2.5Business Continuity Management

Even when a natural disaster (earthquake, flood), a system failure, or a large-scale cyberattack occurs, an organization cannot afford to halt its critical operations. The activity of planning in advance "which operations must be restored, within how much time, and to what point in time" is called business continuity management. The goal of this section is to precisely understand the difference between the two target metrics--recovery time objective (RTO) and recovery point objective (RPO)--and translate them into disaster countermeasures and backup strategy.

2.5.1BCP and BCM

• BCP (Business Continuity Plan) is the plan itself (a document) that defines how to continue or restore critical operations when an emergency such as a disaster or accident occurs. It includes the selection of operations to prioritize continuing, recovery targets, and response procedures.
• BCM (Business Continuity Management) is the whole management activity, not just formulating a BCP, of continuously conducting drills, education, and review. The distinction is that a BCP is "the plan (document) itself," whereas BCM is the PDCA-like ongoing activity spanning formulation through drills and maintenance/improvement. It is important not to stop at writing a BCP, but to verify its effectiveness through regular drills.

2.5.2RTO and RPO

• RTO (Recovery Time Objective) is the target for how much time, after operations stop, they must be restored within (for example, "the core system has an RTO of 4 hours"). The shorter the RTO, the more immediate a recovery mechanism is needed (such as an always-on standby system), and this generally costs more.
• RPO (Recovery Point Objective) is the target for the point in time to which data must be restored (for example, "an RPO of 1 hour means recovery is possible to a state at most 1 hour before the failure occurred"). The shorter the RPO, the more frequent backup or replication is needed, and this likewise costs more.
• The key distinction between RTO and RPO is the difference in axis: RTO is the target for "time" (how quickly), while RPO is the target for "data recency" (how far back recovery goes). Shortening RTO does not shorten RPO if backup frequency stays low, and conversely shortening RPO does not shorten RTO if the recovery work itself still takes time. The two must be considered and set independently.

2.5.3Disaster countermeasures and backup strategy

• Disaster countermeasures are measures--securing a geographically separate alternate site (a backup site) and redundancy (duplication) of systems and network lines--that prevent a failure at a single site or single piece of equipment from directly halting the whole business. Alternate sites are categorized as cold/warm/hot sites by their readiness state in normal times; the higher the readiness, the faster the switchover but the higher the maintenance cost.
• Full backup duplicates all data every time. Recovery is fastest, but taking the backup requires more time and capacity. Differential backup duplicates all data changed since the most recent full backup. Incremental backup duplicates only data changed since the immediately preceding backup (full or incremental)--the lightest to take, but recovery requires applying the full backup plus multiple generations of incrementals in sequence, making the procedure more complex.
• The 3-2-1 rule is the basic backup principle: keep 3 copies of the data (the original plus 2 copies), store them on 2 or more different types of media, and keep 1 of them offsite (at a remote location). If copies are kept only at the same site and on the same medium, a disaster striking that site itself--a fire, an earthquake--would destroy the backups along with everything else, which is why offsite storage is indispensable.

Take a manufacturer's core order-processing system as an example of the thinking behind formulating a BCP. In considering business continuity, management and the business department first discussed the matter and, given that "a stoppage of the order-processing system would cause a loss of business opportunity on the order of tens of millions of yen per day," set an RTO of 4 hours (resume operations within 4 hours) and an RPO of 15 minutes (recovery to a state at most 15 minutes before the failure is sufficient) for this system. Achieving the RTO-4-hour target requires having an alternate site (with readiness at least at the warm-site level) prepared in advance, capable of switching over within 4 hours even if a single data center fails. Achieving the RPO-15-minute target, meanwhile, requires a mechanism of near-real-time data replication at 15-minute intervals to another site, since a once-daily full backup alone would leave up to 24 hours of data loss risk. What matters here is that RTO and RPO are independent targets: preparing an alternate site alone does not shorten RPO, and setting up replication alone does not shorten RTO. Satisfying both requires separately designing and then combining the switchover procedure to the alternate site (an RTO measure) and the frequent data-replication mechanism (an RPO measure). For the backup method, given capacity and cost constraints, the company adopted daily full backups plus hourly incremental backups during business hours. Because recovery then requires applying the previous day's full backup followed by the day's incrementals in chronological order, a runbook is prepared to avoid mistakes in generation management and application order for the incrementals. Furthermore, following the 3-2-1 rule, the backup data is kept in three locations: on-premises storage (the original), tape media (a second medium type), and geographically separate cloud storage (a third, offsite copy). Effectiveness for the BCP formulated this way is secured only by running the BCM cycle: once a year, actually conducting a drill of switching the system over to the alternate site, verifying whether the RTO-4-hour and RPO-15-minute targets are met as expected, and revising the procedure if they are not--rather than treating the BCP as finished once written.

2.5.4Section summary

• BCP is the plan (document) itself; BCM is the ongoing management spanning formulation through drills and maintenance/improvement
• RTO is the target for time until recovery; RPO is the target for how far back recovery can go. The two axes differ and both must be set independently
• Backups use full/differential/incremental by purpose, and the 3-2-1 rule (3 copies, 2 media, 1 offsite) guards against a site-wide failure