The continuity plan contains the disaster recovery plan

The correct answer: C. The disaster recovery plan

✅ Why this answer

A relationship of containment: the business continuity plan (BCP) is the comprehensive umbrella (keeping business functions going in a crisis), and the disaster recovery plan (DRP) is its technical arm contained within it (restoring systems and data), with the downtime plan alongside them as the field arm at the point of care.

❌ Why the other options are wrong

• The release management plan (A) and the configuration management plan (B): day-to-day operations processes (from the ITIL family) that manage routine change, not a crisis.
• The marketing communications plan (D): unrelated to continuity.

💡 Key concept

The full pyramid: risk management is the wider frame that feeds all the plans. The business continuity plan (BCP) is the umbrella. Under it are the disaster recovery plan (DRP), the technical arm, and the downtime plan, the field arm at the point of care. Risk management is not a part inside the continuity plan; it is the source the plan grows from.

In the exam: “the technical component inside the BCP” means the DRP. The release management and configuration management plans are day-to-day operations processes for routine change, not crisis plans.

🔗 Related facts and questions

• Three plans and three questions: the BCP: how do business functions keep going during the crisis? The DRP: how do systems and data come back? The downtime plan: how does the unit work right now, with the system down?
  Practice question: “Restoring from backups to an alternate site.” Which of the three plans does this action fall under? → The disaster recovery plan (DRP).
• At the point of care:
  Practice question: “Handing out paper documentation forms to the units when the system goes down.” Which plan does this action fall under? → The downtime plan, which is part of continuity. When the downtime plan is not among the options, the answer is the BCP, as in a related question in the full bank.
• The business impact analysis (BIA): it identifies the critical functions and how long the organization can bear each one being down. The recovery objectives come from it: the recovery time objective (RTO), how fast a system must be back, and the recovery point objective (RPO), how much data may be lost. So does the order of restoring systems.
  Practice question: which analysis decides which systems are restored first after a disaster? → The business impact analysis (BIA).
• Kinds of alternate site: a hot site is ready with its equipment and data and takes over in a very short time. A warm site has the equipment and needs the data loaded. A cold site is space and power only, and takes days or weeks to set up.
  Practice question: service must return within one hour. Which of the three kinds achieves that? → A hot site.
• Testing the plans: a plan that has not been tested is an assumption. It is tested with a tabletop exercise, in which those responsible walk through a scenario step by step, then with real trials of switching to the alternate site.
• “Assessing the likelihood and impact of a power outage” is the work of risk management, which comes before any disaster; it is not one of the three plans.
• Each plan is defined on its own in related questions in the full bank; this question is about the containment relationship between them.