Integrating Your Disaster Recovery and Business Continuity Plan

By: Kaylie Gyarmathy on December 5, 2019

Organizations rightly live in fear of disasters and the network downtime they can bring with them. When systems go down due to a natural disaster or cyberattack, the consequences can be devastating in terms of lost revenue, missed opportunities, and damaged reputations. That’s why disaster recovery and business continuity plans are a major focus of any organization’s disaster mitigation efforts.

Why Are Business Continuity and Disaster Recovery Plans Important?

According to a 2018 study, 87 percent of large businesses experienced one or more network outages over the course of a year, with medium-sized and smaller companies suffering 79 and 71 percent, respectively. Over a quarter of those companies lost revenue due to an outage, which highlights the importance of having a plan in place for mitigating the damages associated with disaster downtime. Although 95 percent of companies had a disaster recovery plan in place, nearly a quarter of them never took the time to test or update it.

Having a disaster recovery and business continuity plan in place that is regularly tested is essential for preserving data availability and keeping critical systems up and running. When organizations don’t have these plans in place or neglect to implement them properly, they expose themselves to significant risks in the event of a disaster that disrupts their network systems.

What is the Difference Between a Disaster Recovery Plan and a Business Continuity Plan?

The primary difference between the two plans is one of scope and focus. Disaster recovery plans are primarily used by IT departments to establish a clear set of guidelines for how to respond when critical infrastructure fails. It is concerned with limiting downtime for essential systems, backing up essential data, and determining how long it will take to get servers and networks back up and running in the wake of an outage.

By contrast, business continuity plans are more concerned with the implications of a service outage. When key systems are down, that prevents an organization from performing essential business functions. The longer those functions are down, the more complications are sure to develop. To make a crude automotive analogy, if a disaster recovery plan is focused on how long it will take to change a flat tire on a bus, a business continuity plan is more worried about how to keep the bus passengers moving toward their destination until the tire is replaced.

What Should be Included in a Disaster Recovery Plan?

Since disaster recovery plans focus on the technical side of things, the primary concern for planners is getting infrastructure back up and running in the wake of a disaster in order to ensure data availability. It must consider what redundancies should be in place to prevent essential data from being lost or compromised during a disaster or service outage. Where business continuity tends to have a more proactive focus, disaster recovery plans are more reactive, emphasizing key actions that need to be taken when a disaster occurs to keep damage to a minimum.

A good disaster recovery plan starts with an updated contact list of essential employees and relevant stakeholders who could be impacted by an outage. The plan then outlines very specific procedures and defined responsibilities with regards to recovery goals, incident response, and security concerns. Disaster recovery plans have to take tangible infrastructure concerns into consideration, such as where backup sites are located, what power and cooling redundancies are available, and how access should be managed in the event of a disaster.

What Should a Business Continuity Plan Include?

In addition to the contact lists and procedures outlined in a disaster recovery plan, a business continuity plan should include change management procedures, guidelines for when the plan should be used, procedures for implementing the plan, and a schedule for evaluating the plan that incorporates tests and updates. Since the ultimate goal of a business continuity plan is to keep regular business operations up and running during a disaster, it should emphasize the processes and procedures that are central to that function.

Key resources should be identified and essential personnel should have a clear idea of what they need to do in the event of a disaster and when they should do it. The plan also needs to consider how customers and supply chains will be impacted by an outage. If systems go down, it’s important to know who will be prioritized during an outage or loss of capacity. More critically, a business continuity plan looks for ways to minimize risk before a disaster even occurs, assessing potential threats and shoring up both systems and processes to keep any disaster-related disruptions to a minimum.

Integrating your Disaster Recovery and Business Continuity Plan

Given the interrelated nature of disaster recovery and business continuity plans, it makes sense that many organizations have taken steps to integrate both approaches into one cohesive disaster mitigation plan. Even if a company keeps them separate, it’s worth keeping in mind how its physical IT aspects are connected to its human resources and customer-facing services.

Too often, there is a disconnect between the IT department and other business operations. It’s easy to lose sight of what all that infrastructure is supposed to deliver. The people responsible for executing the disaster recovery plan may not have a clear idea of what business functions need to be restored first. By the same token, a business continuity plan may have requirements that aren’t technically possible based on the existing IT infrastructure. By involving everyone in the organization in the development of these plans, organizations can ensure that every department is on the same page when it comes to backing up data and restoring systems in the aftermath of an outage.

When organizations take a more holistic approach to disaster mitigation, they can create and refine plans that meet a variety of business and technical needs. Increased communication helps planners to know what is necessary and what is possible rather than developing plans that may not have realistic expectations. Given the potential costs of a prolonged outage in the aftermath of a disaster, taking the time to get these plans right before there’s a problem can save more than a headache when they’re actually needed.

Speak to an Expert About Your Company's Specific Data Center Needs