After reading, you can tell the two apart, assign each to the right owner, and make their timings match.
Definition
Business continuity covers activities, people, sites and suppliers, whereas disaster recovery covers systems, data and infrastructure.
The business impact analysis links them. It sets the recovery targets, and the recovery plan has to meet them.
Why it matters
The trouble starts when a company has only one of the two. With recovery alone, servers come back while nobody knows how to serve customers in the meantime. With continuity plans alone, the workarounds assume a return time that IT cannot deliver.
How it works
Business leaders own the continuity plan, with its workarounds, staff arrangements and communication. IT owns the recovery plan, with its technical steps and order of restoration.
Run the impact analysis once and feed both plans from it.
Exercise them together at least once. It is the only way to learn whether the workaround really lasts as long as the restoration takes.
A worked case
A fire closes the head office. The continuity plan moves 40 staff to remote work and redirects the phone line within two hours. The recovery plan brings up the finance system in the second data centre within eight hours.
For the six hours in between, finance follows the manual procedure for urgent payments that the continuity plan provides.
Good practices
- Check that every workaround can last until the matching system returns.
- Give each plan a single owner, and direct both from one crisis structure.
- Test them together on a realistic scenario.
Common mistakes
- Using the two terms as synonyms, which is how one of them ends up never being written.
- Letting IT set recovery targets without the business, so that the targets reflect what is easy.
- Writing workarounds that need access to the very system that failed.
- Running two crisis teams that do not talk to each other.
Questions
- Which comes first, continuity or recovery?
- The business impact analysis, because it tells both plans what matters and how fast.
- Can one document hold both plans?
- Yes for a small company, as long as both subjects are really covered and those doing the technical steps can reach them.
- Does ISO 22301 cover disaster recovery?
- As a part of continuity, through its requirements on strategies and plans. It does not set technical recovery steps.
- Who declares a disaster?
- Someone named in advance, usually in the crisis team, using criteria written in the plan.
- Where does incident response fit?
- It handles the event itself, such as containing an attack. Continuity and recovery deal with its effects on the business and on systems.