Vulnerability Assessment and Risk Management · Topic 4 of 4
Disaster Recovery and Business Continuity Planning
Learn how disaster recovery and business continuity plans differ, the kinds of disaster, backups, RTO, RPO and the types of recovery controls.
- 4 min
- A BCP keeps the business running, and a DRP restores IT systems and data.
- A business impact analysis finds the critical functions and acceptable downtime.
- RTO is how long a system can be down, and RPO is how much data loss is acceptable.
What it is
Disaster recovery and business continuity planning prepare an organisation to keep working, or return to work quickly, after something goes badly wrong.
A business continuity plan (BCP) keeps the important parts of the business running during and after a disruption. A disaster recovery plan (DRP) is narrower and covers restoring IT systems and data.
This page covers the kinds of disaster, what the plans contain, backups and recovery sites, and the three types of control.
How it works
Planning happens before the disaster, because there is no time to invent a plan during one.
Kinds of disaster
| Kind | Examples |
|---|---|
| Natural | Flood, earthquake, fire from lightning, storm, extreme heat |
| Human caused, deliberate | Cyberattack, ransomware, sabotage, theft |
| Human caused, accidental | Mistaken deletion, a wrong configuration change, a spilled drink |
| Technical | Power failure, hardware failure, a provider outage |
A good plan covers all kinds, because the effect on the business is often similar. Loss of a building and loss of data from ransomware both stop people working.
Business continuity and disaster recovery plans
The two plans work together.
| Plan | Focus | Typical content |
|---|---|---|
| BCP | The whole business and its critical functions | Which functions are vital, who does what, alternative work places, communication |
| DRP | IT systems and data | Order of restoring systems, recovery steps, backup locations, contact lists |
Both plans normally start with a business impact analysis (BIA). This identifies the critical functions, how long each can be down, and what the downtime costs.
Useful features of a good plan are:
- clear roles and a named person in charge
- up to date contact lists, inside and outside the company
- a priority order for restoring systems
- copies of the plan stored where they can be reached when the main site is lost
- regular testing and training, with the plan updated after each test
Two measures set the targets:
- Recovery time objective (RTO) is how long a system may be down before the damage becomes unacceptable.
- Recovery point objective (RPO) is how much data loss, measured in time, is acceptable. An RPO of one hour means backups must be taken at least every hour.
Backups and recovery sites
Backups are central to recovery. The page on endpoint policy introduced full, incremental and differential backups and the 3-2-1 rule. Backups should be tested, protected from attackers, and kept offline or off site so that one event cannot destroy both the data and its copy.
If the main site is lost, a recovery site can take over.
| Site type | State | Recovery speed | Cost |
|---|---|---|---|
| Hot site | Fully equipped and running with current data | Fastest | Highest |
| Warm site | Has equipment but needs data restored and set up | Medium | Medium |
| Cold site | Space and power only | Slowest | Lowest |
The choice depends on the RTO. A system that can only be down for minutes needs a hot site, while a less critical one may use a cold site.
Disaster recovery controls
Controls are grouped by when they act.
| Type | Purpose | Examples |
|---|---|---|
| Preventive | Stop the event from happening or reduce its chance | Backup power, fire suppression, patching, access control |
| Detective | Notice that something has happened | Alarms, monitoring, intrusion detection, log review |
| Corrective | Fix the damage and restore normal operations | Restoring from backup, rebuilding systems, applying a patch after an incident |
A full plan uses all three. Prevent what you can, detect quickly what you cannot, and correct fast.
What to remember for the exam
Seven facts cover most questions on this topic.
- A BCP keeps the business running, and a DRP restores IT systems and data.
- A business impact analysis finds the critical functions and acceptable downtime.
- RTO is how long a system can be down, and RPO is how much data loss is acceptable.
- A hot site is the fastest and costliest, and a cold site is the slowest and cheapest.
- Backups must be tested and stored away from the main site.
- Preventive controls stop events, detective controls notice them, and corrective controls fix them.
- Plans must be tested and updated regularly.
To tell the control types apart, ask when it acts. Before is preventive, during or just after is detective, and afterwards to fix is corrective.
Common mistakes
These four errors are common.
Using BCP and DRP as the same thing. The BCP covers the whole business, and the DRP covers IT recovery.
Never testing the plan. An untested plan often fails when it is needed.
Keeping the only copy of the plan on the failed system. Store copies where responders can reach them.
Confusing RTO and RPO. RTO is about time to recover, and RPO is about how much data you can afford to lose.
A backup that has never been restored is not proof that you can recover. Test restores regularly.
Check yourself
Work through these three questions.
What is the difference between a BCP and a DRP?
A BCP keeps the whole business running through a disruption. A DRP focuses on restoring IT systems and data.
What do RTO and RPO measure?
RTO is how long a system can be down before the damage is unacceptable. RPO is how much data loss, in time, is acceptable.
Which type of control is restoring from a backup?
A corrective control, because it fixes the damage and restores normal operation.
Topic 4 of 4 in Vulnerability Assessment and Risk Management
Test yourself on Vulnerability Assessment and Risk Management
The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.