An organization's business continuity plan (BCP) should be:

A BCP relies on accurate information about an organization's resources, personnel, processes, and external dependencies. Any changes to these elements, such as staffing changes, new technologies, or facility relocations, can render parts of the BCP obsolete, necessitating immediate updates to maintain its viability for effective recovery.

While new applications might warrant a review or specific testing, the BCP as a whole is typically tested on a scheduled basis, not *whenever* new applications are implemented.

The BCP should be updated based on operational changes, not primarily in anticipation of an independent audit, although an audit might identify areas needing updates.

Testing a BCP after an intrusion attempt is reactive; BCPs should be tested proactively and regularly to ensure preparedness, rather than only in response to specific security incidents.