Disaster Recovery vs Business Continuity

Just wondering if any of you guys knows the difference between disaster recovery vs business continuity? Are they the same?

Recently, I've been trying to uncover the DR and BC plans in my organisation (for those who knows where I'm, you should expect to find one right?)

IMHO, BC plans touches all functions of business (meaning it's horizontal AND vertical). While DR focuses on using technology to ensure that the organisation (not just IT department) can resume operations after a major disaster.

A few issues worth mentioning here:

1) What are the DR processes in place at your organisation (besides data backup and replication)

2) Any BC plans put in place in your organisation?

3) What are the differences between DR and BC?

microlau wrote:

Just wondering if any of you guys knows the difference between disaster recovery vs business continuity? Are they the same?

Many pple I speak to believe that disaster recovery is more IT-centric, whereas business continuity is more business-centric.

Disaster recovery plans focus mostly on ensuring that IT-related operations  are back online asap (e.g. recovering the data lost, ensuring that the systems are back online etc). Business continuity considers a more holistic picture of how the respective business units (e.g. finance, sales, etc) continue to function.

microlau wrote:

2) Any BC plans put in place in your organisation?

Besides BC plans in place, the question is whether actual dry-run of the BC plans are conducted. Many organizations have BC plans as part of the paperwork (often adopted from "templates), but fail to realize whether the BC plans suit their needs.

In order to ensure that the proper BC plans are in place, it is important for top management to be aware of the values of BC, and have it for the sake of having it.

Just to revive an old topic, Baseline has run a series of interviews on executives of organisations directly affected by Sept 11th attacks. They lay down their perceptions and ways to recover.

I am doing something similar recently . The DR process in my organisation (in a bank) normally involve cross border activity and a local hot site. Some of our DR site is hosted in overseas and replication occurs at late night. 

For the users before a system is implemented, they are required to fill up a questionnaire to determaine if it is a baseline or a critical system. The user and the IT project team are required to defend their reply in front of the management and the audit pannel. 

We are required to have a  DR mock run before a DR system is officially rollout with our DR command team. This usually involve switching the entire system (an its supported system to the DR mode). This exercise will be performed annually with the same team and the user. Result is documented and audited. If a disaster occurs there will be a "SLA" to get the DR system up and running after the designated people from the user side or the operational risk side give the command to activate DR.

For BC, user is required to determine the critical business process to recover/perform if the facilities is bombed(example) Users are relocated to another BCP site preferrably with no visible company signboard (its a strategical move). We do have a BCP exercise yearly and of course the process and result is documented and audited. 

 As you can see DR is more on IT side the system and server etc etc where BCP is more in business process recovery to continue BAU activity(less IT services if its not impacted) ASAP. 

Recently our regulatory authority (aka the government) come to my office to "drink tea".  They dropped a question on how we operate if SG happends to have a bird flu or SARS epedimic. They suggested to include split operation as our BCP plan. However in my opinion it can be also a DR plan (got scolding from my boss when I raise this). Imagine if the IT operational pple fell sick (majority of them) and a critical system fails no one will be available and DR will confirm kick in. Unfortunately our bird flu BCP plan fail to see this and its very rigid (spare me from the details) there will be a true disaster if such scenario occurs.

Basically, DR and BC are just names or terms given to plans on how to react efficiently and systematically during when disaster happens and how to ensure the organisation continue its operations when certain functions are impeded.

As mentioned, DR is a plan that will be enforced when disaster strikes. It should state the likely problems encountered in the face of a disaster and of course the solutions. The solutions should also state the people involved and details such as when and how.

Likewise for BC, this is also a plan to ensure that the organisation continues to function in the event if someone or some key aspect of the organisation is missing. Similarly, the plan also states the problems and solutions as well as the who, when and how.

Both DR and BC may seem the same, but they are different plans. DR plans list out the solutions on how to recover from a disaster, such as where the backup systems are and how to activate them. In the IT world, it may be the necessary user IDs and passwords, and also where the backup data is and how to recover them. From the non-IT world, it may mean where the external source, such as backup power generator and how to operate it. The key in DR plans is how to recover from disaster and steps taken to revert back to normal. In BC plans, it may be a situation where the systems are taken offline, and alternative offline systems are in place to ensure that the organisation operates as usual. The key in BC plans is how to continue operations.

Both DR and BC plans have to be tested and refined so as to ensure that they are reliable. The more problems that the plans cover mean better success to recovery and continuation.

Correct me if I am wrong. My understanding on the differences between DR and BC is summarised into this condensed idea:

DR attempts to restore operations back to how they used to be (hardware and location may have changed, but otherwise everything is transparently the same). BC attempts to maintain the business flow via alternative means because things cannot be restored to how they were used to.

That is the correct summarised answer. Just a slight note thatin BC, it may not be always true that things are not able to be restored, just that they may or should be covered under DR. Or rather, it may take a considerable amount of time, and during this period, an alternative process is required to ensure continuity.

Agree with bronkman. However I think there is a need to set a time/ SLA for the recovery, my company has a SLA of 4 hrs for BC and DR. In this period, sufficient must be made to the dpt that we dependant on where we are relocated and how the alternate process works.