What is Business Continuity and Disaster Recovery (BC/DR) Planning?

What happens if IT services go down in your company? You need a game plan to bring those services back up as quickly as possible. After you digest that nightmare, it’s time to start creating BC/DR plans. Let’s discuss what BC/DR is, what business continuity and disaster recovery planning look like, and why these documents are so valuable. 

BC/DR planning is part of a larger data governance domain. If you need to learn everything about data governance, risk, and regulatory compliance in the IT world, check out Keith Barker’s CBT Nuggets course. BC/DR planning is included in his course. 

An Overview of Business Continuity and Disaster Recovery

CBT Nuggets trainer Bob Salmans covers the process for planning out your business continuity and disaster recovery strategies. Having a plan to follow in the event of disaster means a business can keep running — and everyone knows how to respond.

What is Business Continuity and Disaster Recovery Planning?

All emergency services have a playbook they follow during a disaster. Creating game plans on the fly when the proverbial poo hits the fan is not the best course of action. Responders need to react – not think. 

Managing IT services isn’t any different. Business continuity and disaster recovery plans are the IT playbooks for recovering digital services. They are designed to explain how systems will be recovered, how long techs have to recover those systems, and what resources are expendable given specific disaster scenarios. 

BC/DR planning is a long, complicated process that must be reviewed and tested often. So, let’s look at the various components of that process and explain why they are so vital. 

Assign Ownership

The most critical step in the BC/DR planning process is to assign ownership. Someone needs to lead the process, make final decisions, and, most of all, be accountable for those decisions. 

Create BC/DR Policies

BC/DR policies are vital to the planning process. They define why the plans exist, what parts of the business they cover, and who are decision makers. This prevents scope creep and outside influences from butting in where they don’t belong. 

Business Impact Analysis

The BIA defines all the business processes, ranks them in order of importance, and states how screwed the business is if a process fails. 

Critical Analysis

After the business understands what impact failed processes have, it’s time to determine the risk associated with each process. Each process is assigned a risk score. A larger risk gets a higher score. Likewise, each process is assigned a score designating how likely the process is to fail. 

Those scores are combined to create a final ‘Oh fud…’ score. Those final scores help dictate which BR/DR recovery processes need to be planned first and how many resources can be assigned to those efforts. 

Establishing BC/DR Recovery Goals, Strategies, and Plans

The rest of the business continuity and disaster recovery planning process defines and creates those processes. The previous sections outline who’s in charge of what, define business processes, and rate how badly the business will be impacted if those processes fail. 

Once we understand the impact on the business and who can make decisions regarding recovering non-functioning processes, the BC/DR team can create recovery and continuity processes. 

Two key points in designing BC/DR recovery processes are defining the maximum tolerable downtime and maximum tolerable outage. The maximum tolerable downtime defines how long the business can tolerate a service or process being down. The maximum tolerable outage defines how long a business can survive for each specific type of outage causing downtime. 

Those metrics create both priority and budget. For example, if a business can survive a week without a functioning system, the business will need far fewer resources to recover that process. On the other hand, if a business can’t survive more than three hours of downtime, the company will pay through the nose for the recovery process. 

The requirements of priority and budget dictate recovery plans and processes. Unfortunately, organizations do not have an unlimited pool of money and human resources to recover IT systems. 

Finally, once business continuity and disaster recovery processes are defined, they must be tested and maintained. The testing and maintaining BC/DR plan phases change from business to business. There isn’t a one-size-fits-all solution. Likewise, these phases never stop. This is why the testing and maintenance phases are vital but individual parts of the BC/DR process that need independent consideration. 

Start Learning How to Plan for Business Continuity and Disaster Recovery

Business continuity and disaster recovery planning is complicated. We’ve discussed a handful of the essential parts of the BC/DR planning process, but there is much more to discuss. Likewise, BC/DR planning falls under the umbrella of data governance and compliance. 

After digesting this article, sign up for Keith Barker’s Governance, Risk, and Compliance online training course at CBT Nuggets. He walks through the entire BC/DR planning process and the larger scope of governance in his course. These are important lessons anyone responsible for IT services needs to understand.