What Is a BCDR Plan and Why Is It Important?

They say that the best offense is a good defense. What this means in an enterprise IT context revolves around Business Continuity and Disaster Recovery (BCDR), and it is crucial that today's businesses are proactive in their approach to this important program.

As responsible stewards of your organization's information and technology assets, you need to have a plan for events that result in an interruption of services. These events come in many shapes and sizes, and your BCDR response plan needs to be aligned to the size and scale of each type of event. 

What is BCDR?

As we see in the name, this is a two-part program that is complementary but also very different in function.

Business continuity

Let's first consider the first aspect: business continuity (BC). BC is your company's ability to "weather the storm." It ensures that the core business functions can still operate in the event of a disaster. The plan is a company-wide and gives instruction to each department about what is to be done when disaster strikes. 

A BC plan includes a communication and/or crisis response plan. This covers items like who declares the disaster and how the flow of information (media) is managed. A BC plan will describe how to continue operations, even if that is in a diminished capacity, to individual departments like HR and supply chain. The plan also defines the orchestration of effort and events for the organization's disaster response.

Disaster recovery

A disaster recovery (DR) plan is an IT-focused plan that describes the how. The DR plan is a more lower-level plan that's specific to system and data recovery, ensuring no more than an acceptable amount of data or time is lost. We refer to the acceptable data and time loss as a recovery point (data) and recovery time (time) objectives, often referred to as RTO/RPO.

DR procedures are the most critical part of the overall BCDR program. Without these documented procedures, the ability to recover from a disaster is difficult, or even impossible.

A BCDR program is an important form of insurance for your organization. Most companies that do not have a BCDR plan and experience a major disaster never recover. In many cases, they will eventually go out of business. However, establishing a BCDR program can be overwhelming due to scope and complexity. 

How to implement a BCDR strategy

As a result of that complexity, BCDR plans simply don't exist for many companies. Establishing the program, developing it, getting political buy-in and generating the strategy takes time and resources. It also requires knowledge and experience to coordinate and establish the overall framework.

The first step in a BCDR journey is to know where your organization stands today — the current state. You also need to define the impact outages will have on your organization so you can develop priorities. We recommend getting started with a BCDR assessment; a Business Impact Analysis (BIA) is an important first step. Conducting a BIA will uncover the true cost and impact service outages have on the company and can help you in developing prioritized remediation efforts.

BIA as an input to your BCDR program

Before you can create a relevant and efficacious BCDR program, the following issues can be addressed with a BIA:

• determine mission and business processes and recovery criticality;
• identify resource requirement; and
• recovery prioritization.

A BIA strives to determine the maximum amount of application downtime your organization is willing to accept, which provides your BC team with the information they need to determine the proper recovery methodologies.

Be proactive

If your company currently does not have a BCDR program or strategy, we can help you get started on the path to being prepared. Taking a proactive stance and preparing your organization for unplanned disasters may turn out to be one of the smartest decisions your company can make.

Starting with a BIA assessment, we are able to identify and analyze your business functions in order to align IT appropriately with the business. Request an assessment to start the conversation with our experts.