4.1IT service continuity management (ITSCM), BCP, and disaster recovery

For a service manager, service continuity is not about aiming to "never let anything go down." Preventing every possible failure is not cost-effective, so the essence is to work backward from business impact to decide "how much downtime and data loss to tolerate, and how much to spend on measures to achieve it." Grounded in the position of ITSCM—which handles IT recovery within the business-wide BCP—this section builds the judgment to choose recovery objectives (RTO/RPO/MTPD) and a recovery-site approach within the tradeoff between business impact and cost.

4.1.1The relationship between ITSCM and the BCP

• A BCP (business continuity plan) is the business-wide plan for restoring and continuing core business within a tolerable time when operations are interrupted by a disaster, system failure, pandemic, or the like. Its scope is not limited to IT; it includes staff, sites, the supply chain, and alternative means. ITSCM (IT service continuity management) is the service-management process that plans, prepares, and rehearses the recovery of IT services so as to meet the business recovery objectives set by that BCP. In other words, ITSCM is a part of the BCP: the BCP is the higher-level plan and ITSCM is subordinate to it.
• ITSCM is not a matter of "write a recovery plan and be done"; it is a continuous activity that includes periodic rehearsals and tests (actually switching over) and revising the plan to match business and system changes. If the plan does not reflect the latest system configuration, the recovery procedure will not work when it matters—eliminating the procedure obsolescence and overlooked dependencies that only surface in a rehearsal is what determines ITSCM's effectiveness.