CISSP For Dummies

Business Continuity Planning and Disaster Recovery Planning are two sides of the same coin. Each springs into action when a disaster strikes. The difference between BCP and DRP can be expressed in the following two statements:

• BCP: Business Continuity Planning is concerned with keeping business operations running - perhaps in another location or by using different tools and processes - after a disaster has struck.

• DRP: Disaster Recovery Planning is concerned with restoring normal business operations after the disaster takes place.

Here’s the scenario: The business in question is a delivery service with one delivery truck that delivers goods around the city.

Business Continuity Planning is concerned with keeping the delivery service running in case something happens to the truck, presumably with a backup truck, substitute drivers, maps to get around traffic jams, and other contingencies that can keep the delivery function running.

Disaster Recovery Planning, on the other hand, is concerned with fixing the original delivery truck. This might involve making repairs or even buying/leasing a new truck.

While the Business Continuity team is busy keeping business operations running via one of possibly several contingency plans, the Disaster Recovery team members are busy restoring the original facilities and equipment so that they can resume normal operations.

Here’s an analogy. Two boys kick a big anthill - a disaster for the ant colony. Some of the ants will scramble to save the eggs and the food supply; that’s ant city continuity. Other ants will work on rebuilding the anthill; that’s ant city disaster recovery. Both teams are concerned with the anthill’s survival, but each team has its own role to play.

BCP and DRP projects have these common elements:

• Identification of critical business functions via the Business Impact Assessment and Vulnerability Assessment

• Identification of possible disaster scenarios

• Experts who understand the organization’s critical business processes

This is where the similarities end. The BCP project diverges on continuing business operations whereas the DRP is recovering the original business functions. While both are concerned with the long-term survival of the business, they are different activities.