Integrating cybersecurity into business continuity planning starts with one shift: a cyber event is a whole-business crisis, not an IT incident.
Most business continuity plans still treat a cyberattack as a technology scenario owned by the security team. When it hits, the CEO calls the CIO, and the CIO goes to work on the servers. But the CIO has authority over maybe 10% of the problem. The rest is customers, regulators, legal exposure, employees, operations, and reputation. Waiting while IT works on the servers is how a bad week becomes a bad quarter.
This guide covers where cyber events break business continuity plans, the decisions you need to make before the incident, how to build ransomware recovery into your plans, and how to test all of it.
Where Cybersecurity and Business Continuity Intersect
Think of the technical response as the sun. Around it orbit regulators, legal and compliance, litigation, reputation, customers, employees, physical security, insider risk, operations, and business continuity. Security teams are focused, rightly, on the attacker. That focus is exactly why they miss the broader impact.
When a CEO faces ransomware, the questions are not about blocking the attacker. They are:
- How do I get our systems back up and running?
- How do I protect the data?
- How do I deal with the reputational, regulatory, and legal side of this crisis?
Only the first question belongs mostly to IT. Business continuity planning has to answer the other two, and the first one too: what the business does while the systems are down.
| Old View | New View |
| A cyberattack is an IT incident | A cyberattack is a whole-business crisis |
| The security team owns the response | Security owns the technical response; executives own the crisis |
| Backups mean we can recover | Tested restores, in the right order and time, mean we can recover |
| Decide what to do when it happens | Decide who decides before it happens |
| Report patch rates and firewall data to the board | Report recovery time, revenue exposure, and time to decision |
The Gap Between Business Continuity and IT Disaster Recovery
The most dangerous gap in most programs sits between what the business expects and what IT can actually recover.
One client needed several critical systems back within 24 hours. The IT disaster recovery plans for those systems were built to recover in seven days. Nobody had compared the two numbers. A ransomware attack would have found that gap for them.
Cyber events widen the gap in three ways:
- Recovery takes longer than the plan assumes. Restoring one database is a few hours. Restoring an environment after ransomware is days or weeks of round-the-clock work, and you have to confirm the restore point is clean first.
- Your own tools may be part of the incident. Most crisis teams coordinate on Teams or Zoom and have never practiced losing that platform. In one ransomware exercise, three senior leaders opened a simulated malicious attachment, and the chat the team was using to coordinate was declared compromised. You could see the room deflate.
- Recovery may not be the problem at all. Extortion without encryption, where attackers steal data and threaten to publish it, makes your backups irrelevant. The first hour is a disclosure decision, not a restore.
Close the gap by having your business impact analysis (BIA) drive IT disaster recovery. Map each critical process to the applications, data, and vendors it depends on, then compare the recovery time the business needs with the recovery time IT can prove. The gap section of our Ultimate Guide to IT Disaster Recovery has three questions that tell you whether you have this problem.
Plan for Consequences, Not Attack Types
You don’t need a separate business continuity plan for ransomware, phishing, malware, and insider threats. You need plans for what those attacks do to the business. In our work, disruption comes down to four consequences: loss of technology, loss of a critical third party, loss of workforce, and loss of workplace. Cyber events usually hit the first two, and long ones hit the third.
- Loss of technology. What manual workarounds keep each critical process running, and for how long can you sustain them? A workaround that lasts four hours does not cover a two-week recovery.
- Loss of a critical third party. Your vendor’s cyberattack is your business continuity event. The February 2024 ransomware attack on Change Healthcare disrupted claims processing, pharmacy transactions, and provider payments across the US for weeks, according to the American Hospital Association. Tier vendors by disruption impact, not by spend, and know your alternatives.
- Loss of workforce. Recovery is a marathon. Your best people can’t work 20-hour days for two weeks. Plan shifts, relief, and backups for key roles before you need them.
Decide Before the Incident
The decisions that hurt organizations in a cyber event are rarely technical. They are the decisions nobody was authorized to make. Define these decision rights before the incident and write them down:
- Taking systems offline. Who can disconnect a production system or the network to stop the spread? Push that authority as far down the organization as you can tolerate.
- Activating business continuity. Who decides to move critical processes to manual workarounds, and on what trigger? Escalate on suspicion, not confirmation. You will usually learn about a breach after the data is gone.
- Legal lead and privilege. Will in-house or outside counsel lead? Privilege starts in the first minutes, not the first day.
- A ransom decision framework. Who decides, with what input, and what legal exposure applies. Work this out with counsel and your insurer in advance.
- Regulators and law enforcement. Who notifies whom, and when. A public company has four business days after it determines an incident is material to file a Form 8-K under the SEC’s 2023 cybersecurity disclosure rule, and many industries carry their own clocks.
- The press and your largest customers. Who speaks, who approves, and who calls your biggest customers before they read about it.
Then connect the cyber incident response plan to your crisis management and business continuity plans. The incident response plan handles detection, containment, eradication, and recovery. It needs clear escalation points into the crisis team, which manages everything else, and the crisis team needs a clear line into business continuity activation. The cyber crises section of our Ultimate Guide to Crisis Management covers how the two plans fit together.
Build Ransomware Recovery into the Plan
Backups give you something to recover from. They don’t tell you what to recover first, or whether you can recover in time.
Organizations with backups still end up paying. The restore takes longer than anyone tested. The decryption keys sit on the encrypted network. The backups themselves are corrupted. In one case, attackers social-engineered an organization’s offsite backup provider into ending service and deleting the backups. With nothing to restore, the organization paid more than $2 million.
A baseline your plan should assume:
- Onsite and offsite backups, rotated, with at least three generations
- At least one copy offline and immutable
- Multi-factor authentication at your offsite backup provider
- Restores tested for duration, not just success
- A recovery sequence your executives have agreed to: which services come back first, and in what order
Your ransomware recovery plan should make those choices in advance. Your Ransomware Recovery Plan Is a Backup Plan. Here Is What It Is Missing walks through the five decisions it has to make.
Prevention Still Matters, but It Isn’t Continuity
Access controls, multi-factor authentication, encryption, patching, endpoint security, and employee awareness training all reduce the odds of a successful attack. Keep investing in them. But prevention commitments leave out the response. Nobody signed them on behalf of your crisis team.
The NIST Cybersecurity Framework reflects this. CSF 2.0, released in February 2024, added a Govern function to Identify, Protect, Detect, Respond, and Recover. Two of those six are about what happens after the attack, and Govern is about who decides. That is where cybersecurity and business continuity planning meet.
Test It Without Letting IT Save the Day
Most cyber tabletop exercises end when the technical team restores the systems. That’s the wrong ending. Design an exercise where IT can’t save the day:
- A cloud provider is down for 8 to 24 hours.
- Ransomware recovery takes five days, not five hours.
- Your crisis communications platform is itself compromised.
- A critical vendor drops off the map with its own cyberattack.
Put the business continuity plan owners, legal, communications, and your executives in the room with security and IT. Watch for the decisions nobody owns. Then run an After-Action Report (AAR) and treat its findings as a work plan with owners and dates.
Review the pieces at least once a year, and after any major change: the incident response plan, business continuity plans, IT disaster recovery plans, and the crisis management plan. Cloud migrations, new vendors, and AI tools all change your exposure. I talked through why the next technology failure is a boardroom problem on Managing Uncertainty, Episode 327: The IT Problem Myth.
Where to Start in the Next 90 Days
- Compare the numbers. For your top ten critical processes, put the recovery time the business needs next to the recovery time IT has proven. Take the gaps to your steering committee.
- Write the decision rights. One page covering who takes systems offline, who activates business continuity, who leads legally, who decides on ransom, and who notifies regulators, customers, and the press. Get your executives to sign it.
- Run one tabletop that doesn’t let IT save the day, with business leaders in the room, and fix what it finds.
Your security team will fight the attacker. Your business continuity plan decides whether the business is still standing when they win.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity.
- Test it where IT can’t save the day. Exercise in a Day® builds and runs a custom cyber tabletop in one day, with your business leaders at the table.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your cyber readiness with us.
