Information Technology Services
IT Disaster Recovery Planning is a component of Business Continuity Planning:
A Business Continuity Plan is "A plan for post-disaster recovery, maintained by an business function that is essential to an organization, as a part of its security program that will ensure the availability of critical resources and facilitate the continuity of operations in an emergency situation, after a reasonable period of time." In other words, it is the overarching plan of the company to be able to not only recover from a disaster, but also to resume normal business processes in as little time as possible.
Within a BCP, you have some key components:
- Assessment (Business Impact Analysis): A way to identify essential business functions
- Threat evaluation: The likelihood and impact of each threat
- Preparation: For contingent operations - this includes Disaster Recovery Planning, or DRP
- Response: The response to minimize the impact of an emergency
- Mitigation: The reduction or elimination of risks
- Recovery: The return to normalcy
In other words, a Disaster Recovery Plan is a component of the BCP; a critical component, yes, but still only part of it.
So what is exactly an IT Disaster Recovery Plan in light of a BCP?
A Disaster Recovery Plan (DRP) covers "the tactical recovery of IT systems in the event of a disruption or disaster. It provides the capability to process essential organizational applications, even if they are not operating at 100% efficiency, in addition to the ability to return to normal operations within a reasonable amount of time. "
A DRP deals with the nitty-gritty IT related portion of the BCP–Of getting the critical systems & processes identified by the BCP up and running to maintain the continuity and stability of the university in the face of an emergency.
In summary, BCP and DRP are sometimes mentioned interchangeably, when in fact, a DRP is a subset of a BCP: "DRP consists of tactical action items that take place following a disaster. Where a BCP contains high-level language that is appropriate for assessing the stability and continued operation of the business, the DRP process clear and concise instructions that will followed in the event of a disaster."