BCP vs. DRP

A certain concept seems in vogue, which a lot of us have started noticing recently. However, I am hardpressed to mention, it is a concept that has been doing its rounds in the corporate arena for a while. Its placement has usually been on the backburner. Higher productivity; sales targets always seemingly take priority over it. It is called Business Continuity Plan (BCP). BCP is typically shadowed by another concept called Disaster Recovery. Many people are of the opinion that both are basically the same, and consultants blame the consultants who keep making life a tad bit difficult at the drop of a hat. In this article I shall provide a broad overview of what these two concepts mean.

BCP is a pro-active, detailed, ongoing, planning program for the organization's business units. Through the development, implementation and maintenance of BCP, the organization aims to ensure that its critical business functions or services can continue during and after a disaster. Its objective is to prevent interruption of mission-critical business and operations processes or services, and to re-establish uptime as swiftly and smoothly as possible. It requires the identification of business critical processes, performance of Business Impact Analysis (BIA), calculation of potential risks, performing gap analysis of the high risk areas and identification of remediation approaches, design of the Business Continuity Plan (BCP) and close the gaps identified earlier in the process. It contains specific tasks and activities, guidelines and procedures required to enable continuous delivery of products and services in the event of disruption to mission-critical IT systems and applications processors. It applies to the continuation of business and operations processes following an event. Events may affect IT directly, such as a power outage, or may not, such as an employee strike (of non-IT employees). It covers every operational aspect about a business and is a 'how do I run my business without fundamental components'. BCP is defined as planning that facilitates the rapid recovery of business operations to reduce the overall impact of the disaster, while ensuring continuity of the critical business functions.

Disaster Recovery Plan basically addresses detailed guidelines, procedures and job steps to recover each specific system from point of failure in order of critical business functions priority, sequentially or concurrently. It may be referred to as an organization's planned strategies for post-failure procedures. It may be further defined as a guide to the orderly restoration of information services or processes in the event of a disaster. DRP applies to recovery from an incident (usually disastrous) and the restoration of support, particularly IT support on business processes. In either case, the goal is to keep the organization's critical business processes operational, at worst in degraded mode (threshold level) to ensure business continuity. DRP is defined as the procedures for emergency response, extended backup operations and post-disaster recovery when the computer installation suffers loss of computer resources and physical facilities. It focuses primarily on IT systems and data recovery. DRP is basically a sub set of the Business Continuity Plan. In practice the Business Continuity Plan is considered incomplete if its DRP is missing or not in place.

Examples:

Scenario 1: ABC Company, located in Delhi, collects and distributes mangoes. During the pre-monsoon season, the supervisor is caught in the rain. The clipboard with all the handwritten orders for the coming year gets wet beyond recognition. In this scenario, a DRP would not help because the orders were handwritten. An effective BCP however would have anticipated this event happening and resulted in the orders being multi-part forms with a second copy taken off-site to ABC's distribution center, located at a distance of more than 100 km.

Scenario 2: A cardboard box manufacturer just implemented 'state-of-the-art' software to cut the fiber board into foldable boxes for export, as a result they laid-off 90% of their staff because the computer system can replace them all. The company runs their operation 23 hours per day, seven days a week. Their whole process is dependant on the computer now, and they have one IT person who understands the whole system. In this scenario the organization will need a BCP with a strong focus on DRP. The BCP would cover areas such as emergency replacement parts/ computers for the operations side, the ability of the company to recover from the loss of the IT person, and disruption of inputs (alternate suppliers etc.). The DRP component would include things like the ability to restore the fiber cutting software, back-up copies of the software stored off-site and the development of a hot-site location.

In summary, BCM is a proactive business based support which is user crafted to an agreed availability level. DRP is a reactive technical solution which cannot meet otherwise 'undefined' business needs. BCP is proactive, that is, making decisions in advance about how much downtime can be afforded and these are made by business users not IT. DRP is reactive, that is, how to recover specific systems and/or by what order or priority soon after facing a disastrous event.

- Montu Chandrabhushan Das