Key takeaways
- Continuity covers the whole business; disaster recovery covers IT systems and data
- A business impact analysis sets the priorities for both
- RPO and RTO turn those priorities into technical targets
- A plan that has never been tested is still a draft
The difference at a glance
Business continuity
- Scope: the whole business
- Covers people, communication, workspace and suppliers
- Owned by leadership
- Measured by how long each function can be disrupted
Disaster recovery
- Scope: IT systems and data
- Covers backups, restores, failover and rebuilt systems
- Owned by IT, with leadership approving the targets
- Measured by RPO and RTO
Start with a business impact analysis
A business impact analysis, or BIA, is the foundation of both plans. It lists your critical functions, such as billing, scheduling or production, the systems and people each one depends on, and the impact of losing them over time.
NIST’s contingency planning guide, SP 800-34, puts the BIA at the center for the same reason: it is how you decide what to protect first, instead of protecting everything equally and nothing well.
What a small business BCDR plan includes
- Roles: who declares a disruption and who makes which decisions
- Contacts for staff, clients, vendors, your insurer and IT, kept outside your own systems
- Message templates for staff and clients
- Alternate ways to work: remote access, a second site or manual workarounds
- Recovery priorities, with RPO and RTO targets for each system
- Step-by-step backup and restore procedures
- Key suppliers and how they would recover on their side
Plan for impact, not for every cause
- Ransomware or another cyberattack
- Loss of the office to fire, flood or a hurricane
- A long internet or power outage
- Failure of a key server or line-of-business system
- Losing the one person who holds critical knowledge
Planning by impact keeps the plan short. Whatever the cause, the questions are the same: which functions stop, what they need and how soon they need it.
Testing the plan
Tabletop exercise
Walk through a scenario with the people who would act on it. It finds missing contacts and unclear decisions cheaply.
Restore test
Restore a file, a mailbox and a full system, and time each one against its RTO.
Failover test
Run a critical system from its recovery location to prove it works under real conditions.
Update
Fix what the tests revealed, and review the plan whenever systems, people or locations change.
How we help
Our backup and disaster recovery add-on covers the IT side in full: disaster recovery and continuity planning, a defined RPO and RTO, a local and offsite backup strategy with air-gapped copies, and quarterly or annual failover testing with backup summary reports. Through vCIO planning we tie those targets to your wider continuity plan and your yearly IT budget.
Sources
- NIST SP 800-34 Rev. 1: Contingency Planning Guide
- Ready.gov: Business continuity planning
- CISA: #StopRansomware Guide
Information on this page is general and is not legal or compliance advice.