BCP or DRP? The essential response to business interruption!
What would happen to your company if all its data disappeared? Or if its business tools became inaccessible? We are all dependent on our information and IT systems. That's why it's essential to adopt best backup practices to prevent the slightest interruption to a company's activity, whether due to media or hardware failure or disaster.
How to assess the risk? How can we protect ourselves? That's where the Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) come in. BCPs and DRPs are documents that bring together all the measures needed to limit the consequences of incidents, by providing a specific response according to the severity of the disruption. Find out now how to protect your IT infrastructure, and the best tools to help you along the way.
[Definitions] BCP and DRP: the differences
The meanings of the terms BCP and DRP are sometimes confused, sometimes distinguished. Basically, the idea is the same: how do you keep your business running without interruption, or how do you get it back up and running as quickly as possible after an unexpected interruption? One provides a short-term answer, the other a longer-term one.
What is a Business Continuity Plan?
A BCP (Business Continuity Plan) is a system designed to avoid any interruption to your business operations. Whatever problems arise, information must be accessible (implementation of a downgraded mode, backup network, etc.).
The BCP takes the form of an action plan, implemented by your IT department or with the help of an external service provider. The measures it provides for will ensure the continuity of critical business activities and processes, without loss of data or disruption to operations. It encompasses a range of responses relating to :
- backup: incremental or differential, local or cloud (private cloud, public cloud or hybrid cloud) ;
- your antivirus, antispam and firewall shields to protect your business software and data;
- your suppliers: service providers, hosting companies... In the event of failure, what guarantees do you have? In terms of insurance? In terms of accessibility? Are they committed to high availability of your data? Do they offer managed services or IaaS (Infrastructure as a Service)?
- ISO 22301, which sets out a framework for best practice in this area.
There are three steps to implementing a business continuity plan:
- identify business continuity requirements ;
- Establish the documentation base defining all business continuity procedures;
- regularly test your BCP to correct any shortcomings or inconsistencies.
A BCP enables you to anticipate and minimize the legal, financial and image impacts of a disaster affecting your business.
What is a Disaster Recovery Plan?
The Disaster Recovery Plan (DRP) can be implemented as part of a business continuity plan, or independently. In all cases, it sets out the steps to be taken in the event of an incident, so that IT activities can be resumed as quickly as possible, whether in degraded or full mode.
When a short outage is foreseeable, the DRP is adapted. It involves defining the maximum acceptable downtime and the maximum tolerable data loss. In particular, it enables the company's IS to be switched over to a backup system.
The aim of the DRP is to respond to a risk with long-term repercussions. It specifies the conditions under which the company will be able to resume normal operations, ensuring that the restart is as orderly and rapid as possible.
A simple backup does not make a good DRP! It can include :
- the presence of backup sites ;
- data redundancy between datacenters;
- parameters for restarting applications or machines.
[Objectives] Why implement a BCP or DRP?
Is your company concerned by BCP and DRP?
Cybersecurity issues
In the age of cloud computing virtualization, we all know the proportions that a cyber attack can take.
93% of companies were victims of attempted fraud in 2016.
This figure shows the intensity of the threat. Hacking is protean: viruses, spyware, Trojans... Whatever the operating system used, no one is immune.
The tip of the iceberg
Hacking can be used for identity theft, ransomware, theft by money transfer or industrial espionage. These practices have a direct impact on a company's image, competitiveness and finances.
Deeper impacts
Less quantifiable collateral damage, but just as damaging, is the loss of service for your business. When the IT infrastructure crashes, employees no longer have access to their work tools. And yet, the meter is running: a dry loss for the company.
What kind of risks does your company face?
More generally, various kinds of serious crises can affect a company's information system and jeopardize business continuity:
- external IT threats such as cyber-attacks, viruses, server theft, etc. ;
- an operating error;
- hardware or computer failure;
- network or infrastructure problems;
- prolonged power cuts;
- natural disasters such as floods, fires, storms, etc.
Whatever the size of your business, it is undoubtedly exposed to some of these risks.
The infographic below reveals the risks of fraud and intrusions into corporate IT systems in France. These figures are based on the results of a survey of 150 finance departments, conducted jointly by Euler Hermes (credit insurance) and the DFCG (national association of finance and management control directors).
Cascading effects
The disaster scenario
Imagine that your ERP (Enterprise Resource Planning), your CRM (Customer Relationship Management), your EDM (Electronic Document Management) or even your DB (Database) became inaccessible. What would happen? The IT department would be on pins and needles, looking for a solution, carrying out rapid troubleshooting.
Long-term after-effects
The breakdown would eventually be resolved. However, some information could be permanently lost - e-mails, customer data or order forms, for example.
The consequences would be felt over the long term. These types of collateral damage are so diverse and far-reaching that they are difficult to assess in their entirety. They can include :
- financial fallout (if key company activities are forced to shut down),
- consequences for brand image and customer satisfaction,
- impacts on the company's internal operations,
- legal consequences, etc.
The organization faces operational difficulties in addition to its day-to-day challenges: in fact, 80% of companies that suffer a major IT disaster close down within two years.
The essential aim of implementing a BCP or DRP is to limit the damage that can be caused by a business interruption, and to ensure business continuity or recovery.
Below, we'll look at how to protect your business, and how you can arm yourself to safeguard your business with DRP and BCP.
[In practice] How do you set up a BCP or DRP?
Prerequisites
The plan must describe the resources to be deployed and the procedures to be followed in the event of an incident, in the same way as a crisis unit.
The company must ensure that the processes involved in implementing a BCP or DRP are entrusted to individuals or entities with technical mastery and real expertise in the field. To this end, the process can be undertaken internally if the required skills exist within the teams, or by a specialized service provider.
The stages
The first step in setting up a BCP or DRP is to take stock of the situation. Questions raised upstream will help identify the company's vulnerability, the type of situation it may face, and the appropriate response (continuing operations, calling on external support, etc.). The following steps can be taken:
- Analyze requirements in terms of data availability and critical processes;
- draw up a classification of the company's information and assets;
- study the risks to which the information system is exposed;
- draw up a continuity plan or disaster recovery plan;
- define processes for steering and managing a potential crisis;
- organize and monitor test phases.
Best practices
Assessing risk
Measuring the risk associated with the loss of your information assets means calculating the cost. It depends on the extent of your IT assets, on the one hand, and on the practices that surround them, on the other.
Make an exhaustive analysis and raise awareness
Do your employees consult professional data on their personal computer terminals: smartphone, tablet, computer? BYOD (Bring Your Own Device) is an increasingly common practice.
If this is the case in your company, you need to extend your security measures to cover it. Habits also need to be carefully considered. The use of USB sticks, for example, or the ability to recognize the risk of phishing.
This is also where we need to work: training people to protect themselves, both individually and collectively.
Prevention AND cure
Taking action means trying to prevent an incident from happening in the first place. It also means knowing what to do if the worst happens. You need to anticipate the different types of incident.
They can be computer-related or hardware-related: a fire that melts down your computer servers; a flood that renders your computer circuits unusable; and so on.
[Tools] Reliable solutions to secure your data!
To implement a comprehensive business continuity plan, your company needs a reliable backup solution. There are various software solutions available, such as Trust2Cloud or Beemo Data Safe Restore. Both of these solutions provide your company with a network-attached storage (NAS) box, for faster system recovery in the event of an incident.
Here is a selection of other tools that can help you implement a BCP or Disaster Recovery Plan.
BeBackup, a solution within everyone's reach
BeBackup software is aimed at IT service providers, enabling them to manage a Cloud backup service for their customers. Regardless of the type of hosting chosen (at the service provider's premises, and/or in a datacenter, and/or at the customer's premises), the solution offers a very high level of security. You can choose any type of backup infrastructure, depending on the level of security required by your customers.
BeBackup highlights :
- An ultra-secure solution, thanks to agent-side encryption of backed-up data at source;
- Optimized backup with intelligent server-side tasks (data control, deduplication, replication, etc.);
- A web console for centralized management of your entire fleet;
- Attractive pricing.
BeBackup
UCover by Nuabee, disaster recovery in the cloud
UCover by Nuabee is a fully-managed disaster recovery solution that automates disaster recovery processes. More than just a backup solution, UCover by Nuabee ensures the recovery of IT activities for SMEs and SMBs in the event of an incident or disaster, with the possibility of restarting critical applications in a matter of hours.
Their IT infrastructure is modeled in their databases, and when a DRP is executed, the infrastructure is automatically rebuilt and recovered. The solution enables regular, monitored testing of the restoration of IT environments in the public cloud. A major advantage: internal IT resources are not impacted during the test phases.
UCover by Nuabee highlights:
- A reliable solution thanks to its 100% industrialized model, which enables tests to be run on a very regular basis;
- No impact on the original IT infrastructure, and therefore no interruption to users' work during test execution;
- Choice of backup method: agent-based or agentless (via hypervisor), depending on the application most relevant to your servers, with a hybrid approach possible.
UCover by Nuabee
vSphere, virtualization for hybrid clouds
vSphere is a server virtualization platform and the heart of a Software Defined Datacenter (SDDC), also known as a "virtual datacenter". vSphere is designed for companies that want to maximize their IT resources by consolidating and optimizing their applications.
As part of a BCP or DRP program, the solution helps reduce the cost and complexity of disaster recovery and business continuity operations, thanks to always-available IT functionality and agile implementation.
vSphere highlights:
- Market leader in virtualization;
- Reduced hardware and IT costs;
- Multi-level protection against downtime and data loss.
vSphere
Protect your business - call in the experts!
The aim of a business continuity plan is to do everything possible to keep your business running. By assessing the risks of data loss or service disruption, you can deploy the measures needed to protect your business.
By implementing a BCP or DRP, you give yourself the means to limit any damage to your information system, thanks to precise organization and procedures to reduce the impact. The choice of your recovery plan depends on the criticality of your IT capabilities: you may opt for a BCP if their continued maintenance is essential to the survival of your organization, or you may implement a DRP strategy if a gradual resumption of your activities is conceivable after a service outage.
In all cases, the process of implementing business continuity or recovery is complex and highly specialized. It will have to be entrusted to competent in-house resources, or outsourced to service providers with the requisite expertise.
What about you? Are your information systems prepared for the consequences of a potentially damaging event? What have you put in place, or are you planning to put in place, in terms of business continuity or recovery?
Updated article, originally published in May 2017.
Article translated from French