Ensuring the Availability of Essential Public Services – BCP & DRP

The Business Continuity Plan (BCP) ensures the continuity of priority missions during a crisis.
The Disaster Recovery Plan (DRP) restores information systems to normal operating levels after a major incident.

Availability objective

100%

Availability objective

99,9%

Target RPO

< 15 min

Target service restoration

< 2 h

Why Implement a BCP/DRP?

Maintain citizen-facing services (civil registry, school catering, social support, water, waste management, urban planning…)
✔ Continuity of public services
Civil registry, education, social services, water, waste — even during a crisis.

✔ Reduced impact
Lower financial, legal, and reputational losses.

✔ Protection against major risks
Cyberattacks, outages, weather events, human error.

✔ Compliance & best practices
Alignment with ANSSI, GDPR, and resilience standards.

Démarche en 6 étapes

✅ Governance & Scope — Sponsor, business leads, DPO, CISO, IT department.
✅ BIA (Business Impact Analysis) — MTPD, dependencies, recovery priorities.
✅ BCP Strategy — Organization, fallback sites, crisis remote work, procedures.
✅ DRP Strategy — RPO/RTO targets, service levels, architecture.
✅ Implementation — Immutable backups, replication, automation, runbooks.
✅ Testing & Continuous Improvement — Drills, feedback, KPIs.

Defining RPO & RTO

RPO: maximum acceptable data loss.
RTO: maximum acceptable recovery time.

Set realistic targets based on criticality levels, validated by business units.

    • Align with the MTPD (Maximum Tolerable Period of Disruption)

    • Regularly measure actual RPO/RTO during tests

    • Balance costs vs. service levels

Quick Downtime Cost Estimation

A service interruption can represent far more than a technical outage :

    • Cost/hour × target RTO

    • Re-entry cost × number of files/cases

    • Value of unrecoverable data (RPO)

Requirements & Standards

    • General Code for Local Authorities, continuity of public service

    • GDPR: availability and integrity of personal data

    • RGS / PSSI-E / ANSSI: information system security best practices

    • Master Plan / Municipal BCP, alignment with crisis management

Expected Deliverables

    • Process mapping and prioritization (MTPD)

    • Business Impact Analysis (BIA) & Risk Analysis

    • Continuity strategy & disaster scenarios

    • Action plan, procedures, quick-response guides, contact lists

    • Test reports & yearly updates

Test Plan

    • Documentation test: procedure review

    • Technical test: restoration, application failover

    • Crisis exercise: crisis unit, communication

    • Chaos engineering: controlled test window

Recommended Frequency

    • Level 1: quarterly

    • Level 2: semi-annual

    • Level 3: annual

Recovery Architecture

Components

    • VM/database replication (synchronous/asynchronous)

    • Immutable and encrypted backups (WORM)

    • Air-gapped object storage / public cloud

    • Recovery site (cloud, inter-municipal datacenter, another local authority)

    • Intelligent network services

    • Dynamic DNS, load balancer, admin bastion

    • Orchestration scripts/runbooks for failover

    • Scheduled, non-disruptive failover tests

Service Levels

Category
Level 1 – Critical
Level 2 – Important
Level 3 – Standard
Exemples
Civil registry, payroll, emergency services
School services, canteen
Intranet, DMS
RPO
< 15 min
< 1 h
< 24 h
RTO
< 2 h
< 8 h
< 72 h