When an organization experiences a disruptive event, the business continuity plan (BCP) should be triggered PRIMARILY based on:

The expected duration of an outage is the primary trigger for a BCP because the plan's purpose is to ensure the continuity of critical business functions when normal operations are interrupted for a significant period. If the outage is short and can be resolved within standard operational recovery times, a full BCP activation might not be necessary, but a longer anticipated duration necessitates immediate BCP invocation to mitigate prolonged business impact.

While understanding the root cause is crucial for remediation, it is not the primary factor for *triggering* BCP, which focuses on impact, not cause.

The type of security incident informs incident response, but the BCP trigger focuses on the *business impact* and *duration* of the disruption, not just the incident type.

Management direction is essential for BCP oversight and approval, but the *trigger* itself is an objective measure of disruption severity, often predefined in RTOs (Recovery Time Objectives).