When performing walkthroughs and interviews during our audits, organizations often ask what the difference is between BCP, DRP, and BCDR.
A business continuity plan (BCP)
Primarily focused on the recovery of business operations to help ensure that essential business functions and key processes can be recovered in the event of a disaster.
Common components include the steps required to keep business operating, key employee contact information, relocation of personnel, and backup site details.
A disaster recovery plan (DRP)
Primarily focused on the recovery of information technology systems that are used to support business operations.
Common processes would include recovery of systems, data and network restoration to allow the organization to resume operations.
A business continuity / disaster recovery (BCDR)
Given how closely BCP and DRP are aligned, organizations commonly combine them into a single business continuity / disaster recovery (BCDR) plan that addresses the recovery of both business operations and information technology.
Whether taking a combined approach or a stand-alone approach, plans should be tested and updated at a minimum of annually or more frequently when significant changes are made to the environment.
About STEPHEN HALBROOK
Stephen Halbrook is a Managing Principal at Schellman. He is an experienced and proven federal practice leader performing service delivery management across service lines including FedRAMP, NIST, SOC, PCI DSS and ISO. Stephen also helps assist large and complex organizations that have multiple compliances needs helping them strategically align their efforts to maximize cost and efficiencies. He has more than 15 years of experience in the assessment industry and started his career working in Deloitte’s Advisory practice.