A BCP defines and ranks key business functions according to vulnerability and risk, assigns priorities to those functions, and defines procedures to continue priority functions to ensure continuation of an organization, public or private, as a going concern in the event of a disaster. A responsive BCP depends on an adequate Business Impact Analysis (BIA, Looked it up elsewhere in the source) and Risk Assessment (RA, Looked it up elsewhere in the source). Computer system and data recovery, under an IT disaster recovery plan, is a subordinate but important part of a BCP. A BCP includes safeguards for personnel and families, business assets and reputation, customers/clients/citizens, vendors, communications and access to critical resources. It involves training, periodic exercises, post-exercise reviews, and plan updates with special attention to media relations. A BCP is a major factor in an overall risk management program. A BCP is also known as business recovery plan, business resumption plan, and business contingency plan. Under US laws and regulations, private for-profit companies should ensure a capacity to meet obligations to shareholders as well as under the Sarbanes-Oxley Act (SOA). Public sector entities have a duty to meet a standard of care with respect to public health and safety. Relates to Continuity of Governance (COG, Looked it up elsewhere in the source)