware attack reveals a need for scoping and procedures.
IT transformation or outsourcing
Cloud migration, a new provider, M365, ERP, an acquisition or a change of managed service provider alters recovery dependencies.
Committee or cyber budget
Management must decide on investment in backup, monitoring, hardening, redundancy, documentation and testing.
05 · THE DELIVERABLES
Material that management, IT and the business units can use
The documentation must be clear enough to decide, precise enough to act and short enough to actually be consulted during an incident.
Executive summary
Management view: critical activities, major risks, trade-offs, priority actions and indicative budget.
BIA map
Activities, impacts, tolerable interruption times, dependencies, minimum resources and recovery requirements.
RTO / RPO matrix
Recovery objectives per activity or application, validation conditions and points of fragility.
Continuity scenarios
Loss of email, ransomware, ERP outage, data leak, critical provider, site inaccessible.
Quick-reference sheets
Crisis cell, communication, backups, restoration, emergency accounts, critical contacts, preservation of evidence.
Test plan & lessons learned
Exercise schedule, success criteria, deviations observed, corrective actions and keeping the plan operational.
06 · WHAT WE DO NOT PROMISE
Continuity is prepared, not guaranteed
Cyber resilience requires method, but also regular testing, clear responsibilities and deliberate choices. An untested document gives an illusion of control.
No guaranteed availability
The arrangements reduce improvisation, but they do not remove incidents, external dependencies or difficult trade-offs. No result is guaranteed: a BCP/DRP does not ensure that there will be no interruption.
No purely technical DRP
Restoring a server is not enough if access, data, approvals, business units or providers are not aligned.
No continuity without maintenance
Contacts, procedures, emergency accounts, backups, permissions and scenarios must be kept up to date. A plan that has never been tested is a hypothesis, not a guarantee.
A plan that has never been tested is a hypothesis, not a guarantee
The value of a continuity arrangement depends on testing, governance, backups, emergency access and keeping it operational. Galyct Pro links the BIA, the RTO/RPO objectives and the scenarios so that continuity stays ready to activate, in the same place as risk and incident management.
A cyber crisis in progress?
Suspected intrusion, ransomware, compromised critical account, data leak: stabilise without destroying the evidence, and get support. We open a crisis cell and keep the thread of decisions.
See the Continuity module in your context.
A 30-minute live demo, or start on your own with the free executive diagnosis. No commitment, your data processed in the European Union.