BCP (Business Continuity Plan) Explained | Key Points for the IT Passport Exam

What is BCP? (In a Nutshell)

BCP (Business Continuity Plan) is a plan for continuing business operations and achieving early recovery when a crisis such as a disaster, cyberattack, or pandemic occurs. It is built through a process of "identifying core business → setting recovery targets → preparing alternative measures." BCM (Business Continuity Management) is a broader concept that includes not only the creation of a BCP but also the entire cycle of its operation, review, and improvement. The difference between BCP and BCM is a frequently tested point on the exam.

RTO and RPO ── Two Metrics You Must Master

RTO (Recovery Time Objective) is a metric indicating "how quickly a system must be restored," for example, set as "restart within 4 hours." RPO (Recovery Point Objective) is a metric indicating "to what point in time data must be recovered," defined as "no data loss within the last 1 hour." On the exam, confusing choices that swap RTO and RPO are common, so memorizing the contrast as "length of time = RTO, freshness of data = RPO" will help you answer correctly.

Key Points for the IT Passport Exam

One or two questions appear each time in the Risk Management area of the Strategy domain. The focus is on identifying the terms BCP, BCM, RTO, RPO, and Contingency Plan (emergency response plan), testing your ability to accurately distinguish which concept each refers to. Decision-making flows during a disaster (continuous improvement through the PDCA cycle) may also appear.

Typical Past Exam Question Patterns

• "Which of the following is the most appropriate description of BCP?"
• "What is the correct combination of meanings for RTO of 4 hours and RPO of 1 hour?"
• Questions asking about the difference between BCP and Disaster Recovery (DR)

Understanding with Real-World Examples

Since the Great East Japan Earthquake (2011), most listed companies have established BCPs, making it a mandatory requirement for management. During COVID-19, the shift to telework effectively became a "de facto BCP activation," reaffirming the importance of BCP across industries. In cases of recovery from ransomware attacks, the precision of RTO and RPO design directly impacts recovery costs and time.

Related Terms

Risk assessment is the process of identifying risks before creating a BCP; studying them together deepens your understanding. Internal controls and J-SOX are closely related to BCP (you can practice related problems in the Strategy Overview), and in relation to information security policies, knowledge of encryption and backup technologies is also tested (detailed in Encryption Basics).

Study Tips

Memorize RTO and RPO along with the principle that "shorter values mean higher costs" to make it easier to deduce the correct answer from the question's assumptions. Visualizing the hierarchical relationship BCM ⊃ BCP ⊃ DR as a diagram will help prevent confusion between similar terms. Reading the BCP guidelines from the Ministry of Economy, Trade and Industry (METI) or the Small and Medium Enterprise Agency once will help you grasp the thinking behind the questions.

Summary

If you understand the contrast that "BCP is a plan for business continuity, and BCM is its operation and improvement," you can reliably answer terminology questions. As long as you avoid confusing RTO and RPO, you can confidently score points on this frequently asked Strategy question. For comprehensive practice on the Strategy domain, use the Strategy Overview, and to test yourself in an exam-like format, use the Practice Exam.