What is the Difference Between IT Disaster Recovery and Business Continuity?

Pre-reading [BL-DR-5] [M1-S1]We get asked that question a lot. What's the difference between Business Continuity and Disaster Recovery? And what is 'resilience' for that matter?

It's an interesting question, and there are specific industry and expert definitions. But, confusingly, they are often used interchangeably. In a broader business context, this is unhelpful.

Business Continuity

According to the BCMPedia, the definition of "Business Continuity" "aims to safeguard the interests of an organization and its key stakeholders by protecting its critical business functions (CBFs) against predetermined disruptions."

The capability of the organization to continue delivery of products or services at acceptable predefined levels following a disruptive incident."

Disaster Recovery

And the definition of IT "Disaster Recovery" is "the ability of an organization to provide critical Information Technology (IT) and telecommunications capabilities and services, after it is disrupted by an incident, emergency or disaster."

The IT DR strategies and plans for recovering and restoring the organizations technological infra-structure and capabilities after a serious interruption."

In a nutshell,

• "Business Continuity" is your organisation's ability to deliver its products and services.
• "Disaster Recovery" is specific to technology and how you 'recover' from an incident.

Data-barracks often use "IT Disaster Recovery" to make this distinction clearer. An "IT Disaster Recovery Plan" can be one of several procedures that sit within a Business Continuity plan.

Some Real-life Examples of Business Continuity vs Disaster Recovery

Key Ingredients in a Business Continuity Plan

• Suppliers: Ensuring your key raw materials are delivered - even if there is a problem with your primary supplier

• Building and Work Environment: Providing alternative resources to continue working, and/or giving staff members remote access to systems if they cannot get to the office

• People: Ensuring there is always enough staff to continue business operations

Key ingredients in a IT Disaster Recovery Plan

• Fall-over Strategy: Strategies for failing-over to replica systems following a fire in the primary server room

• Data Recovery: Processes for recovering data from backups after a malware infection

So What is IT Resilience?

Continuity does not just mean recovering from incidents. In fact, there is an argument that the term "Disaster Recovery" is harmful because it focuses on the (rare) disasters.

A lot of what we do in IT is ensuring up time and resilience rather than "Disaster Recovery". Some examples of creating IT resilience in practice:

• Clustering servers

• Load balancing (improving performance and reliability by ensuring there isn't one point of failure)

• Cyber prevention tools e.g. anti-virus, anti-spam.

A Business Continuity Plan is the foundation for keeping every aspect of your business operational. Should trouble arise, Business Continuity measures keep the wheels turning. Disaster Recovery is a key aspect within that plan, recovering your IT systems following a disruptive incident or disaster. These measures all improve your business' resilience.