--- title: "Does the Applicant have a written Business Continuity Plan / Disaster Recovery Plan, tested annually?" url: https://insuranceposture.com/questions/incident-response/applicant-written-business-continuity-plan-disaster-recovery-plan-tested category: "Incident response and claims history" canonical_key: q_ir_003 evidence_state: attested updated: 2026-08-24 --- # Does the Applicant have a written Business Continuity Plan / Disaster Recovery Plan, tested annually? URL: https://insuranceposture.com/questions/incident-response/applicant-written-business-continuity-plan-disaster-recovery-plan-tested Section: Incident response and claims history Evidence state: Attested, not tenant-verifiable Incident response handles the attack. Continuity handles the business while the attack is being handled, and carriers ask about both because they fund both. ## What the carrier is actually asking The carrier is asking whether written continuity and recovery plans exist and are tested annually. Continuity covers how the business keeps operating without its systems; disaster recovery covers how the systems come back. They are related and separate, and organisations frequently have one. ## Why it is underwritten Business interruption cover pays for the period when operations are degraded. How long that lasts, and how much can continue manually, is determined by continuity planning. An insured that can process orders on paper for three days has a materially smaller claim than one that stops entirely. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Plans and test records are attested. The recovery objectives they state should be grounded in measurements from restore testing. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Plan documents | Business impact analysis identifying critical processes and their tolerance | Processes ranked by impact over time, which is what makes recovery order defensible | | Plan documents | Recovery time and recovery point objectives per system | Objectives grounded in measured restore times rather than aspirations | | Plan documents | Manual workarounds for critical processes | Documented alternatives for operating without systems, which is the continuity half | | Test records | Annual test, its scope, and findings | A dated test that exercised something meaningful. Attested | | Dependencies | Third-party and supply chain dependencies in the plan | Vendor outages included, since a critical provider failing is as disruptive as your own systems failing | **Objectives without measurements are wishes** A stated four-hour recovery time objective is a target. The restore test tells you the actual figure. When the two differ by a factor of five, the plan is describing an outcome the infrastructure cannot deliver, and the gap surfaces during the event rather than before it. ## What a defensible yes requires - Both continuity and recovery are addressed, not one standing for both. - A business impact analysis identifies critical processes and their tolerance for downtime. - Objectives are grounded in measured recovery times. - Manual workarounds exist for the processes that cannot stop. - An annual test has taken place with a record and findings. ## How this answer goes wrong The disaster recovery plan is detailed and the continuity plan does not exist, so there is no answer to how the business operates during the outage. Or the plans assume a data centre failure while the realistic scenario is encryption across the estate, where the recovery site is encrypted too because it replicated faithfully. ## If this answer turns out to be wrong The claims and circumstances questions connect directly to the notice conditions in the policy, which have to be satisfied before the insurer owes anything at all. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [what a condition precedent has to satisfy first](https://insuranceposture.com/glossary/condition-precedent). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Is one combined document acceptable? Yes, provided both dimensions are covered. Carriers care about the content rather than the document count. ### How does ransomware change the plan? Substantially. Traditional disaster recovery assumes the primary site failed and the replica is good. Ransomware compromises both, which is why recovery from immutable backup, not failover, is the relevant path. ### What counts as a test? Anything that exercises the plan against a scenario with the people involved. A full failover is ideal and a tabletop with a documented outcome is acceptable. ### Should suppliers be included? Yes. A critical vendor outage is a continuity event you do not control, and it is increasingly the scenario that materialises. ## Related questions - [Estimated time to restore essential functions in widespread ransomware attack?](https://insuranceposture.com/questions/backup-and-recovery/estimated-time-restore-essential-functions-widespread-ransomware-attack) - [How frequently is the IR plan tested (quarterly/semi-annually/annually)?](https://insuranceposture.com/questions/incident-response/frequently-ir-plan-tested) - [Are copies of BCP/DR/IR plans stored so accessible if the Applicant's network is unavailable?](https://insuranceposture.com/questions/incident-response/copies-bcp-dr-ir-plans-stored-accessible-applicant-s) - [Has any service provider with access to Applicant's network sustained outage longer than 4 hours?](https://insuranceposture.com/questions/third-parties/service-provider-access-applicant-s-network-sustained-outage-longer) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.