The difference between BCP and DR
You may be one of the many people who ask what is the difference between BCP and DR – that is, what is the difference between a Business Continuity Plan and Disaster Recovery planning?
First a little history – back in the pre-computing era, for most businesses, if they suffered a disaster such as a fire, there would be almost nothing that could be done to recover the business. Records would have been destroyed, new orders (on paper) and product stock, tools and equipment would be gone – a total disaster.
With the digital era, information (including products!) can be duplicated and replicated into backups and remote systems. This capability allows more businesses to benefit from the capability to bring back information in the event of a disaster.
So, by extension, the ability to recover from a disaster has largely been enabled by IT. This has meant that for many businesses, and their management, there is an association that the recovery of a business is the responsibility of IT.
- Don’t worry, we have a backup! – and the 9 mistakes of DR planning
So, there needs to be an understanding of the difference between BCP and DR because of the difference in responsibilities.
The difference between BCP and DR
The two terms of BCP and DR are frequently in use, and they are often confused for each other. There is a hierarchy of planning for disasters that produces these two plans;
Business Impact Analysis -> Business Continuity Plans -> Disaster Recovery Plans -> System Recovery Plans
As you can see, the BCP leads in to a DRP.
The explanation is in the name – a BCP is all about how the Business continues to operate if something goes wrong. It is important to ensure that the ownership of this plan is with the business, as this drives the focus of the document. A properly defined BCP would include considerations such as paper processes, communication with customers and suppliers, staff relocation, location of other documents and contact details.
There should be a disaster recovery plan for IT, but there may be DR plans for other parts of the business too – such as manufacturing, customer interaction, logistics etc. – which in themselves would have disaster recovery plans for their own business capabilities and functions.
What is a BCP?
Development of a BCP will identify contingencies and alternatives for continuing business, and allow the business to define key parameters for the development of Disaster Recovery Plans, such as;
- Defining the priority of critical business processes
- Specifying the time that business processes should be recovered by (Maximum Tolerable Outage)
- Identifying how much information can be recovered by going back to source information – how much can be lost and re-entered (Recovery Point Objective)
What is a DR Plan?
The big difference between BCP and DR plan is that a DRP will specify how the recovery of a function will be performed. Within a DR plan, there will be individual component system recovery plans that would specify steps to recover applications.
