A Continuity of Operations Plan, often shortened to COOP, is a recovery plan that keeps essential services running during or after a disruption. In cyber security, it defines what must stay online, who makes decisions, what backups are used, and how staff switch to manual or alternate procedures when normal systems fail.
COOPs matter because attackers often aim to interrupt operations, not just steal data. Ransomware, destructive malware, account compromise, and network outages can stop billing systems, dispatch tools, industrial controls, or remote access channels. A good COOP reduces downtime by identifying critical assets, setting recovery priorities, testing backups, and documenting fallback communications. In critical infrastructure, it may also include safe shutdown steps, offline control methods, and vendor contact lists. The goal is resilience: restoring mission-essential functions quickly while limiting safety, financial, and service impacts.