Glossary
Business continuity
Business continuity is an organization's ability to keep delivering its essential products and services through a disruption and to return to normal operation afterward. It spans people, premises, suppliers and manual workarounds as well as technology, so disaster recovery of IT systems is one component of it rather than a synonym.
Four practices that are often confused
Continuity is the widest of four related practices. Each answers a different question, and a program that uses the terms interchangeably tends to fund one and assume the others are covered.
| Practice | Question it answers | Scope |
|---|---|---|
| Business continuity | Can the organization keep delivering during and after the event? | People, sites, suppliers, processes and IT |
| Disaster recovery | How are IT systems and data brought back after a site or its data is lost? | IT services and their data |
| High availability | Does a service keep running through routine component failures? | A single system or platform |
| Backup | Is there an earlier, restorable version of the data? | Data only |
None of these substitutes for another. A highly available system with no clean backup survives a failed drive and not a ransomware attack. A tested recovery plan restores servers that nobody can use if staff have no building, no network or no way to sign in.
How a continuity program runs
Most programs follow the management cycle in ISO 22301, the international standard for business continuity management systems. It is a loop rather than a project:
- Analyze how disruption affects each activity in a business impact analysis, which sets how long each can stop and how much data it can lose.
- Choose a strategy for each kind of loss: a site, a supplier, a group of staff, a set of IT services.
- Write the plans, with the disaster recovery plan covering the IT part.
- Exercise them, from tabletop discussions to live tests.
- Review what the exercises exposed, and run the cycle again as the organization changes.
Where continuity plans break
Plans rarely fail on the component that was made redundant. They fail on something the redundant components quietly share. Two data centers that authenticate against one identity service go down together. Two network carriers whose cables run through the same duct are cut together. Backup copies whose encryption keys sit in one key manager are lost together. A single engineer who knows the restore sequence is a dependency that appears on no diagram.
Adding more redundancy does not reveal these. Asking what each redundant pair has in common does, by mapping identity, power, network routes, suppliers, keys and people across the services the plan relies on. Exercises that remove one shared piece, such as running a recovery without the usual administrator, show whether the plan still holds.
What storage contributes
Storage supplies the data layer of continuity in two ways: it keeps data reachable through hardware faults and maintenance, and it holds copies that survive a deliberate attack. The second has gained weight because ransomware is now a continuity event in its own right. It can take applications, email and phone systems offline at once, so plans include out-of-band communication and recovery from copies an attacker could not alter, as described under ransomware recovery.
Frequently asked questions
Does business continuity cover cyberattacks?
Yes. A ransomware attack can disable systems and internal communication at the same time, so continuity plans usually include out-of-band contact methods, manual procedures and recovery from protected copies.
Who owns business continuity in an organization?
Usually a continuity or risk function with executive sponsorship. Business units own their plans and recovery priorities, and IT owns the technical recovery that supports them.