Business Continuity Planning (BCP) in Indian Banking

A complete, exam-ready guide to BCP & Disaster Recovery for banks — key concepts (RTO, RPO, BIA), the BCP lifecycle, DR site types, testing methods, and the latest RBI framework (IT Governance Master Direction, 2023) — with tap-to-reveal MCQs.

JAIIB / CAIIB IIBF Risk Management RBI Grade B Bank Promotion IT & Cyber Security

What is BCP Key Terms BCP vs DR Objectives Lifecycle RTO vs RPO Threats DR Sites Testing RBI Guidelines Standards MCQs Revision

1 What is Business Continuity Planning?

Business Continuity Planning (BCP) is the process of creating a plan to ensure that a bank’s critical business functions continue during and after a disruption — such as a natural disaster, cyber-attack, power failure or pandemic — with minimum loss to customers and the bank.

For banks, BCP is part of operational risk management. Because banks handle payments, deposits and public money, even a few hours of downtime can damage customer trust and financial stability — so BCP is a regulatory requirement, not a choice.

One-line idea: BCP keeps the bank running during a crisis; Disaster Recovery (DR) focuses on restoring IT systems and data after the crisis.

2 Must-Know Terms

BCPBusiness Continuity Plan — keeps critical operations going during disruption.

BCMBusiness Continuity Management — the overall framework that includes BCP.

DR / DRPDisaster Recovery (Plan) — restoring IT systems, applications and data after a disaster.

BIABusiness Impact Analysis — identifies critical functions and the impact of their disruption.

RTORecovery Time Objective — how fast a system must be restored.

RPORecovery Point Objective — how much data loss (in time) is acceptable.

MTD / MTPDMaximum Tolerable Downtime — total time a function can stay down before serious harm.

WRTWork Recovery Time — time to verify systems and restore data after recovery.

DC & DR SiteDC = primary Data Centre; DR = alternate Disaster Recovery site.

3 BCP vs DR vs BIA

Basis	BCP	Disaster Recovery (DR)
Scope	Whole business (people, processes, systems)	Mainly IT systems, applications & data
Goal	Keep critical functions running	Restore IT after a disaster
Relationship	Broader plan	A subset of BCP
Focus	Continuity & resilience	Technical recovery

Where BIA fits: A Business Impact Analysis is done first — it lists critical functions and decides the RTO and RPO for each. BCP and DR plans are then built to meet those targets.

4 Objectives of BCP

Ensure continuity of critical banking services (payments, ATMs, core banking, internet/mobile banking).
Minimise financial loss and reputational damage.
Protect customer data and assets.
Enable quick recovery within agreed RTO/RPO targets.
Meet regulatory (RBI) and legal obligations.
Maintain public confidence in the banking system.

5 BCP Lifecycle (Phases)

Risk Assessment: identify threats (natural, technical, man-made) and vulnerabilities.
Business Impact Analysis (BIA): find critical functions, set RTO & RPO.
Strategy Development: decide recovery strategies (DR site, backups, alternate staff/locations).
Plan Development: document the BCP & DR plan, roles and escalation steps.
Testing & Drills: test the plan regularly to confirm it works.
Maintenance, Training & Review: update the plan and train staff (Board reviews at least yearly).

6 RTO vs RPO (Most Asked!)

Basis	RTO (Recovery Time Objective)	RPO (Recovery Point Objective)
Measures	Maximum acceptable downtime to restore a system	Maximum acceptable data loss (in time)
Question it answers	“How fast must we recover?”	“How much data can we afford to lose?”
Decides	Speed of recovery & DR-site type	Frequency of data backup/replication
Direction in time	Looks forward from the disaster	Looks backward to the last good backup

Example: If a system fails at 12:00 noon, an RTO of 2 hours means it must be back by 2:00 PM. An RPO of 1 hour means backups run hourly, so at most 1 hour of data is lost. RPO = 0 means zero data loss is tolerated (needs real-time replication).

7 Types of Threats / Disasters

Category	Examples
Natural	Floods, earthquakes, cyclones, pandemics (e.g. COVID-19)
Technical	Hardware/software failure, network outage, power failure, data-centre fire
Man-made / Cyber	Cyber-attacks, ransomware, fraud, terrorism, sabotage, human error

Real example: The COVID-19 pandemic was a major BCP trigger — banks activated continuity plans for remote working, split operations and digital channels, and RBI stressed strong BCP during the crisis.

8 Disaster Recovery (DR) Site Types

DR Site	Readiness	Recovery Time	Cost
Hot Site	Fully equipped, data replicated in real time	Very fast (lowest RTO)	Highest
Warm Site	Partly equipped; data needs restoring	Moderate	Medium
Cold Site	Only space, power, cooling; set up after disaster	Slow (highest RTO)	Lowest

Near DR vs Far DR

Near-site DR: located close to the Data Centre; uses synchronous replication for zero/near-zero data loss.
Far-site DR: located far away (different seismic/flood zone); uses asynchronous replication to survive regional disasters.
Many large banks maintain DC + DR, and often a third Near-line site for RPO = 0 (zero data loss).

9 BCP/DR Testing Methods

Testing is arranged from least disruptive to most realistic:

Test	What Happens
Checklist / Desk Check	Review the BCP documents for completeness.
Structured Walkthrough / Tabletop	Team discusses roles and steps in a meeting.
Simulation	A disaster scenario is simulated to test the response.
Parallel Test	Recovery systems run alongside live systems — no disruption to production.
Full Interruption Test	Live systems are actually shut down and switched to DR — most realistic, most risky.

10 RBI Guidelines on BCP (India)

Current framework — IT Governance Master Direction, 2023

Full name: RBI (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023.
Notified on 7 November 2023; effective from 1 April 2024.
Chapter V deals specifically with Business Continuity and Disaster Recovery Management.
Requires a Board-approved BCP & DR Policy, reviewed at least annually.
Mandates periodic DR drills, regular data backup, and checking the integrity of backup data.
BCP/DR is one of the five focus areas of IT governance (along with strategic alignment, risk, resource and performance management).
A Board-level IT Strategy Committee (ITSC) oversees IT governance and meets at least quarterly.
Applies to banks (excl. RRBs), Small Finance Banks, Payments Banks, large NBFCs, Credit Information Companies and AIFIs (EXIM, NABARD, NaBFID, NHB, SIDBI).

Background (still asked): Earlier BCP guidance came from the G. Gopalakrishna Working Group (2011) on Information Security, Electronic Banking, Technology Risk Management and Cyber Frauds. The 2023 Master Direction now consolidates and updates these older instructions.

11 Relevant International Standards

ISO 22301Standard for Business Continuity Management Systems (BCMS) — the global benchmark for BCP. (Successor to BS 25999.)

ISO 27001Standard for Information Security Management Systems (ISMS) — closely linked to DR and data protection.

BCMSThe management system an organisation uses to plan, run, test and improve business continuity.

12 Practice MCQs (Tap to Reveal Answers)

A mix of previously-asked and high-probability questions. Attempt first, then tap to check.

Q1In BCP, RTO stands for:

(a) Recovery Time Objective
(b) Real Time Operation
(c) Recovery Test Order
(d) Restart Time Option

Tap to reveal answer

Answer: (a) Recovery Time Objective. It is the maximum acceptable time to restore a system after disruption.

Q2RPO (Recovery Point Objective) measures the maximum acceptable:

(a) Downtime
(b) Data loss
(c) Recovery cost
(d) Staff strength

Tap to reveal answer

Answer: (b) Data loss (measured in time). It decides how frequently data must be backed up.

Q3A Business Impact Analysis (BIA) is mainly used to:

(a) Market new products
(b) Identify critical functions and set RTO/RPO
(c) Recruit staff
(d) Audit accounts

Tap to reveal answer

Answer: (b) Identify critical functions and set RTO/RPO. BIA is the foundation of the BCP and DR plans.

Q4Which DR site is fully equipped and can take over almost immediately?

(a) Cold site
(b) Warm site
(c) Hot site
(d) Mobile site

Tap to reveal answer

Answer: (c) Hot site. It has the lowest RTO but the highest cost. A cold site is cheapest but slowest.

Q5Disaster Recovery (DR) is best described as:

(a) Larger than BCP
(b) Unrelated to BCP
(c) A subset of BCP focused on IT recovery
(d) Same as marketing

Tap to reveal answer

Answer: (c) A subset of BCP focused on IT recovery. BCP covers the whole business; DR covers IT systems and data.

Q6The RBI (IT Governance, Risk, Controls and Assurance Practices) Directions, 2023 came into effect from:

(a) 1 April 2024
(b) 1 January 2023
(c) 7 November 2023
(d) 1 April 2023

Tap to reveal answer

Answer: (a) 1 April 2024. (It was notified on 7 November 2023.) Chapter V covers Business Continuity and Disaster Recovery.

Q7Who is responsible for approving a bank’s BCP/DR policy?

(a) Branch Manager
(b) Board of Directors
(c) Auditor
(d) RBI Governor

Tap to reveal answer

Answer: (b) Board of Directors. The Board approves and reviews the BCP/DR policy at least annually.

Q8The international standard for Business Continuity Management Systems is:

(a) ISO 9001
(b) ISO 22301
(c) ISO 14001
(d) ISO 27001

Tap to reveal answer

Answer: (b) ISO 22301. ISO 27001 is for information security; ISO 9001 is quality management.

Q9An RPO of zero means:

(a) No downtime allowed
(b) No data loss is tolerated
(c) No recovery needed
(d) No backups required

Tap to reveal answer

Answer: (b) No data loss is tolerated. It requires real-time (synchronous) data replication.

Q10Which BCP test is the most realistic but also the most disruptive?

(a) Checklist test
(b) Walkthrough
(c) Parallel test
(d) Full interruption test

Tap to reveal answer

Answer: (d) Full interruption test. Live systems are shut down and switched to DR. A parallel test runs DR alongside live systems without disruption.

Q11In banking IT, “DC” and “DR” stand for:

(a) Direct Credit / Direct Recovery
(b) Data Centre / Disaster Recovery
(c) Demand Cheque / Demand Recovery
(d) Digital Currency / Digital Recovery

Tap to reveal answer

Answer: (b) Data Centre / Disaster Recovery. DC is the primary site; DR is the alternate recovery site.

Q12BCP is primarily a part of which type of risk management in banks?

(a) Credit risk
(b) Market risk
(c) Operational risk
(d) Liquidity risk

Tap to reveal answer

Answer: (c) Operational risk. BCP addresses losses from disruption of people, processes and systems.

Q13Which committee oversees IT governance (including BCP/DR) under the RBI 2023 Direction?

(a) Audit Committee only
(b) IT Strategy Committee (ITSC)
(c) ALCO
(d) Nomination Committee

Tap to reveal answer

Answer: (b) IT Strategy Committee (ITSC). It is a Board-level committee that meets at least quarterly.

Q14The earlier (2011) RBI guidance on Information Security, Technology Risk and Cyber Frauds was given by which working group?

(a) Nachiket Mor Committee
(b) G. Gopalakrishna Working Group
(c) Tarapore Committee
(d) Damodaran Committee

Tap to reveal answer

Answer: (b) G. Gopalakrishna Working Group (2011). Its recommendations are now consolidated in the 2023 Master Direction.

Q15A test where recovery systems run alongside live production without disrupting it is called a:

(a) Parallel test
(b) Cold test
(c) Full interruption test
(d) Checklist test

Tap to reveal answer

Answer: (a) Parallel test. It checks the DR setup while the live system keeps running.

Q16The COVID-19 pandemic is an example of which category of BCP threat?

(a) Technical
(b) Cyber-attack
(c) Natural
(d) Financial fraud

Tap to reveal answer

Answer: (c) Natural. A pandemic is a natural disaster that triggered large-scale BCP activation across banks.

60-Second Quick Revision

BCP → keeps the bank running in a crisis.

DR → restores IT/data · a subset of BCP.

BIA → finds critical functions · sets RTO/RPO.

RTO → how fast to recover.

RPO → how much data loss allowed.

RPO = 0 → zero data loss (real-time replication).

Hot site → fastest, costliest · Cold → cheapest, slowest.

Full interruption → most realistic test.

Parallel test → DR runs without disruption.

RBI IT Master Direction 2023 → effective 1 Apr 2024.

BCP/DR policy → approved by Board · reviewed yearly.

ITSC → IT Strategy Committee · meets quarterly.

ISO 22301 → business continuity standard.

BCP → part of operational risk.