4.4Disaster recovery and business continuity

No matter how firmly you defend, a disaster, failure, or attack can bring things to a "stop." What matters is deciding in advance how fast and how far you can restore afterward. This section covers the difference between a DRP (disaster recovery plan), focused on procedures to restore IT systems, and a BCP (business continuity plan), the broader plan to keep the whole business running; RTO (the target recovery time) and RPO (the tolerable amount of data loss); the underlying backups; and the three kinds of DR controls—detective, preventive, and corrective—learned through the lens of designing "how to recover after a stoppage."

4.4.1DRP vs. BCP, RTO vs. RPO

• DRP (Disaster Recovery Plan) is a plan focused on the procedures to restore IT systems—servers, data, networks. It concretely defines "how to bring broken systems back" and is the more technically oriented plan.
• BCP (Business Continuity Plan) is the broader plan to keep the whole business running or resume it quickly during a disaster. It covers not just IT recovery but alternate sites, staffing, business procedures, and communication. Grasp that a DRP is part of a BCP (its IT portion).
• RTO (Recovery Time Objective) is the target for how fast to recover (e.g., restore within 4 hours). RPO (Recovery Point Objective) is the point you can roll back to = the tolerable amount of data loss (e.g., losing up to the last hour is acceptable). RTO sets "time," RPO sets "how far back in data."

4.4.2Backups and the three DR controls

• Backups are copies of data taken in advance so you can restore after corruption or loss. Meeting the RPO hinges on backup frequency (hourly backups cap loss at one hour). Generation management and off-site storage guard against simultaneous damage and overwrites.
• DR controls split into three by purpose: preventive—make incidents less likely in the first place (redundancy, UPS, regular backups); detective—notice an anomaly or failure (monitoring, alerts, logs); and corrective—restore after an incident (restoring from backup, failover, executing recovery procedures).

Late at night, the server hosting the core order-taking system fails and stops. Whether you can act without panic depends on whether you prepared a BCP and a DRP in advance. From the whole-business view (BCP), to keep taking orders while the system is down, business-level continuity measures kick in, such as switching to an alternate procedure of taking orders by phone or email. In parallel, following the concrete IT-recovery steps (the DRP), you work to restore the server. Two target values guide this recovery. The RTO is "within how many hours to recover"—if you set it at four hours, you decide to switch to a standby machine (failover) when you are about to exceed it. The RPO is "the point you can roll back to = how much data loss you tolerate"—if you take backups hourly, the loss is capped at the last hour of order data. It is essential not to swap the difference: RTO is time, RPO is how far back in data. Furthermore, this whole response can be organized by the three DR controls. Noticing the failure via a monitoring alert is a detective control; routinely making it less likely / less damaging through redundancy, a UPS, and regular backups is a preventive control; and restoring via backup recovery or failover is a corrective control. At the introductory stage, accurately holding these three pairs of distinctions—"DRP (IT) vs. BCP (whole business)," "RTO (time) vs. RPO (data)," and "preventive/detective/corrective"—is the foundation for recovering calmly after a stoppage.

4.4.3Section summary

• A DRP specializes in IT recovery procedures; a BCP is the broader whole-business continuity plan, and the DRP is part of the BCP
• RTO is the target time to recover; RPO is the tolerable data loss (set by backup frequency)—do not swap them
• DR controls are organized into three: preventive (make less likely), detective (notice), and corrective (restore)