Information Systems
Business Continuity and Disaster Recovery Planning Explained
By SimplyCPA · 11 October 2026
Text size
On this page (7)
- BCP vs DRP: A business continuity plan keeps the whole business running; a disaster recovery plan restores IT systems and data.
- Business impact analysis: Identifies critical processes, the impact of disruption over time, and recovery priorities.
- Key metrics: Recovery time objective (how fast to restore), recovery point objective (how much data loss is acceptable) and maximum tolerable downtime.
- Recovery sites: Hot (ready in hours, costly), warm (days), cold (space and power only, weeks) — and mirrored sites for near-zero downtime.
- Testing: Checklist reviews, tabletop exercises, simulations, parallel tests and full interruption tests — an untested plan isn't a plan.
BCP vs DRP
| Business continuity plan (BCP) | Disaster recovery plan (DRP) | |
|---|---|---|
| Scope | The whole organisation — people, facilities, suppliers, processes | IT systems, applications and data |
| Goal | Continue critical operations during and after a disruption | Restore technology to support those operations |
| Relationship | The DRP is one component of the broader BCP | |
Business impact analysis (BIA)
The BIA, described in NIST SP 800-34, is the foundation of contingency planning. It:
- Identifies the organisation's mission-critical processes and the systems that support them.
- Determines the impact of an outage over time (financial, operational, legal, reputational).
- Sets recovery priorities and the resources needed.
The key metrics
- Maximum tolerable downtime (MTD) — the longest a process can be unavailable before the impact becomes unacceptable.
- Recovery time objective (RTO) — the target time to restore a system; must be shorter than the MTD.
- Recovery point objective (RPO) — the maximum acceptable data loss measured in time — the point to which data must be recovered. An RPO of 4 hours means backups (or replication) at least every 4 hours.
Example: An online retailer decides its order system can be down for no more than 8 hours (MTD), targets restoration within 4 hours (RTO), and can lose at most 15 minutes of orders (RPO). A nightly backup can't meet a 15-minute RPO — it needs continuous replication to a hot site.
Recovery site options
| Site | What's ready | Recovery time | Cost |
|---|---|---|---|
| Mirrored / active-active | Fully duplicated, running simultaneously | Near zero | Highest |
| Hot | Hardware, software and recent data | Hours | High |
| Warm | Hardware and connectivity; data must be loaded | Days | Medium |
| Cold | Space, power and cooling only | Weeks | Low |
Cloud services now provide many of these options on demand, often with replication across regions.
Backup types
- Full — everything, every time. Slowest to back up, fastest to restore.
- Incremental — changes since the last backup of any type. Fastest to back up; restore needs the last full plus every incremental.
- Differential — changes since the last full backup. Restore needs the last full plus the latest differential.
Keep at least one copy offline or immutable so ransomware can't encrypt it, and test restoration regularly.
Testing the plan
- Checklist (desk) review — plan owners review the documentation.
- Tabletop exercise — participants walk through a scenario in discussion.
- Simulation — a scenario is played out with more realism, without disrupting operations.
- Parallel test — recovery systems are brought up while production continues.
- Full interruption test — production is shut down and operations switch to recovery; the most realistic and the riskiest.
See cybersecurity risks and controls and ISC incident response.