What Is Business Continuity and Disaster Recovery?

Businesses need to keep running during times of crisis. A central part of the challenge is bridging through and recovering from computer system crashes that can put a halt to sales, operations, production, and transportation. Whether IT outages are caused by human actions, software bugs, extreme weather, or natural disasters, organizations need well-planned operational and technical strategies for getting through a crisis with key processes intact, then quickly recovering and resuming normal work.

Unplanned, disruptive events that impede critical business operations can harm brand reputation and lead to financial losses and regulatory reprimands. That’s why organizations have long maintained comprehensive continuity plans and backup systems. Now, the proliferation of cloud computing and newer application architectures inspired by the internet are changing the way organizations plan for operating through outages, design disaster recovery systems for retrieving critical data, and allocate budgets for improved resilience.

While plans that use geographically distanced physical data centers as the basis for disaster recovery are common, here we will focus on newer strategies that involve using cloud services.

Running some applications in both a data center and a cloud infrastructure service can be a simple, affordable way to improve resilience by geographically distributing application systems. Costs can be kept down further by running smaller or standby instances in the cloud and scaling them up only when needed.

As we’ll see, one of the toughest decisions will involve deciding how to keep constantly updated copies of critical data stores, such that losing one copy only temporarily interrupts operations. For instance, a system that allows customers to manage their accounts is useful only if the customer can see their purchases and create new ones. If a disaster disrupts that access, the application isn’t useful. Database replication strategies are often a chief factor in creating a resilient strategy.

What Is Business Continuity?

Business continuity plans provide an organization’s leaders with roadmaps for keeping operations running when a disaster or IT failure disrupts the normal flow of work and takes the applications they rely on offline. The plans detail the people, processes, and technology strategies an organization needs to keep working effectively during a catastrophe. The most common reasons for interruptions to normal operations are human technical errors and software bugs that cause crashes, according to experts. Natural disasters, and increasingly, system problems caused by overheated data centers due to extreme weather can lead to business interruptions. Terrorism, cyber criminals, and war can also be causes.

Business continuity plans, while including disaster recovery of software applications and data, go broader, encompassing staff communication, ensuring workers have physical access to computers and mobile devices, and needed changes to supply chains and other operational considerations.

What is Disaster Recovery?

In addition to planning for the people, processes, and technology needed to maintain operations during a disruption, businesses need a concrete plan for recovering access to critical systems, data, and applications. Disaster recovery describes the detailed technical plans businesses create for getting workloads up and running again in their order of importance, the budgets they allocate for doing so, and plans for testing the strategy.

The goal is to minimize downtime and data loss while balancing the cost to protect each computing workload. Here’s where cloud technologies can help.

When computing was primarily done on client-server systems in company-owned or rented data centers, IT budgets could double or triple for each application that needed its own set of licenses, duplicate servers, storage, networking, and cooling, all running in facilities an appropriate distance from the company’s production data center. Cloud computing has changed the math, letting businesses deploy mission-critical applications to multiple cloud regions, or data centers. Cloud technologies also let IT departments quickly change the size of server resources, or instances, and add more capacity as needed using remote management tools.

Businesses need to make critical choices on two key disaster recovery metrics: How quickly do we need to recover from an outage, and what is an acceptable amount of data loss?

The recovery time objective (RTO) measures how long a business is willing to wait until service is restored, and the recovery point objective (RPO) determines the maximum amount of data a business is willing to lose in a disaster. The lower the thresholds the better, but the more a disaster recovery plan will cost to implement. Each system IT runs will have its own RTO and RPO. A sales transaction system will have short recovery times and points, while an employee expense system could reasonably be recovered a few days after a disaster.

What is BCDR (Business Continuity and Disaster Recovery)?

Business continuity and disaster recovery refers to the technologies, policies, and procedures an organization puts in place to ensure it can continue operating in the event of a disaster or other unplanned interruption. BCDR involves identifying potential risks to uptime and developing strategies to recover and resume normal operations as quickly as possible.

Business continuity and disaster recovery strategies have become more important for a broader swath of companies as more transactions with customers, suppliers, and other partners are done online, and data volumes have swelled. Further, more systems have become interdependent. That customer portal that lets customers see past orders and make new ones may require connections with inventory management, fulfillment, and production management systems. Since they’re all required, each will inherit the shortest RTO and RPO requirements of the group.

While business continuity is important for companies in every sector, effective BCDR plans can be particularly critical for organizations in certain industries. For example, companies in highly regulated sectors including banking, energy, and healthcare have rigorous business continuity requirements and often can’t tolerate the time it takes to recover data from backup copies. And certain subsectors, such as capital markets trading, can’t afford to lose even minutes’ worth of data.

Businesses should start their BCDR planning with an impact analysis that details what disasters may take place and the types of losses that could result. The plan should include technical configuration errors, natural disasters, acts of terrorism, and cybersecurity incidents such as ransomware attacks. Since data volumes today are much higher than in decades past, business leaders need to prioritize processes and their associated software applications, determining which are mission-critical and placing others in ranked groups of importance, called tiers, where more lenient RTO and RPO standards can apply.

Identifying the most critical areas of a business and estimating the amount of downtime each one could tolerate will help create a plan for keeping those functions running, including data backups, “pilot light” IT installments that can help start broader computing operations, and the technology setups employees would need to work from home. Pilot light systems can be thought of as warm standby systems, and as long as they can reach critical data stores, these cloud-based systems can be up and running in minutes after a disaster.

Cloud computing technologies are important tools that can help companies implement business continuity and disaster recovery plans without breaking their budgets.

Hybrid IT setups, in which some computing resources run in the public cloud and some run in on-premises data centers, have lowered the cost of disaster recovery. Cloud workloads built with microservices—collections of small software components running on distributed, virtual servers working in tandem to deliver applications to users—let companies create so-called “pilot light” IT deployments, that is, live, up-to-date data with idle services that can be used to restart a system in a cloud data center. Hybrid cloud environments do require businesses to identify, catalog, and manage application dependencies that would prevent a software program from restarting if another it relies on is offline.

Some businesses are working to move all their applications to the cloud, with the goal of eventually shutting down their data centers. Several drivers are typically at work here, including a desire to integrate in-house applications more easily with other cloud-based systems; simpler system and application management; better application scalability, availability, and upgradability; and superior BCDR. The business continuity benefits include the ability to keep pilot light systems in cloud data centers in geographically disparate cloud regions, fewer concerns for employee and customer accessibility in a disaster, and a fundamentally more bullet-proof application design with few or no single points of failure. Getting all these benefits requires more than simply moving an existing application to run in a cloud data center, however. It requires rearchitecting and recoding the application.

The process is known as refactoring, and the best architecture for that effort is cloud services. Refactoring can be time-consuming and expensive. However, the resulting applications are more resilient, versatile, and scalable—all outcomes that benefit your BCDR strategy. The application will also be easier to modify to provide new functionality. For instance, adding analytics and AI functionality becomes a more manageable process as these are just new web services to use within the app.

Businesses need to prioritize their workloads by necessary availability, RTO, and RPO when planning a disaster recovery approach that fits their budget. Restoring systems from a backup copy may be the least expensive path—though large data sets can take a very long time to recover, and offline backups will have a long RPO. Still, offline backups are important, especially for critical data, and may be the only viable option to recover from a ransomware incident. Pilot light deployments can restore systems to running status in minutes instead of hours but are more expensive to maintain.

Warm standby methods, which combine live, up-to-date data with cloud-based application replicas that can handle requests while running at lower capacity, have RPOs measured in seconds and RTOs in minutes. A so-called active/active failover approach using multiple live sites running at full capacity can deliver recovery times and points of nearly zero but is the most expensive.

BCDR Explained

Business continuity planning should start with an assessment of potential risks. Organizations should then measure the expected impact of those risks on processes and identify the team members who’ll take on defined roles to mitigate them. Plans should also capture how the company will maintain employee communications, account for customer service and sales contingencies, and adjust supply chains. And they shouldn’t depend on any one person to bring systems back online.

Companies need to create an inventory of their hardware and software assets that documents the dependencies among them. Components of systems that will run only during disasters need especially careful testing, since they aren’t ordinarily used and are prone to failure.

The most successful BCDR programs map dependencies, determine application tiers, assess risk, undergo regular testing, and feature skilled teams and a visible executive sponsor, according to research from PwC.

It's important for businesses to differentiate between high availability and disaster recovery when planning their cloud computing approaches. Public clouds that include so-called availability zones within a few kilometers of one another, or even within the same building complex, can help ensure that if there’s a failure in one data center, customers’ workloads will continue running in the others in the zone. While this approach provides higher availability, it doesn’t cover disasters with a wider radius, such as major weather events, regional blackouts, and heatwaves.

Why Is Business Continuity & Disaster Recovery Important for Businesses?

Disruptive events, natural disasters, or unforeseen IT failures can impede sales and operations, render offices unusable, knock data centers offline, or destroy plants and equipment. Financial losses often follow. A business continuity and disaster recovery plan can let organizations respond swiftly during a crisis, limiting losses, meeting compliance requirements, and continuing to serve customers.

Severe computer outages that wreak havoc on operations can cause financial damage to the tune of US$100,000 per hour, according to estimates. Southwest Airlines, for example, grounded nearly 2,000 flights in April 2023 after a network firewall problem, leaving passengers stranded at terminals or on tarmacs. And unplanned outages are becoming more expensive: A 2022 survey of 830 companies (PDF) by IT advisory group Uptime Institute found that a quarter of unplanned outages cost affected businesses more than US$1 million. Of those surveyed, 29% had revenues less than US$1 million, 28% earned between US$1 million and US$9.99 million, and the remainder were US$10 million or above.

What Components Are Included in a BCDR Plan?

Business continuity plans include comprehensive assessments of potential risks and the interruptions to operations they would cause, how internal staff and suppliers could be affected, and the financial losses and regulatory fines that could result. They also detail the personnel, processes, and technical steps needed to get back online and operational and recover any missing data. Training and testing are also essential.

A strong BCDR plan includes the following:

• Identification of scenarios which would interrupt normal business processes, noting essential people, resources, facilities likely affected and that will require attention during recovery.
• A business impact analysis with a discussion of recovery time objectives and recovery point objectives. The analysis should include estimates of lost sales and profits following a disaster, factoring in how much risk those losses would pose to the company’s survival.
• A strategy for selecting and provisioning backup sites, and for distributing workloads in a public cloud in a way that lets operations restart promptly.
• A ranking of critical and important business applications that need to be restarted first and a map of IT dependencies that could impede getting those apps online.
• Changes to operations, the risks involved, and a program for educating staff about contingency planning.
• Provisions for continuous improvement of the plan and approval from line-of-business (LOB) executives whose groups would potentially be involved. Individual lines of business should also identify scenarios which would interrupt their work, the people, resources, sites, and technology involved, and develop plans for responding to those scenarios.

How to Build a BCDR Plan

Building a BCDR plan involves several steps, beginning with assembling a team of key stakeholders. By following this process, you can build a comprehensive BCDR plan that will help protect your business and minimize disruptions in the event of an emergency.

1. Identify and build a team of people, including an executive sponsor, that’s responsible for creating and implementing the plan and ensuring that it’s kept up to date and periodically tested.
2. Catalog the physical and IT assets that could be affected by a disaster.
3. Conduct a business impact analysis of operations and locations that could be disrupted by a disaster or an unforeseen outage, including the impact on suppliers, distributors, retailers, and other outside parties.
4. Establish an alternate site where staff can work during the disruption, and create a plan for communicating with employees during that time. Alternatively, determine how employees can work from wherever they may be during a disaster.
5. Create a disaster recovery plan that ensures recovery times are commensurate with an application’s importance, keeping in mind that large data sets can take a very long time to recover from a backup system.
6. IT teams should determine which workloads can be restored from backup, which require live data combined with services running at reduced capacity, and which workloads always need full-service capacity even when running on backup servers. Decide on their RPOs and RTOs and develop recovery processes to meet them.
7. Test the business continuity and disaster recovery plans, either through tabletop testing, consisting of a verbal run-through of the steps key stakeholders would take, or through an actual walk-through of those measures. Temporary cloud deployments can help significantly in testing recovery procedures.

On the IT side, pay special attention to testing components of systems that will be used only during disasters.

Download the free business continuity and disaster recovery plan (DOC)

Future of BCDR

The business continuity and disaster recovery fields are looking to new technologies to automate work and improve accuracy. At the forefront is generative AI, which can comb through standards and documents about best practices to create a starting point for a BCDR plan. The technology can draw connections between business processes and the resources behind them, helping create the business impact analysis.

AI tools can then save business continuity managers hours of time by finding detailed information in the impact analysis that can inform the recovery plan.

Generative AI in IT development and operations can also analyze usage spikes and abnormal changes in access to data that staff could miss and that could indicate a pending outage. It can also help identify software dependencies and be used to re-architect systems to have fewer single points of failure.

Simplify Your Business Continuity Strategy with Oracle Cloud Infrastructure

Cloud computing with Oracle technology provides several safeguards against computing downtime as the result of a disaster. Oracle Cloud Infrastructure (OCI) employs a unique and especially resilient approach that separates each of its global cloud regions, which provide services across geographic areas, into availability domains, which are isolated from one another. Availability domains in the same region each have their own power and cooling systems, so a failure at one domain in the region is unlikely to bring down computing work in another.

The availability domains are connected to one another by a low-latency, high-bandwidth network, letting customers build systems that can be replicated across availability domains for high-availability and disaster recovery. The network also connects cloud environments to on-premises computing for hybrid cloud environments.

Each OCI availability domain in turn includes three fault domains so computing instances don’t reside on the same hardware within an availability domain. This architecture also helps protect against unplanned outages. Oracle’s strategy is to deploy two or more cloud regions in countries where it operates a public cloud to address customers’ data residency requirements.

In addition, Oracle Database includes Real Application Clusters (RAC) technology for built-in redundancy, whether workloads are running on OCI or Microsoft Azure. A separate product, Oracle Active Data Guard, real-time, remote standby copy of data for higher availability and disaster recovery of Oracle Database. For customers with the most demanding and sophisticated DR needs, Oracle Cloud Infrastructure GoldenGate can replicate data at the block level, providing quick recovery times from recovery points.

A comprehensive business continuity and disaster recovery plan can help minimize downtime, financial losses, and reputation damage. It also provides a sense of security to employees, customers, and stakeholders, knowing that the organization is prepared to handle unexpected situations, comply with regulatory requirements, and protect critical data and assets. The peace of mind and resilience that a BCDR plan offers make it worth the effort for businesses of all sizes.

BCDR FAQs

What do you include in a BCDR plan?

A business continuity and disaster recovery plan should include a risk assessment of the potential errors and events that could interrupt normal operations, an impact analysis of what assets and computer systems would be affected, an estimate of potential financial losses, and provisions for keeping people and processes running during a crisis. BCDR plans also include detailed technical descriptions of how a business will bring key applications back online and make sure employees have access to data while minimizing its loss. Training for staff is also an important component.

What does BCP stand for?

BCP stands for business continuity plan, which includes a detailed strategy and a catalog of the processes and systems that let a company maintain its operations through an unforeseen disruption. A BCP includes provisions for managing people, processes, and technology during a crisis, with the goal of returning to normal work as quickly as possible.