{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"Business continuity and recovery plan - Plan de continuité et de reprise / Bedrijfscontinuïteits- en herstelplan (BE)","description":"A business continuity and recovery plan of an SME: critical services and systems, recovery objectives where the enterprise has them, backups, incident scenarios, recovery strategies, contacts, communication, tests, coordinator and approvals. No law makes this plan mandatory for an SME outside the NIS2 law; for a NIS2 entity continuity of operations is one of the minimum measures. The template states nothing about NIS2 compliance, sets no default objective, frequency or review period, and prints a visible blank for what is missing.","type":"object","additionalProperties":false,"required":["entity","plan","nis2","scope","objectives","strategies","contacts","coordinator","approvals"],"properties":{"entity":{"type":"object","additionalProperties":false,"required":["name"],"description":"The enterprise.","properties":{"name":{"type":"string","description":"Name of the enterprise the plan belongs to."},"enterprise_number":{"type":"string","description":"Belgian enterprise number (KBO/BCE), written 0123.456.789.","pattern":"^[01][0-9]{3}\\.[0-9]{3}\\.[0-9]{3}$"}}},"plan":{"type":"object","additionalProperties":false,"required":["version","effective_date"],"description":"The plan.","properties":{"version":{"type":"string","description":"Version of the plan, as the enterprise numbers it."},"effective_date":{"type":"string","format":"date","description":"Date from which this version applies."},"next_review":{"type":"string","format":"date","description":"Date of the next review of the plan, as the enterprise decides it."}}},"nis2":{"type":"object","additionalProperties":false,"required":["status"],"description":"NIS2 status.","properties":{"status":{"type":"string","enum":["not_in_scope","in_scope_important","in_scope_essential","unknown"],"description":"The user's answer on the NIS2 status of the enterprise: not_in_scope, in_scope_important, in_scope_essential or unknown. A statement of the user, never of the template."}}},"scope":{"type":"object","additionalProperties":false,"required":["services","systems"],"description":"What the plan covers.","properties":{"services":{"type":"array","description":"Critical services covered by the plan.","minItems":1,"items":{"type":"object","additionalProperties":false,"required":["name"],"properties":{"name":{"type":"string","description":"Name of the critical service."},"description":{"type":"string","description":"What the service is."}}}},"systems":{"type":"array","description":"Systems and applications covered by the plan.","minItems":1,"items":{"type":"string","description":"A system or application."}}}},"objectives":{"type":"array","description":"Recovery objectives per system, where the enterprise has them.","minItems":1,"items":{"type":"object","additionalProperties":false,"required":["system"],"properties":{"system":{"type":"string","description":"System the objectives are set for."},"rto_hours":{"type":"number","description":"Recovery time objective, in hours, as the enterprise sets it.","minimum":0},"rpo_hours":{"type":"number","description":"Recovery point objective, in hours, as the enterprise sets it.","minimum":0}}}},"backups":{"type":"object","additionalProperties":false,"description":"The backup regime.","properties":{"where":{"type":"string","description":"Where the backups are kept."},"frequency":{"type":"string","description":"How often backups are made, as the enterprise states it."},"last_restore_test_on":{"type":"string","format":"date","description":"Date of the last restore test."},"responsible":{"type":"string","description":"Who is responsible for the backups."}}},"incident_categories":{"type":"array","description":"Incident scenarios with likelihood and impact.","items":{"type":"object","additionalProperties":false,"required":["category","likelihood","impact"],"properties":{"category":{"type":"string","description":"Category of incident or disruption."},"likelihood":{"type":"string","enum":["low","medium","high"],"description":"Likelihood as the enterprise assesses it: low, medium or high."},"impact":{"type":"string","enum":["low","medium","high"],"description":"Impact as the enterprise assesses it: low, medium or high."},"scenarios":{"type":"array","description":"Scenarios of this category.","items":{"type":"string","description":"A scenario."}}}}},"strategies":{"type":"array","description":"Recovery strategies.","minItems":1,"items":{"type":"object","additionalProperties":false,"required":["system","primary_site","fallback","procedure_summary","responsible"],"properties":{"system":{"type":"string","description":"System the strategy is for."},"primary_site":{"type":"string","description":"Where the system normally runs."},"fallback":{"type":"string","description":"Where or how it runs when the primary site is not available."},"procedure_summary":{"type":"string","description":"Summary of the recovery procedure."},"responsible":{"type":"string","description":"Who is responsible for the recovery."}}}},"alternative_working":{"type":"string","description":"How the enterprise keeps working while systems are unavailable, in its own words."},"contacts":{"type":"object","additionalProperties":false,"required":["internal"],"description":"Contacts.","properties":{"internal":{"type":"array","description":"Internal contacts.","minItems":1,"items":{"type":"object","additionalProperties":false,"required":["name"],"properties":{"name":{"type":"string","description":"Name of the person or organisation."},"role":{"type":"string","description":"Function or kind of contact."},"how":{"type":"string","description":"How to reach them (a channel or an address, not a phone number in a sample)."}}}},"external":{"type":"array","description":"External contacts: suppliers, insurer, authorities.","items":{"type":"object","additionalProperties":false,"required":["name"],"properties":{"name":{"type":"string","description":"Name of the person or organisation."},"role":{"type":"string","description":"Function or kind of contact."},"how":{"type":"string","description":"How to reach them (a channel or an address, not a phone number in a sample)."}}}}}},"communication_plan":{"type":"object","additionalProperties":false,"description":"Communication plan.","properties":{"internal_stakeholders":{"type":"array","description":"Who is informed inside the enterprise.","items":{"type":"string","description":"An internal stakeholder."}},"external_stakeholders":{"type":"array","description":"Who is informed outside the enterprise.","items":{"type":"string","description":"An external stakeholder."}},"media_contact":{"type":"string","description":"Who speaks to the media or the public."}}},"testing":{"type":"array","description":"Exercises and tests.","items":{"type":"object","additionalProperties":false,"required":["kind","frequency","result"],"properties":{"kind":{"type":"string","enum":["tabletop","partial_failover","full_failover"],"description":"Kind of exercise: tabletop, partial_failover or full_failover."},"frequency":{"type":"string","description":"How often the exercise is held, as the enterprise states it."},"last_test_on":{"type":"string","format":"date","description":"Date of the last exercise."},"result":{"type":"string","description":"Result of the last exercise, in the enterprise's own words."}}}},"coordinator":{"type":"object","additionalProperties":false,"required":["name","role"],"description":"Coordinator.","properties":{"name":{"type":"string","description":"Name of the coordinator of the plan."},"role":{"type":"string","description":"Function of that person."},"contact":{"type":"string","description":"How to reach that person."}}},"approvals":{"type":"array","description":"Approvals of this version.","minItems":1,"items":{"type":"object","additionalProperties":false,"required":["name","title","date"],"properties":{"name":{"type":"string","description":"Name of the approver."},"title":{"type":"string","description":"Function of the approver."},"date":{"type":"string","format":"date","description":"Date of the approval."}}}}}}