When something goes wrong such as a ransomware attack, a server failure, a flood, a power cut, most businesses reach for two terms in the same breath, disaster recovery and business continuity.
They're closely related, but they're not interchangeable and knowing the difference matters when you're deciding what to plan, test and invest in.
Disaster recovery (DR) is about restoring your IT systems and data after an incident. Business continuity (BC) is about keeping your whole organisation, people, processes and technology running during and after that same incident. DR is a critical part of BC, not a replacement for it.
This insight breaks down what each term actually means, how they differ, where they overlap and how to bring them together into one resilience strategy.
What is disaster recovery?
Disaster recovery relates to the policies, technology and services an organisation uses to restore its IT systems, applications and data after a disruptive event. It's a technical, IT-focused discipline built around two key measures, your recovery time objective (RTO), how quickly systems need to be back online and your recovery point objective (RPO), how much data you can afford to lose. We've covered both in detail in our guide to RTO vs RPO.
Modern disaster recovery covers far more than fires and floods. The most common triggers today are cyber attacks, ransomware, cloud outages, hardware failure and human error and a good DR plan needs to account for all of them. Our 10-step disaster recovery plan checklist and our disaster recovery (IT and data) services page go into more depth on building and delivering a plan that covers these risks.
What is business continuity
Business continuity is the ability of an organisation to keep operating during and after a disruptive incident and it covers far more ground than IT alone. It takes in people (do your staff have somewhere to work if your office is unavailable?), processes (can your teams still deliver services to customers?), suppliers, communications and compliance, as well as technology.
Where disaster recovery answers “how do we get our systems back?”, business continuity answers “how do we keep the business running while that happens, and afterwards?”.
Our business continuity services page sets out the full picture and it's worth reading our business continuity myth busting blog before you rely on a plan you haven't reviewed recently, five common misconceptions could be leaving you exposed.
Disaster recovery vs business continuity
The easiest way to think about it, business continuity is the strategy and disaster recovery is one of the tools that delivers it.
- Business continuity is strategic and organisation-wide. It's concerned with keeping critical products and services running at an acceptable level, whatever happens.
- Disaster recovery is tactical and technology-focused. It's concerned with restoring the IT systems and data that the wider business depends on.
Disaster recovery sits inside business continuity planning, not alongside it. A business can have a disaster recovery plan without a wider business continuity plan and be exposed everywhere else but it's very hard to have a credible business continuity plan without disaster recovery underpinning it.
Our Why every business needs offline plans blog looks at exactly this gap in the context of cyber risk.
Disaster recovery vs business continuity at a glance
| Aspect | Disaster recovery | Business continuity |
| Primary focus | Restoring IT systems, applications and data. | Keeping the whole organisation operating. |
| Scope | IT and technology. | Products & services, people, processes, technology, suppliers, resources and premises. |
| Goal | Get systems and data back safely, in a defined time that is in accordance with business needs. | Maintain critical products and services at an acceptable level, minimise disruption and reputational damage. |
| Typically owned by | IT and technical teams. | Senior leadership, risk and operations. |
| Key measures | RTO, RPO | RTO, MTPD (maximum tolerable period of disruption), MBCO (minimum business continuity objective). |
| Typical triggers | Cyber attack, ransomware, server failure, cloud outage, hardware failure. | Any of the above, plus staff, supplier, premises or reputational disruption. In essence, any trigger that has the ability to disrupt normal operations and critical services. |
| Common related standards | ISO 27031, ISO 27001, ISO 27002, NIST SP 800-34, ITIL 4. | ISO 22301, ISO 22313, ISO 31000, ISO 22361, ISO 22317. |
| Relationship to the other | A tactical, technology-focused component of business continuity | The strategic umbrella that disaster recovery sits under |
Why you need both, not one or the other
A disaster recovery plan on its own can restore your servers and data, but it won't tell your staff where to work if your office floods, how to keep serving customers if your phone system fails or how to reassure regulators, insurers and clients that you're in control. A business continuity plan on its own can cover people and process, but without disaster recovery behind it, there's nothing to fall back on the moment the technology fails.
This is why our business continuity services bring the two together: disaster recovery for IT and data, work area recovery for your people, data protection to keep information safe wherever it lives, and operational resilience consultancy to help understand what is critical in your organisation and to pull it all into tested, governed plan(s).
The businesses that come through disruption well are the ones that treat disaster recovery and business continuity as one connected strategy rather than two separate projects. In our disaster recovery blog we note that a significant proportion of businesses never fully recover after a serious disaster and many still don't have an up-to-date, tested plan covering both angles.
Real-world example: when disaster recovery alone wasn't enough
In our business continuity myth busting guide, we share the story of a multinational finance customer that had almost cancelled its work area recovery contract, assuming home working covered the risk. A cyber attack on a third-party telephony provider took its entire IT infrastructure offline, including staff working from home via VPN and softphones. Because the business continuity plan included work area recovery as well as disaster recovery, critical staff were moved to a dedicated recovery centre and kept core customer service and finance functions running.
Disaster recovery alone would have restored the systems eventually, business continuity is what kept the business trading in the meantime.
We see the same principle play out across regulated sectors. Our work with Larking Gowen, a chartered accountancy firm who combined managed IT, cyber security and resilience-focused services to protect billable time and maintain compliance as the firm grew.
You can read more customer stories on our case studies hub, and hear directly from our customers on our customer feedback page.
How to build a combined disaster recovery and business continuity strategy
- Run a business impact analysis (BIA) to identify your critical systems, people and products/services/ processes and what happens if each one is unavailable.
- Set your recovery targets – RTO and RPO for your systems, and equivalent tolerances for people and premises. Our RTO vs RPO guide walks through how to set these correctly.
- Document both plans together, so your disaster recovery procedures and your wider business continuity plan reference each other rather than living in separate drawers.
- Put the right infrastructure in place – backup and replication, work area recovery, and where useful, business continuity management software to keep your plans accessible when you need them most.
- Test and rehearse regularly. An untested plan is an unreliable one, and testing is what turns a document into genuine operational readiness.
- Review after every significant change to your systems, people or suppliers. Our 10-step disaster recovery checklist is a good place to start.
Ready to bring disaster recovery and business continuity together?
Our business continuity services combine disaster recovery, work area recovery, data protection and operational resilience consultancy into one tested strategy. Talk to us to find out where your current plans stand.
Frequently asked questions
Is disaster recovery part of business continuity?
Yes. Disaster recovery is a technology-focused component of a wider business continuity plan. Business continuity covers the whole organisation; disaster recovery specifically covers restoring IT systems, applications and data.
Can you have business continuity without disaster recovery?
Not credibly. A business continuity plan that doesn't include a tested way to restore your IT systems and data has a significant gap, since almost every modern business process depends on technology in some way.
What's the difference between a business continuity plan and a disaster recovery plan?
A business continuity plan covers people, processes, suppliers, premises and technology, and sets out how the organisation keeps operating during disruption. A disaster recovery plan is narrower and more technical, focused specifically on restoring IT infrastructure, applications and data within defined time and data-loss targets.
How do RTO and RPO fit into business continuity?
RTO and RPO are disaster recovery measures that feed into business continuity planning. They tell the wider business how long it needs to operate without a given system, and how much data loss is tolerable, which shapes the rest of the continuity plan.
Do small and mid-sized businesses need both disaster recovery and business continuity?
Yes. Smaller organisations are often more exposed to disruption because they have fewer resources to absorb it. Both disciplines are scalable and can be tailored to the size and risk profile of the business.
