Business Continuity and Disaster Recovery

Let’s start with definitions. A disaster is any unplanned event that causes major disruption. This could be a fire in the data centre, a cyber attack that locks all files, or a flood that destroys the office. A disaster is not a small issue like a slow internet connection — it is something that stops normal operations completely.

Disaster recovery (DR) is the set of actions and procedures you follow to restore IT systems and data after a disaster. Think of it as the technical repair manual. If a server melts, what steps do you take to bring a new server online? How do you restore the company’s database from a backup? DR focuses on getting the technology working again.

Business continuity (BC) is broader. It is the plan that keeps the whole organisation (not just IT) running during and after a disaster. While DR focuses on the server, BC focuses on the people and processes. For example, if the office building is inaccessible, BC might set up a temporary call centre in a different city. BC plans cover everything: how to communicate with employees, where to work from, which customers to contact, and how to keep paying suppliers.

BC and DR are related but distinct. BC answers the question: how do we keep the business alive? DR answers: how do we fix the technology? An organisation needs both. If you only have DR, you might get the server running but have no idea where people should work. If you only have BC, you might have a place to work but no working computers.

Key components of these plans include:

Why do these concepts exist? Because perfect uptime is impossible. Hardware fails, humans make mistakes, and nature causes chaos. Organisations used to simply accept downtime and lose money. Today, customers expect 24/7 service, and legal regulations (like those for healthcare or finance) require data to be protected and recoverable. BC and DR turn panic and guesswork into a structured, rehearsed response.

Consider a real example: a retail company relies on an e-commerce website. One morning, a software update corrupts the database. The shopping cart stops working. The DR plan kicks in: the IT team restores the database from a backup taken twelve hours earlier. The website is back up in two hours. However, because the RPO was twelve hours, the company loses all orders placed in the last twelve hours. That is a consequence of the chosen RPO. The BC plan then kicks in: the customer service team sends apology emails to affected customers, offers a discount code, and the marketing team posts an announcement on social media that the site is back online. The BC plan includes a communications strategy to protect the brand’s reputation.

For the CC exam, you must know these terms and how they relate. The exam will ask which term describes “the maximum acceptable downtime” (RTO), or which plan “keeps the business operating during a disruption” (BC). You will also need to recognise that BC and DR are both part of a larger field called organisational resilience — the ability to bounce back from any crisis.

The process of creating these plans usually involves several steps that an IT professional follows:

Testing is crucial. A plan that has never been tested is just a piece of paper. During a simulation, you might discover that the backup password is unknown, or that the failover software has a bug. Fixing these issues before a real disaster saves the company.

Finally, know that BC and DR are not one-time projects. They are ongoing processes. Threats evolve (new viruses, new weather patterns), and so must the plans.

Imagine you are an IT support technician at a mid-sized accounting firm. The firm stores all client tax records on a local server in the basement. Your manager asks you to help create a disaster recovery plan.

First, you inventory every IT asset: servers, network switches, backup tapes, workstations, and internet connections. You note that the server has a full backup every night to a tape that is stored in a fire safe in the same room. You raise a flag: if there is a fire, the backup tape burns with the server. That is a single point of failure. You recommend storing the tape offsite, either in a different building or with a cloud backup service.

Next, you interview department heads to understand what downtime costs. The tax preparation team tells you that if the server is down for more than four hours during tax season, they lose thousands in billable hours. You set an RTO of four hours for that server. The accounting team says they can survive without access to archived records for up to two days, so you set an RTO of 48 hours for that dataset.

You then design the DR procedures. For the critical server, you set up a “warm standby” — a second, powered-down server at a different location that contains an image of the primary server’s operating system. If the main server fails, you can boot the warm standby from a recent backup within four hours. For the archived records, a simple restore from cloud storage within 48 hours is acceptable.

You document every step in a DR runbook: phone numbers of the cloud provider, login credentials (in a secure password vault), steps to power up the standby, and a checklist for communication. You schedule a quarterly test where you simulate a server failure and see if you can actually meet the RTO.

Meanwhile, the business continuity plan is being written by another team. They arrange for a small rental office space across town with internet access, so accountants can work if the main building is damaged. They also create a phone tree: if the internet goes down, the office manager texts all staff with instructions to work from home. They pre-write social media messages for a crisis: “Our office is currently closed due to a power outage. Please contact us via email. We will respond within 24 hours.”

You review the BC plan to ensure IT is aligned. For example, if the BC plan says staff will work from home, your DR plan must ensure that the VPN (secure remote access) and cloud services can handle the extra load. You collaborate with the HR and communications teams to test the BC plan with a mock scenario: a building evacuation. Everyone goes to a designated meeting point, and the receptionist uses a printed roster to check who is present.

Your role as an IT professional is not just about hardware. It is about understanding the business’s priorities, quantifying risk, and creating practical, documented processes that non-technical staff can follow. You also need to ensure that backups are encrypted to protect client data — a legal requirement for accounting firms.

When a real disaster hits (a severe storm floods the basement), your plan is activated. You grab the DR runbook, drive to the secondary site, power up the warm standby server, restore the database from the cloud backup, and confirm it works. Simultaneously, the business continuity team activates the phone tree and moves staff to the rental office. Clients receive a pre-scripted email explaining the situation. By the end of the day, the firm is processing tax returns again — with only four hours of downtime. That seamless response is the result of careful BC and DR planning.