Business Continuity and Disaster Recovery

What are business continuity and disaster recovery?

Business continuity is how an organisation keeps delivering its most important products and services during a disruption, whether that is a cyber attack, a power cut, a flood, a pandemic or a key supplier failing. Disaster recovery is the narrower technical part: restoring IT systems and data afterwards.

The two depend on each other. A recovered server is of little use if no one knows which service to restore first, and a continuity plan fails if the systems it relies on can’t be brought back.

How do you decide what matters?

The starting point is a business impact analysis (BIA). For each business activity it asks how quickly a disruption would cause unacceptable harm, and what the activity depends on: people, premises, technology, data and suppliers. That produces recovery priorities and targets, usually expressed as:

• recovery time objective (RTO): how soon a system or service must be back;
• recovery point objective (RPO): how much recent data you can afford to lose, which sets how often you back up;
• the maximum tolerable period of disruption: the point beyond which the harm becomes unacceptable.

A risk assessment then looks at the disruptions most likely to cause that harm.

What goes into the plans?

• Continuity strategies, such as alternative sites, remote working, manual workarounds and second suppliers.
• Disaster recovery plans for each critical system, with step-by-step restore procedures and named owners.
• Crisis management and communications: who leads, how decisions are made, and how staff, customers and regulators are told.
• Backups designed to survive an attack. Ransomware groups target backups first, so keep at least one copy offline or immutable, separate the credentials that manage them, and test restores regularly.

How do you know the plans work?

By exercising them: tabletop walkthroughs, technical recovery tests and full simulations. Each exercise should end with fixes to the plan. An untested plan is a hope, not a capability.

Which standards apply?

• ISO 22301 sets the requirements for a certifiable business continuity management system, with ISO 22313 as guidance.
• NIST SP 800-34 Revision 1 is NIST’s guide to contingency planning for information systems, including the BIA and the different types of plan.
• ISO/IEC 27001 includes controls on information security during disruption and on ICT readiness for business continuity.
• NIST CSF 2.0 covers recovery planning and execution in its Recover function.

What does the law expect?

The EU’s DORA requires financial entities to have an ICT business continuity policy, response and recovery plans, backup and restoration procedures, and regular testing. NIS2 lists business continuity, including backup management, disaster recovery and crisis management, among the risk-management measures essential and important entities must take. Sector regulators elsewhere, such as financial supervisors, often set operational resilience rules of their own.

Common pitfalls

Plans that only cover IT, recovery targets nobody has checked are achievable, backups that share credentials with production, untested restores, and supplier dependencies left out of the analysis.