The impact of successful security attacks on an organization can be significant. Loss of profits and customers are two possible outcomes that organisations never want to happen. A business continuity plan is a document that outlines the procedures to sustain business operations during and after a significant disruption. It is created alongside a disaster recovery plan to minimise the damage of a successful security attack. Here are four essential steps for business continuity plans: - *Conduct a business impact analysis*. The business impact analysis step focuses on the possible effects a disruption of business functions can have on an organization. - *Identify, document, and implement steps to recover critical business functions and processes*. This step helps the business continuity team create actionable steps toward responding to a security event. - *Organise a business continuity team*. This step brings various members of the organization together to help execute the business continuity plan, if it is needed. The members of this team are typically from the cybersecurity, IT, HR, communications, and operations departments. - *Conduct training for the business continuity team*. The team considers different risk scenarios and prepares for security threats during these training exercises.