A business continuity plan (BCP) sets out how you keep critical processes running, or get them back quickly, when something goes badly wrong. In the Netherlands it is now part of the legal duty of care under the national NIS2 law.
Whether a plan helps on the day comes down to two questions. Who decided what counts as critical, and has anyone ever rehearsed it?
What a business continuity plan covers
A BCP covers the whole operation, with IT as one part of it. It identifies the processes that matter most, how long each can be down, what keeps them going and who calls the shots during a disruption. Disaster recovery sits inside it as the technical piece: restoring systems and data.
The international standard for a business continuity management system is ISO 22301. The current edition dates from 2019, picked up a climate-related amendment in 2024, and ISO has flagged it for revision. Certification is optional, but the structure of the standard makes a sensible scaffold for your own plan.
Do NIS2 and DORA require a business continuity plan?
The Netherlands transposed NIS2 through the Cyberbeveiligingswet (Cbw, the Dutch Cybersecurity Act), in force since 15 August 2026. Organisations in scope must take appropriate and proportionate measures to manage risks to their network and information systems. The board approves those measures and oversees how they are carried out.
The Dutch National Cyber Security Centre (NCSC) lists ten measures in its duty-of-care fact sheet, and number three reads simply: draw up a business continuity plan. The reasoning is blunt. For most businesses a prolonged outage of core processes is unacceptable, and a BCP keeps you standing through events such as a power failure or a cyber incident.
Financial entities face firmer wording. DORA requires the management body to approve, oversee and periodically review the ICT business continuity policy (Article 5). In a supervisory update on ICT risk management, the Dutch markets regulator AFM summarises what the technical standards add: a response and recovery plan with clear activation criteria, testing built on realistic disruption scenarios that takes in third-party services where possible, and findings and shortcomings reported back to the management body.
How to write a business continuity plan in six steps
1. Agree ownership and scope
Start with the board. Under the Cbw it signs off the measures, so it should know which processes the plan covers and which it leaves out. Name a single owner for the whole thing, often a business continuity manager or the CISO, and give every critical process an owner from the business side.
2. Run a business impact analysis
The business impact analysis (BIA) does the heavy lifting. For each process you work out what an outage costs, how many hours pass before it really hurts and how much data you can afford to lose. Those answers become a recovery time objective (RTO, the longest acceptable time to restore) and a recovery point objective (RPO, the most data you can lose).
My advice is to let the business set those numbers rather than IT. Ask IT what is achievable and you get an RTO shaped by today's infrastructure, when what you need to know is what the organisation requires. The gap between the two is exactly what a BIA should expose.
3. Map dependencies and scenarios
For each critical process, write down the systems, people, sites and suppliers it relies on. Then work through a handful of scenarios that fit your organisation: ransomware that reaches the backups, a cloud provider down for a day, a power cut at head office. The last two show how much you lean on parties outside your own walls, which is why supply chain security also features in the Dutch duty of care.
4. Choose continuity and recovery measures
Only now do solutions come in. Typical ones are backups kept apart from production and restored in tests, a fallback site or second cloud region, manual workarounds for processes that must survive a few days without systems, and contractual commitments from critical suppliers about their own recovery. Record which RTO and RPO each measure is meant to meet.
5. Set up crisis management and communications
The middle of a major outage is a poor moment to work out who decides. Settle who sits on the crisis team, who activates the plan, how people reach each other when email and Teams are down, and who speaks to customers, staff, the press and the regulator. Tie this to your incident response process, since recovery and investigation run side by side after a cyber attack. For the forensic side, see incident response retainer vs interim DFIR specialist.
6. Test, rehearse and keep it current
You only find out whether a plan works by rehearsing it. Begin with a tabletop exercise for the crisis team, move on to restoring a critical system from backup, and build towards an exercise that brings in a supplier. Log what failed and who will fix it.
The NCSC treats checking whether your measures actually work as a duty-of-care measure in its own right, and under DORA the findings go back to the management body. Revisit the plan at every major change as well, such as a new supplier or a migration.
The people you need
A first plan or a major overhaul usually calls for three roles.
- Business continuity manager. Runs the programme, facilitates the BIA, writes the plan and organises the exercises. ISO 22301 experience helps even when certification is not the goal.
- Disaster recovery specialist. Turns RTO and RPO into technology: backup architecture, failover and restore testing.
- IT risk manager. Links the plan to the risk assessment and fits it into the three lines of defence model, which matters a great deal in financial services. See IT risk management for more on the role.
Interim makes sense when a deadline is looming: an audit, a regulator asking questions, or an incident that showed the old plan did not hold up. An interim BCM specialist lays the foundations and hands over to a permanent owner. Plan that handover from the first week. A BCP needs looking after for years, and that suits a permanent hire who knows the organisation.
Need help with your BCP?
Through MVPeople freelance and interim we supply BCM managers and disaster recovery specialists, and MVPermanent recruits the permanent owner. The business continuity specialist hiring page shows the profiles we place. If the BCP is part of a wider NIS2 programme, read demonstrating NIS2 compliance too.
Want to talk the scope or profile through first? Call or email me.
