BCP or DRP? The essential response in the event of business interruption!
What would happen to your company if all its data disappeared? Or if its business tools became inaccessible? We are all dependent on our information and IT systems. That's why we need to adopt the best backup practices to prevent the slightest interruption to a company's activity, whether it's due to media or hardware failure or a disaster.
How do you assess the risk? How do you protect against it? This is where the Business Continuity Plan and the Disaster Recovery Plan come in. The BCP and DRP are documents that bring together all the measures needed to limit the consequences of incidents, by providing a specific response, depending on the severity of the disruption. Find out now how to protect your IT infrastructure and the best tools to help you in your approach.
[Definitions] BCP and DRP: the differences
The meanings of the terms BCP and DRP are sometimes confused and sometimes distinguished. Basically, the idea is the same: how do you continue your business without interruption, or how do you get it back up and running as quickly as possible after an unexpected interruption? One provides a short-term answer, the other a longer-term one.
What is a Business Continuity Plan?
A BCP (Business Continuity Plan) is a system designed to avoid any interruption in the operation of your business; whatever problems occur, the information must be accessible (implementation of a downgraded mode, back-up network, etc.).
The BCP takes the form of an action plan, implemented by your IT Department or with the help of an external service provider. The measures it provides for will ensure the continuity of a company's critical business activities and processes, without any loss of data or disruption to operations. It covers a range of responses relating to
- backup: incremental or differential, local or cloud (private cloud, public cloud or hybrid cloud) ;
- the shield formed by your anti-virus, anti-spam and firewalls to protect the company's business software and data;
- your suppliers: service providers, hosting companies, etc. In the event of failure, what guarantees do you have? In terms of insurance? In terms of accessibility? Are they committed to high availability of your data? Do they offer facilities management or IaaS (Infrastructure as a Service)?
- ISO 22301, which provides a framework for best practice in this area.
There are three stages to implementing a business continuity plan:
- identify the business continuity requirements ;
- establish the document base defining all the continuity procedures;
- Regularly test your BCP to correct any shortcomings or inconsistencies.
A BCP enables you to anticipate and minimise the legal, financial and image impact of a disaster affecting your business.
What is a Disaster Recovery Plan?
The Disaster Recovery Plan (DRP) can be implemented as part of a BCP or independently. In all cases, it sets out the steps to be taken in the event of an incident, so that IT activities can be resumed as quickly as possible, either in a degraded mode or at full capacity.
When a short outage can be envisaged, the DRP is adapted. It involves defining the maximum acceptable downtime and the maximum tolerable data loss. In particular, it enables the company's IS to be switched over to a backup system.
The aim of the DRP is to respond to a risk with long-term repercussions. It specifies how the company will be able to resume normal operations, ensuring that the restart is as orderly and rapid as possible.
A simple backup does not make a good DRP! It can include :
- the presence of backup sites
- data redundancy between datacentres;
- parameters for restarting applications or machines.
[Objectives] Why implement a BCP or DRP?
Is your company concerned by BCP and DRP?
Cybersecurity issues
In the age of cloud computing virtualisation, we all know the scale that a cyber attack can take.
93% of businesses were victims of attempted fraud in 2016.
This figure shows the intensity of the threat. Hacking is protean: viruses, spyware, Trojan horses... Whatever the operating system used, no one is immune.
The tip of the iceberg
Hacking can be used for identity theft, ransomware, theft by transfer of funds or industrial espionage. These practices have a direct impact on a company's image, competitiveness and finances.
Deeper impacts
Collateral damage that is less quantifiable, but just as damaging, is the cessation of service due to your activity. When the IT infrastructure crashes, employees no longer have access to their work tools. And the clock is ticking: a deadweight loss for the company.
What kind of risks does your company face?
More generally, different kinds of serious crises can affect a company's information system and jeopardise the continuity of its business:
- external IT threats such as a cyber-attack, virus, server theft, etc. ;
- an operating error
- hardware or IT failure
- network or infrastructure problems
- a prolonged power cut;
- natural disasters such as floods, fires, storms, etc.
Whatever the size of your business, it is undoubtedly exposed to some of these risks.
The infographic below reveals the risks of fraud and intrusions into companies' IT systems in France. The figures are based on the results of a survey of 150 finance departments conducted jointly by Euler Hermes (credit insurance) and the DFCG (national association of finance and management control directors).
Cascading effects
The disaster scenario
Imagine that your ERP (Enterprise Resource Planning), your CRM (Customer Relationship Management), your EDM (Electronic Document Management) or even your DB (Database) became inaccessible. What would happen? The IT department would be on pins and needles, looking for a solution and carrying out rapid repairs.
Long-term consequences
The breakdown would eventually be resolved. However, some information could be permanently lost - emails, customer data or order forms, for example.
The consequences would be felt over time. These types of collateral damage are so diverse and far-reaching that they are difficult to assess in their entirety. They can include :
- financial fallout (if key business activities are forced to shut down),
- consequences for brand image and customer satisfaction,
- impacts on the company's internal operations,
- legal consequences, etc.
The organisation is faced with operational difficulties in addition to its day-to-day challenges: in fact, 80% of companies that suffer a major IT disaster close down within two years.
The essential aim of implementing a BCP or DRP is to limit the damage that can be caused by a business interruption and to ensure the continuity or resumption of the company's activity.
Below, we'll look at how to protect your business and how to arm yourself to safeguard your business thanks to the DRP and the BCP.
[In practice] How do you set up a BCP or DRP?
Prerequisites
The plan must describe the resources to be deployed and the procedures to be followed in the event of an incident, in the same way as a crisis unit.
The company must ensure that the process of implementing a BCP or DRP is entrusted to people or entities with technical expertise and real experience in the field. To this end, the process can be undertaken internally if the required skills exist within the teams, or by a specialist service provider.
The stages
The first step in implementing a BCP or DRP is to take stock of the situation. Questions raised upstream will help to identify the company's vulnerability, the type of situation it may face and the response to be made (continuing operations, calling on external support, etc.). The following steps can be taken:
- analyse requirements in terms of data availability and critical processes ;
- Draw up a classification of the company's information and assets;
- Study the risks to which the information system is exposed;
- draw up the Business Continuity Plan or Disaster Recovery Plan;
- Define the processes for steering and managing the potential crisis;
- organising and monitoring test phases.
Best practice
Assessing the risk
Measuring the risk associated with the loss of your information assets means calculating the cost. It depends on the extent of your IT assets and the practices that surround them.
Carry out an exhaustive analysis and raise awareness
Do your employees consult work-related data on their personal computer terminals: smartphone, tablet, computer? This is known as BYOD (Bring Your Own Device), a practice that is becoming increasingly common.
If this is the case in your company, you need to extend your security measures to cover it. Habits also need to be carefully considered. The use of USB keys, for example, or the ability to recognise a risk of phishing.
This is also where we need to work: training people so that the organisation protects itself, both individually and collectively.
Prevention AND cure
Taking action means trying to prevent an incident from happening. It also means knowing what to do if the worst happens. You need to anticipate the different types of incident.
They can be IT or hardware-related: a fire that melts down your IT servers; a flood that renders your IT circuits unusable; etc. [Tools].
[Tools] Reliable solutions for securing your data!
To put in place a comprehensive business continuity plan, your company needs to be able to rely on a reliable backup solution. There are various software packages available, such as Trust2Cloud or Beemo Data Safe Restore. Both of these solutions provide your company with a networked storage box, known as a NAS (Network Attached Storage), for faster system recovery in the event of an incident.
Here is a selection of other tools that can help you implement a BCP or Disaster Recovery Plan.
BeBackup, a solution for everyone
BeBackup software is aimed at IT service providers, enabling them to manage a Cloud backup service for their customers. Regardless of the type of hosting chosen (at the service provider's premises, and/or in a datacenter, and/or at the customer's premises), the solution offers a very high level of security. You can choose any type of backup infrastructure, depending on the level of security required by your customers.
The strengths of BeBackup :
- An ultra-secure solution thanks to source encryption (on the agent side) of the backed-up data;
- Optimised backup with intelligent server-side tasks (data control, deduplication, replication, etc.);
- A web console for centralised management of all your data;
- Attractive prices.
BeBackup
UCover by Nuabee, disaster recovery in the cloud
UCover by Nuabee is a fully managed Disaster Recovery Plan solution that automates the DRP process. More than just a backup solution, UCover by Nuabee ensures the recovery of IT activities for SMEs and SMBs in the event of an incident or disaster, with the possibility of restarting critical applications within a few hours.
Their IT infrastructure is modelled in their databases, and when a DRP is executed, the infrastructure is automatically rebuilt and recovered. The solution also enables the restoration of IT environments in the public cloud to be regularly tested and monitored. A major advantage: internal IT resources are not impacted during the test phases.
The strengths of UCover by Nuabee :
- A reliable solution thanks to its 100% industrialised model, which means that tests can be run on a very regular basis;
- No impact on the original IT infrastructure, so no disruption to users' work during test execution;
- Choice of backup method: agent-based or agentless (via hypervisor), depending on the most relevant application for your servers, with a hybrid approach possible.
UCover by Nuabee
vSphere, virtualisation for the hybrid cloud
vSphere is a server virtualisation platform and the heart of a Software Defined Datacenter (SDDC), also known as a "virtual datacenter". This is an IT infrastructure that is reconstituted on the web and can be managed virtually and automatically using software. vSphere was designed for businesses that want to maximise their IT resources by consolidating and optimising their applications.
As part of a BCP or DRP, the solution helps to reduce the cost and complexity of disaster recovery and business continuity operations, thanks to always-available IT functionality and agile implementation.
The strengths of vSphere :
- Market leader in virtualisation;
- Reduced hardware and IT costs;
- Multi-level protection against service interruptions and data loss.
vSphere
Protect your business - call in the experts!
The aim of a business continuity plan is to do everything possible to keep your business running. By assessing the risks of data loss or service disruption, you are in a position to deploy measures to protect your business.
By implementing a BCP or DRP, you give yourself the means to limit any damage to your information system through precise organisation and procedures to reduce the impact. The choice of your recovery plan depends on the criticality of your IT capabilities: you will opt for a BCP if their continued maintenance is essential to the survival of your organisation or, if a gradual resumption of your activities is conceivable after a service outage, you will implement a DRP strategy.
In all cases, the process of implementing business continuity or recovery is complex and sophisticated. It will have to be entrusted to competent in-house resources or outsourced to service providers with the requisite expertise.
What about you? Are your information systems prepared for the consequences of a potentially damaging event for your business? What have you put in place, or are you planning to put in place, in terms of business continuity or recovery?
Updated article, originally published in May 2017.
Article translated from French