Response Operations: BCP, IRP, and DRP - Why You Need all Three

No well-managed organization is immune to the risk of the potential business interruptions that may occur from time to time, whether caused by acts of nature, malicious attack, or simple human error. Depending on the severity of the interruption and the organizational assets and business units that may be affected, one of three internally developed response programs should be put into effect: A Disaster Recovery Plan, Incident Response Plan, or Business Continuity Plan. These program titles are often-times used interchangeably by organizations, and while they do share some overlap in functionality or requirements, they are not the same. It is important to understand why each one is developed and the correct situation in which to activate them. Establishing and activating the right plan at the right time can make all the difference in an organization's ability to recover from an event of any kind.

Disaster Recovery

Disaster Recovery is a key component of most organization's business processes. The Disaster Recovery plan is generally developed by senior leadership with large amounts of critical input provided by the Information Technology and Information Security teams and personnel. With an emphasis on technology assets and redundancy operations, Disaster Recovery Plans will usually be activated when a loss of infrastructure or data has, or is likely to occur, and is authorized for activation by crisis management, or another similarly structured team. Procedures on how to recover purged or corrupted information from previous backups and archives, such as, power restoration instructions for electrical failures, details regarding parallel technology infrastructure spin-up, or high availability and automatic failover technology asset configurations are all likely to be documented and updated on an annual basis and incorporated into the Disaster Recovery Plan.

Incident Response

With cyber threats becoming more frequent, intelligent, and prevalent, it is the responsibility of an organization to develop a comprehensive solution to combat them in a proactive way. Sometimes, however, proactivity does not always prevent a threat from causing its intended damage. For these situations, where edge security and personnel awareness have failed, an Incident Response Plan is the most relevant and effective program to activate. Like the Disaster Recovery Plan, the Incident Response Plan is often-times established by senior leadership but influenced more by information security, forensic, and cybersecurity. Determining the source, vector, and target of an attack on internal systems is paramount to identifying the correct course of action to take after an incident has been identified. Incidents can be observed and reported by anyone in the organization, however, like with Disaster Recovery operations, Incident Response Procedures must be enforced by the crisis management team or incident response team. An incident is best described as any situation, occurrence, or anomaly that may have an adverse impact on the security or confidentiality of protected information, assets, or business processes.

Business Continuity

To top off this list of programs we have the one plan to rule them all: The Business Continuity Plan, or BCP. Key facets of Disaster Recovery and Incident Response can be found or referenced within a BCP. Since a BCP is designed to issue guidance on the key components, objectives, and processes around continued operations during a business interruption, it is most frequently used as a blanket response plan for most types of events that can occur, which is not the correct course of action. A BCP requires extensive analysis of business objectives and tolerances, such as a Business Impact Analysis. It is developed by key executive teams and almost always requires their consent and authorization to activate, and strict adherence to the procedures established within it to ensure the most cost-effective continuance of operations. All facets of the organization are included in a BCP from the smallest internal business units, to partner, stakeholders, and vendors which makes the value and necessity of the plan immeasurable when it is needed.

Operational Response Plans are developed differently for each organization. There is no magical blend of resources, assets, and prerequisites to creating effective programs. Understanding the organizations budget restraints, workforce skillsets, and technological capabilities will help balance the requirements and guide the plan development process. Having the knowledge and awareness to react accordingly utilizing the appropriate response plan is just as important as the creation of the plan itself. Learning to be objective but flexible with resources and build response plans that do not overextend the capabilities or resources of the organization, will provide the most efficient and rewarding outcomes in any situation.