Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Information Systems

Business Continuity and Disaster Recovery Explained

Updated 11 October 2026 · Fact-checked

A **Business Continuity Plan (BCP)** keeps critical business functions running during and after a disruption. A **Disaster Recovery Plan (DRP)** is a part of it that restores IT systems and data. To answer a question, state the meaning, link it to risk and impact analysis, then cover backups, recovery sites, roles and testing.

Understand Business Continuity and Disaster Recovery

Every business depends on information systems. If a server fails, a fire hits the data centre, or ransomware locks your files, work stops. Business continuity and disaster recovery are the planning tools that limit this damage.

Business continuity planning (BCP) is the wider plan. It covers people, premises, processes, suppliers and technology. Its aim is to keep critical services running, or restore them quickly, when something goes wrong. A BCP answers: who does what, from where, and with which resources?

Disaster recovery planning (DRP) is narrower. It deals with restoring IT infrastructure, applications and data after a disaster. So DRP is a component of BCP, not a substitute for it. A company can recover its servers perfectly and still fail if staff have no place to work or customers are not informed.

Both plans start with a risk assessment and a Business Impact Analysis (BIA). The BIA identifies critical functions, how long each can be down, and how much data loss is tolerable. These limits are expressed as the Recovery Time Objective (RTO) and Recovery Point Objective (RPO). They decide which backup method and recovery site you choose.

A plan on paper is not enough. It must be approved by senior management, communicated to staff, tested regularly, and updated when systems, people or risks change. For a company secretary, this is a governance and compliance matter: the board should oversee it, and it supports security obligations under the IT Act and sector rules.

Key rules to remember

RTO (Recovery Time Objective): RTO = maximum acceptable time between disruption and restoration of the service; Shorter RTO means a faster, costlier recovery solution such as a hot site.
RPO (Recovery Point Objective): RPO = maximum acceptable data loss measured in time since the last good backup; An RPO of 4 hours means backups or replication must happen at least every 4 hours.
Relationship of DRP to BCP: BCP ⊃ DRP (DRP is a subset of BCP); BCP covers the whole business. DRP covers IT recovery only.
Recovery site ladder: Hot site (fastest, costliest) > Warm site > Cold site (slowest, cheapest); Choose the site by matching RTO and budget. Mirror sites are even faster than hot sites.
Backup types: Full = all data; Incremental = changes since the last backup of any type; Differential = changes since the last full backup; Restore needs: full only; full + all incrementals in order; full + latest differential.
BCP life cycle: Risk assessment → BIA → strategy → plan development → testing → maintenance; Use this sequence as your answer skeleton.

How to solve Business Continuity and Disaster Recovery questions

Use this order for any theory or case question on BCP and DRP. It gives you provision, analysis and conclusion in one flow.

1Define the term asked (BCP, DRP, backup or recovery site) in one or two lines, and state how BCP and DRP relate.
2Say why it matters for the company in the question: dependence on IT, cost of downtime, legal and customer obligations.
3Start the process with risk assessment and BIA. Name the critical functions and fix the RTO and RPO.
4Match the facts to a strategy: backup type, storage location (on-site, off-site, cloud) and recovery site (hot, warm, cold).
5Add people and process points: response team, roles, communication plan, alternate work location, vendor contacts.
6Cover testing and maintenance: walkthroughs, simulations, full failover tests, review after each test or change.
7Close with governance: board or management approval, documentation, training and a clear conclusion tied to the facts.

Quickest way: R-B-S-T method: Requirements, Backup, Site, Test

When to use it: Use it when time is short or the question says 'discuss', 'advise' or 'prepare a plan' without giving much detail.

Requirements: state BIA, RTO and RPO in two lines.
Backup: pick the backup type and frequency that meets the RPO, and keep a copy off-site.
Site: pick hot, warm or cold based on the RTO and budget, and justify it in one line.
Test: end with testing, training and periodic updates, plus management approval.

Common mistakes in Business Continuity and Disaster Recovery

Treating BCP and DRP as the same thing.
Both deal with disruptions and the terms are often used together.
Fix: Write that DRP is the IT recovery part of the wider BCP. BCP covers people, premises, processes and technology.
Mixing up hot, warm and cold sites.
Students memorise names but not what is pre-installed at each.
Fix: Hot: equipment, software and near-current data ready. Warm: equipment ready, but data and some software must be loaded. Cold: only space and basic utilities.
Skipping the Business Impact Analysis.
Students jump straight to backups and sites.
Fix: Always begin with risk assessment and BIA. RTO and RPO come from it and drive every later choice.
Confusing RTO with RPO.
Both are time measures and look alike.
Fix: RTO is how long you can be down. RPO is how much data you can lose. Remember: Time to restore versus Point to restore to.
Storing backups only at the main site.
Backups feel safe because they exist.
Fix: Keep at least one copy off-site or in the cloud, away from the same fire, flood or attack. Also test restores.
Ending the answer without testing and updating.
Students treat the plan as a one-time document.
Fix: Add testing, training and review as the last step. An untested plan may fail when needed.

Worked examples

Example 1

Distinguish between a Business Continuity Plan and a Disaster Recovery Plan. Explain with an example of an Indian online retailer.

Show the solution

Define BCP: a plan to keep critical business functions running during and after a disruption, covering people, premises, processes and technology.
Define DRP: a plan to restore IT systems, applications and data after a disaster. It is part of the BCP.
Compare scope: BCP is organisation-wide. DRP is limited to technology.
Compare focus: BCP aims at continuity of operations. DRP aims at recovery of systems and data.
Compare timing: BCP works before, during and after an event. DRP mainly acts after the system failure.
Apply the example: suppose a flood hits the Mumbai office of an online retailer. The BCP moves customer service staff to a Pune office, informs customers and uses a manual order process. The DRP restores the order database and website from backups at the recovery site.

Answer: A BCP keeps the whole business operating through a disruption. A DRP is the narrower IT part that restores systems and data. In the retailer's case, shifting staff and informing customers is BCP, and restoring the order database and website is DRP.

Example 2

Sunrise Finserv Ltd, an NBFC, must be able to restore its loan processing system within 2 hours. It can lose at most 30 minutes of transactions. The board has a moderate budget. Advise on backup and recovery site strategy.

Show the solution

Identify objectives: RTO is 2 hours and RPO is 30 minutes.
Apply the RPO: backups once a day cannot meet 30 minutes. Use continuous or near-real-time replication of data to the recovery site, or very frequent incremental backups at intervals of 30 minutes or less.
Apply the RTO: a cold site needs time to buy or install equipment, so it cannot restore in 2 hours. A warm site may do so if equipment is ready and data is replicated. A hot site is the safest fit.
Consider budget: a hot site is costly. Since the RTO is tight but the budget is moderate, recommend a warm site with replicated data only if testing proves the 2-hour restore. Otherwise, use a hot site for the loan system alone.
Keep a backup copy at a geographically separate location or in a secure cloud, so one event does not destroy both copies.
Add governance: board-approved DRP, named recovery team, vendor contacts, and at least periodic failover tests with review of results.

Answer: Use near-real-time replication or backups every 30 minutes or less to meet the RPO. Use a hot site, or a tested warm site with replicated data, to meet the 2-hour RTO. A cold site is unsuitable. Keep an off-site copy, and test the plan regularly.

Exam tips

Draw the BCP and DRP relationship clearly. Examiners reward the point that DRP is a subset of BCP.
In case questions, calculate or state RTO and RPO from the facts first, then choose the site and backup method.
Learn hot, warm and cold sites as a short comparison: readiness, recovery time, cost. Add mirror sites for a bonus point.
End every answer with testing, training and updating, plus management or board approval.
Use short headings and bullet points in a 3-hour descriptive paper. They make the plan easy to read and mark.

Practice questions from Information Systems

Business Continuity and Disaster Recovery in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Business Continuity and Disaster Recovery: frequently asked questions

What is the difference between a business continuity plan and a disaster recovery plan?

A business continuity plan keeps the whole business running during a disruption. It covers people, premises, processes and technology. A disaster recovery plan is part of it and focuses only on restoring IT systems and data.

What is the difference between hot, warm and cold sites?

A hot site has equipment, software and near-current data ready, so recovery is fastest and costliest. A warm site has equipment but needs data or software loaded. A cold site offers only space and utilities, so it is cheapest and slowest.

How do I prepare a disaster recovery plan?

Start with a risk assessment and business impact analysis, and set RTO and RPO. Then choose backup methods and a recovery site, assign roles, document the steps, and test the plan. Review it whenever systems or risks change.

What are RTO and RPO?

RTO is the longest time a service can stay down. RPO is the longest period of data loss you can accept, measured back from the disruption. Both come from the business impact analysis.