Business continuity plans

Detects business continuity plans and business impact analyses with populated recovery objectives (RTO/RPO/MTPD values), crisis contacts and alternate sites. Topic wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a populated recovery objective (RTO/RPO/MTPD/MAO with a duration) or a populated continuity contact or site field (crisis lead, incident controller, alternate/recovery site, after-hours contact)), and 85 needs two distinct structures plus independent continuity-operations (critical functions, workarounds, activation, call tree) evidence, so policies, blank forms and training text stay below 75.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Security of Critical Infrastructure Act 2018 (Cth)
Frameworks: ISO 27001, NIST CSF
Data categories: security
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:business\s+continuity\s+(?:plans?|management\s+plan|arrangements)|continuity\s+of\s+operations\s+plan|crisis\s+management\s+plan|business\s+impact\s+analysis)\b

Corroborative evidence keywords

critical business function, manual workaround, workaround, activation, invocation, escalation, minimum staffing, supplier dependency, call tree, dependencies, student, transcript, grade, [object Object], enrollment, FERPA, FAFSA, financial aid, tuition, degree (+24 more)

Proximity: 300 characters

Should match

The business continuity plan is due for its annual review in March. — Discovery probe (65)
Business impact analysis - Payroll RTO: 24 hours RPO: 4 hours — Medium-tier probe (75) - populated recovery objectives
Business continuity plan - Payroll Services RTO: 24 hours; RPO: 4 hours; MTPD: 3 days Crisis lead: Jordan Staffson (0412 555 019) Alternate site: Level 3, 88 Wharf Street Critical business function: fortnightly pay run - manual workaround via bank file upload; activation by the incident controller. — High-tier probe (85) - several objectives, contacts/site and continuity context

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match
Policy statement: every business unit maintains a business continuity plan and tests it annually. — Policy text
Business continuity plan template RTO: ____ hours Crisis lead: [insert] — Blank template
Course module 1: a business impact analysis sets targets such as an RTO of 4 hours. — Training framing

Known false positives

Continuity standards and consulting material quote RTO/RPO definitions. Mitigation: Objectives must carry durations; guidance/training framing is excluded and 85 needs contacts or sites.