What’s the difference between Business Continuity (BC) and Disaster Recovery (DR)? This is a question I have had to answer multiple times. It is a very good question and the answer is not simple! So, as a good lazy 'techy', I tried to find the answer on the web. That way, when I am asked, all I would have to do is send a link.
I have used this approach multiple times for other questions I have received. It is convenient and a great way to avoid re-typing an answer. However, this time, I was not very successful in my quest to find an answer. I searched the web, multiple times, for hours without finding the perfect "pre-written answer" I was looking for. So I decided to stop being lazy and write it myself.
Now, if you are like me, and you've been looking for an answer to this question, feel free to use this one.
So, let’s start with a few definitions from the Business Continuity Institute (BCI) Glossary:
Disaster Recovery (DR): “The strategies and plans for recovering and restoring the organizations technological infrastructure and capabilities after a serious interruption. Editor’s Note: DR is now normally only used in reference to an organization’s IT and telecommunications recovery.”
Business Continuity (BC): “The strategic and tactical capability of the organization to plan for and respond to incidents and business disruptions in order to continue business operations at an acceptable predefined level.”
First, I’d like to say that I have a slightly different view of DR than BCI. Now, who am I to disagree with what BCI is saying? Well, bear with me a little longer and you will see how my interpretation of DR might help people understand the differences between DR and BC better. So here’s my definition: DR is the strategies and plans for recovering and restoring the organizations (scratch technological) infrastructures and capabilities after an interruption (regardless of the severity).
Unlike the BCI, I don’t make a distinction between the technological infrastructure and the rest of the infrastructures (the buildings for example) and nor I do differentiate between the types of interruptions. In my opinion, either a system is down or a building is burnt or flooded, both should be considered a disaster and therefore both require a disaster recovery plan.
Therefore DR is the action of fixing a failing, degraded or completely damaged infrastructure. For example, the 2nd floor of a building was on fire; the fire is now out so the initial crisis is over. Now the damage caused by fire must be dealt with; there is water and smoke on the 2nd floor, the 3rd floor has damages caused by smoke and the 1st floor has water damage. The cleanup, replacement of furniture, repair of the building and its structure, painting, plastering, etc. are all part of the disaster recovery plan.
What is Business Continuity then? Business Continuity is how you continue to maintain critical business functions during that crisis. Back to the example, when the fire started, the alarm went off and people were evacuated from the building. Let say you had a Call Center on the 2nd floor and this just happens to be a critical area of your business. How would you continue to answer calls while people are being evacuated? How would you answer calls while the building is being inspected, repaired or rebuilt? Keeping the business running during this time is what I call Business Continuity.
The same approach can be taken with a system crash or when the performance of a system has degraded to the point that it has impacted business operations. So fixing the system is DR and the action of keeping the business operations running without the system being available is BC.
In conclusion, BC is all about being proactive and sustaining critical business functions whatever it takes whereas DR is the process of dealing with the aftermath and ensuring the infrastructure (system, building, etc.) is restored to the pre-interruption state.
