Why Standard Backups Aren't Enough Anymore

What Is BCDR?

BCDR (business continuity and disaster recovery) is the combined plan that keeps a business operating during a disruption and restores its IT systems and data afterwards. Business continuity covers people, processes and communication; disaster recovery covers the technical restoration of systems, applications and data.

The RTO and RPO Equation

Many businesses believe they are protected because they back up their data to the cloud every night. But having the data and actually being able to use it are two completely different things.

A true BCDR strategy is defined by two critical metrics:

• Recovery Point Objective (RPO): How much data are you willing to lose? If you only back up at midnight, a server crash at 4:00 PM means you lose 16 hours of work.
• Recovery Time Objective (RTO): How long can your business afford to be offline? If you have to order a new server, install an OS, and download 5 terabytes of data from a cloud backup, your RTO is measured in days or weeks.

Real-World Scenario: The Hardware Catastrophe

Instantaneous Cloud Failover

What happens if the entire office building floods or burns down, destroying both the primary server and the local BCDR appliance?

Modern BCDR solutions replicate every local snapshot to a secure, geographically distant data center. In the event of a total site disaster, your IT provider can spin up your entire server infrastructure within the cloud, allowing your team to access their critical applications securely from home via VPN while a new physical office is secured.

RTO and RPO Explained

Two numbers drive every BCDR plan:

• Recovery Time Objective (RTO): the maximum time a system can be unavailable before the impact becomes unacceptable. An RTO of 4 hours means the system must be running again within 4 hours.
• Recovery Point Objective (RPO): the maximum amount of data you can afford to lose, measured in time. An RPO of 1 hour means backups or replication must run at least hourly.

Lower RTOs and RPOs cost more to achieve, so set them per system based on business impact rather than applying one target to everything.

How to Build a BCDR Plan in 6 Steps

1. Business impact analysis. List your critical business functions, the systems they depend on and the cost of each hour of downtime.
2. Risk assessment. Identify likely threats: ransomware, hardware failure, cloud outages, power loss, flooding or loss of key staff.
3. Set RTOs and RPOs for each system based on the impact analysis.
4. Design the recovery strategy. Choose backup, replication and failover technology that meets those targets, including at least one immutable copy.
5. Document the plan. Record roles, contact details, step-by-step recovery runbooks and communication templates for staff, customers and regulators.
6. Test and update. Run tabletop exercises and real restore tests at least annually, and update the plan whenever systems or people change.

Cloud Disaster Recovery (DRaaS)

Disaster Recovery as a Service replicates your servers to a cloud platform such as Azure or AWS, so they can be started there if your primary environment fails. It removes the need for a second physical data centre and lets SMEs achieve recovery times that once required enterprise budgets. See our cloud migration cost guide for typical cloud pricing considerations.

BCDR Testing: The Step Most Businesses Skip

An untested plan usually fails at the worst moment: passwords are missing, runbooks are out of date or backups turn out to be incomplete. Schedule:

• Quarterly restore tests of individual files and systems.
• Annual full failover or tabletop exercises with leadership.
• After every major change, such as a new system, a migration or key staff leaving.

BCDR and Compliance

Business continuity is a requirement in ISO 27001 (information security aspects of business continuity) and is expected by regulators, insurers and enterprise customers during supplier due diligence. A documented, tested BCDR plan is also your strongest defence against ransomware.