Business continuity is the continuation of business operations in the event of an interruption to the “normal” means of conducting business.  The interruption could be the loss of computer systems due to natural disaster or cyber attack, loss of a facility due to fire or natural disaster, or even the ability to gather everyone in the same location due to a pandemic.

A business continuity plan (BCP) lays out how to continue to conduct business in the event of such an interruption.

They want to be sure that if there is an interruption to your business that you can recover and continue to offer service to them as their business processes will be relying on the use of your service.

They may ask for a copy of the Business Continuity Plan. Additionally, they may request to see the results or report from business continuity exercises whether they be full exercises or tabletop exercises.  These reports will give an indication of the ability to recover in the event of an interruption to your business.

Disaster Recovery is the process of planning for the possibility of a major system failure and the recovery from such an event. Such an event may involve a major component failure or the complete destruction of the data center housing the assets.  Recovery may be partial recovery, recovery of the whole system in a capacity limited, or complete recovery at full capacity at an alternate site.

Customers may rely on the system as part of their business operations and downtime will impact their ability to conduct business, therefore, impacting the company’s revenue.  They need to be assured that there is a plan to recover the system, in a timely manner.

They may ask for a copy of the Disaster Recovery Plan, which should include the Recovery Point Objective (RPO) and Recovery Time Objective (RTO).  This information will tell them how much data may be lost and how long the business will be interrupted.  Additionally, they may request to see the results or report from disaster recovery exercises, whether full recovery exercises or tabletop exercises.  These reports will give an indication of the ability to meet the objectives in the Disaster Recovery Plan.