Business Continuity and Disaster Recovery: Their Differences and How They Work Together

Although disaster recovery is considered a subset of business continuity, the methods can overlap. Following is a list of functional similarities:

• Emphasize protecting staff and other stakeholders and critical assets. 
• Prioritize activities and facilities that must resume operations quickly.
• Anticipate and analyze potential risks and threats, including events that could impact equipment and physical facilities or disrupt a distributed platform.
• Detail end-to-end steps for avoiding damage and disruption and recovering from disasters.

“Some organizations just do disaster recovery,” explains Fraser. “They don't do a full business continuity plan. The smaller the business, the more likely it is that you’re making sure that your internal systems and customer systems don't go down. The next piece is, ‘How do I make sure that the business itself continues to operate?’”

A business continuity plan describes the steps a company takes to move through disruption to resume regular business. A plan provides a way for the business to survive and avoid complete closure. 

A business continuity plan should detail the following items, as appropriate for your organization:

• Contact information for continuity leaders, key staff, and all employees
• Guidelines for when and how to use the plan
• Step-by-step procedures and checklists for recovery and continuity
• Communication plans for managing stakeholder relationships 
• Opportunities to test the plans in order to prepare employees to deal with disruptions 
• Continuous improvement strategies to include new learning from exercises and incidents in plan updates 

To learn more about writing a plan, see our how-to guide to writing a business continuity plan. For most useful free, downloadable business continuity plan (BCP) templates please read our "Free Business Continuity Plan Templates" article.

A disaster recovery plan includes the steps to avoid unplanned outages or recover from a disaster. A disaster recovery plan usually covers critical systems such as IT and communications equipment and technical operations.

“We think about disasters, but we don't think about the impact to us until it hits us directly,” says Fraser. Disaster recovery is critical for companies that can’t work without their data or access to online tools. See our article about the importance of business continuity to learn more. 

The concept of disaster recovery is sometimes bundled together with backup for disaster recovery. When you back up your data, you make copies of it (and other programs), either via on-premises media like flash drives or tapes, or in the cloud. Disaster recovery allows you to use those copies, if needed, for recovery. Today, backup and disaster recovery services are usually merged with malware protection.

“People are scared and nervous because today it's all about malware locking up your corpus of data and you have to pay a ransom,” says Harry Brelsford, CEO of SMB Nation and O365nation.

Although you deploy disaster recovery as a reaction to an incident, in a disaster recovery plan, you have to account for a time span of minutes or days and address the following items:

• Essential procedures and steps to recover critical equipment and processes (see this example of disaster recovery procedures) 
• Contact information for all internal and external stakeholders, and a hierarchy chart of recovery team roles and responsibilities 
• Guidelines for when and how to initiate the plan
• Test guidelines to ensure that recovery plans work when needed
• Assurance that data will be available with minimal downtime.

To make disaster recovery planning easier, download one of these disaster recovery plan templates.

With the advent of cloud computing, much restoration falls to what is sometimes called disaster recovery as a service (DRaaS). Simply put, DRaaS is the complete backup of all applications and data to the cloud. 

In addition to backup, cloud services may provide failover services. In failover, when a system fails, another redundant system immediately resumes the functions of the original system. Learn more about the benefits of and best practices for including the cloud in disaster recovery in our article about cloud computing and business continuity.

Service-level agreements (SLAs) specify your customers’ expectations of you, as well as your expectations of your own IT and cloud vendors. In an SLA, you describe recovery point objectives (RPO) and recovery time objectives (RTO) as service-time tier levels. 

You can also include tier levels in your recovery plan. If you don’t have well-defined SLAs, consider using this downloadable SLA template to build them.

As you develop a disaster recovery plan, a critical method of understanding your IT assets is to audit your end-to-end digital environment. A network assessment tool analyzes and reports on your IT infrastructure, including device types, applications, security, processes, and performance. 

IT and network assessments are valuable for a few reasons. With readily available, user-friendly SaaS applications, small-scale devices, and remote work, it's easy for people to add assets without first getting approval (this is known as shadow IT). You also need to be aware of whether you've outgrown your setup — and if you are making significant changes (such as migrating to the cloud), you need to understand what assets you have.

“Use a tool, not a notebook,” advises Brelsford. Online assessment tools trace your network to detect open ports and note which programs people use. For small shops, a physical inventory may be sufficient.

An IT assessment is important even for small and micro-businesses. Download this simple, customizable template to note all devices, like desktops and printers, and the software on each, and current antivirus programs. 

‌Download At-a-Glance IT Assessment Template 

Word | PDF | Google Docs

Consider the guideline ISO 24762, Information and Communications Technology Disaster Recovery, to gain a strong understanding of disaster recovery practices. This document provides a framework of requirements for third-party disaster recovery vendors. 

Even if your organization is small, you can use these guidelines to shape your internal recovery activities.

The two types of policies have some differences. Disaster recovery policy focuses on protecting data and restoring the minimum technical functions for the business to continue. Conversely, business continuity policy focuses on processes to support IT and the rest of the business functions as the firm resumes normal activities.

Business continuity and disaster recovery policies are similar in the following functions:

• Provide a foundation for each plan to limit disruption and continue key operations. 
• Detail continuity or recovery leadership, roles, and responsibilities.
• Specify scope of the plan, including exclusions, inclusions, and limitations.
• Note any legal, regulatory, or other standards an organization must observe. 
• Prescribe the type and frequency of testing and exercises.
• List restoration priority for functions and departments.
• Note who verifies compliance and resolves disputes and questions.
• Provide a benchmark for evaluating adherence to plan and compliance, as well as understanding how to mitigate implementation problems.
• Specify a schedule for regularly updating plans to reflect business changes and learnings from continuous improvement efforts.
• Document risk tolerance, which is often expressed as tiers of service or through the five nines of availability: 
  • One Nine: 9 percent availability, which equates to more than 332 days of downtime out of 365 days
  • Two Nines: 99 percent availability, or 3 days, 15 hours, and 40 minutes of downtime per year
  • Three Nines: 99.9 percent availability, or 8 hours, 46 minutes of downtime per year
  • Four Nines: 99.99 percent availability, or 52 minutes, 36 seconds of downtime per year
  • Five Nines: 99.999 percent availability, or 5 minutes, 15 seconds, or less, of downtime per year

Many organizations post their policies online. You’ll often find these policies are brief and straightforward.

Nonprofit

Both of these policies for nonprofit and government organizations contain detailed definitions. They also emphasize responsibility and detail plan requirements: 

• Maine State Government
• Weill Cornell Hospital

Corporate

One of these corporate records is more of a policy statement for a large company. The other is a smartly designed customer-facing document. 

• Intel
• Tata

Educational

These disaster recovery policies for IT at educational facilities display different approaches to an online document: a web page versus an online PDF. 

• Fordham University
• St. Helens and Knowsley Teaching Hospitals