Though many companies use the terms “disaster recovery” and “business continuity” largely interchangeably, they are not the same. It is critical to understand the difference and meaning of both terms.
Disaster recovery is the ability, after a disaster, to get critical data back, and critical applications running again. Business continuity is more than that. It is about planning for a business to stay operative and profitable before, during and after a disaster. Disaster recovery is focused on data and the network. Business continuity is focused on people, processes and business.
Obviously, a good business continuity plan will include a disaster recovery (DR) process. For most small businesses, in a few rare but critical situations, this DR process still means having a “recovery time objective” (RTO) greater than zero. In other words, if a critical server failure occurs, and failover to a local alternative is absent or also fails for some reason, the plan allows for some brief period of time to get a replacement back up and running (virtualized in the cloud in many cases) and accepts a certain amount of financial loss during that time period as a regrettable but acceptable loss in very rare circumstances. With a true local backup and disaster recovery (BDR) solution, failover to a local server should be available in most emergencies, so the risk is small but real.
For an increasing number of businesses, any network downtime at all is unacceptable. In this instance, the demands of business continuity will include a disaster recovery plan with failover to a virtual server in the cloud. In other words, the business can stay operative on a replicated virtual server, activated almost instantaneously after a disaster, with network downtime approaching zero.
And this is precisely the point at which many business continuity plans are inadequate, even if a company’s disaster recovery plan is fully fleshed out. It will make little difference that the servers are up and running in the cloud, if the company does not have, at the very least:
- a designated emergency downtime manager whose job it is to make a better list than this one
- a prioritized list of critical IT functions for recovery
- an emergency list with employee cell numbers and other contact info for quick coordination of offsite or alternative worksite possibilities
- a succession of persons designated to act as coordinators
- a plan for each employee to know how to access critical logins and return to work on critical applications
- a predesignated way to let business customers know that operations are normalizing
- company training in virtual meeting technology to make sure critical meetings can still take place