3 Areas You Need to Pay Attention to In Your Business Continuity and Disaster Recovery Plan

The concept of a business continuity and disaster recovery plan (BCDR) is not new, but all too often they are neglected or become outdated over time. In fact, a survey from Mercer found that more than a quarter of companies do not have a business continuity plan in place. And, out of the subset of companies that do have these plans, many haven’t yet accounted for recent world developments that have had a significant impact on business operations, such as the COVID-19 pandemic and supply chain disruptions. Supporting this point, that same study revealed 51% of companies around the world admit they have “no plans or protocols in place to combat a global emergency, such as coronavirus (COVID-19).”

Whether it’s a global pandemic, cybersecurity attack or natural disaster, organizations need to recognize that it’s no longer a matter of if their business will be disrupted, but when. And the only way to continue to operate or successfully respond to such an event is to have a solid BCDR plan in place.

In this blog post, we explain why a business continuity and disaster recovery plan is so important—and the key areas to focus on to keep your business safeguarded from the unexpected.

Breaking Down Business Continuity and Disaster Recovery

The “business continuity” part of BCDR is a set of protocols and processes that allow daily operations to continue during or immediately following a disaster or unplanned outage, while ensuring that the company is minimally affected. The “disaster recovery” part includes the actual steps and technologies needed for recovery in the event of a disruption, especially when it comes to restoring lost data, infrastructure failure or other technological components. 

Combined, BCDRs are all about preparedness. To get there, however, businesses need to first make sure their people, processes and technology are in total lockstep—and for many, that ends up being a hurdle. The reality is that people often procrastinate, especially when it comes to preparing for the future. But most of the time, people procrastinate because they don’t know where to start.

Here are three fundamental areas you should be paying attention to in your BCDR planning:

1. People – Collaboration is Key

An effective BCDR plan needs clear guidance from security leadership, such as a CISO, but also participation from business leaders and collaboration across departments to guide every aspect of a disaster response—from the technical steps following an event, to the financial decisions that need to be made, to communication with employees, partners, customers and other key stakeholders. 

This is why BCDR participation must stretch beyond IT and security teams to include HR, PR, finance, legal and so on. To successfully adapt when disruptions occur, maintain business operations, and keep staff, data and your company’s reputation safe, the entirety of your organization must be involved.

2. Planning – Key Elements of a Successful BCDR Plan

Without an effective BCDR plan in place, your team will be left scrambling to figure out how to respond at a time when every second counts. To get started on building a plan that is tailored to the needs of your business, consider the following:

• Involve all key stakeholders, including executive leadership, board of directors, line of business leaders, facility managers, security/IT teams, HR, PR, legal, finance and key partners such as an MSP, etc.
• Include clearly defined roles and responsibilities for each person involved in the response process.
• Include clearly defined technical protocols and processes to enact in the event of a disaster or unplanned outage.
• Include clearly defined communications processes to both internal and external stakeholders—include a list of key contacts and how to reach them outside of the business (which will come in handy if company phones and email are down).
• Define your acceptable levels of downtime and data loss (i.e., Recovery Time Objectives and Recovery Point Objectives).
• Determine if you need guidance or support from outsourced consultants or technical experts.
• Determine the type of plan testing needed—for example, tabletop exercises, simulations, cutover tests, backup tests, data verification, recovery assurance, etc.
• Schedule testing on a regular basis—at least twice a year, though quarterly is ideal.

3. Testing – Build It Into Your Plan

Once a BCDR plan is developed, it needs regular testing to ensure it will work as intended when you need it most. This is another area that can get neglected. It’s not enough to simply have a plan and test it once. It should be built into your plan from the start with a regular cadence for testing.

Testing is critical because it helps leadership and employees know their roles and how to respond following a cyberattack or another disruptive event. It empowers security teams to detect and correct areas of weakness or vulnerability before they become a problem in a real-life scenario. And, it helps companies keep plans current; when they sit for months, they quickly become outdated or misaligned with the needs of the business, and therefore won’t work as expected.

BCDR Success

A business continuity and disaster recovery plan is not a “nice to have,” it is essential to maintaining operations. In today’s unprecedented threat landscape, BCDR success translates to business success, so it’s vital that organizations have an up-to-date plan that incorporates the right people, processes and testing. If you’ve put off implementing a BCDR plan because you don’t have the expertise, tools or personnel to get started, discover how Navisite’s security services can fill these critical gaps and help safeguard your business.