# How Is a Business Continuity and Disaster Recovery Plan Built? ISO 22301, ISO 27001 and Regulations

**URL:** https://securesys.com.tr/en/learning/backup-and-business-continuity/business-continuity-and-dr-plan-iso-22301

![How Is a Business Continuity and Disaster Recovery Plan Built? ISO 22301, ISO 27001 and Regulations](/images/bilgi-merkezi/covers/cover-backup-12.webp)

An organization having a strong backup infrastructure does not, on its own, guarantee business continuity.

Immutable backup may be in place.

An air-gap architecture may have been built.

A second data centre may be ready.

Cloud backup and DRaaS may be in use.

However, when a critical interruption occurs;

who will decide,

which system will be brought up first,

which backup will be used,

which location will be switched to,

how customers will be informed,

what employees will do,

how the RPO and RTO targets will be verified

if the answers to these questions have not been determined in advance, the technical infrastructure alone may not be sufficient.

For this reason organizations need to address their backup and disaster recovery investments within a broader framework.

The name of this framework is:

#### Business Continuity Management

and one of its technical dimensions is:

#### Disaster Recovery

as the pair.

A strong business continuity approach assesses not only the organization's technological systems but;

people,

facilities,

suppliers,

communication,

operations,

data

and critical business processes

as a whole.

The aim is not merely to bring the servers back up.

The aim is:

**for the organization to be able to continue its critical services within an acceptable period.**

### What Is Business Continuity?

Business continuity is the organization's ability to continue its critical activities at an acceptable level after a serious interruption, crisis or disaster.

This interruption;

a cyber attack,

ransomware,

loss of the data centre,

a natural disaster,

a power outage,

a cloud outage,

a critical supplier problem,

loss of human resources

can arise from many different causes such as these.

The core question of business continuity is this:

**“If this service stops, how will the organization keep working?”**

### What Is a Business Continuity Plan – BCP?

BCP is expressed as:

#### Business Continuity Plan

that is:

#### the plan for business continuity

in full.

The BCP defines how critical business processes will be continued during an interruption.

For example;

a manual order process if the ERP is not running,

an alternative communication method if there is no e-mail service,

a remote working process if the office cannot be reached

can be defined inside the BCP.

### What Is a Disaster Recovery Plan – DRP?

DRP is the:

#### Disaster Recovery Plan

that is:

#### the plan for recovering from disaster

which defines how IT systems will be brought back after a disaster.

For example;

server recovery,

database restore,

DR site failover,

network recovery,

Active Directory recovery,

a DNS change

can be assessed within the scope of the DRP.

### What Is the Difference Between BCP and DRP?

The BCP is broader.

The DRP, meanwhile, is mostly technology-focused.

Put simply:

**BCP = how will the business continue?**

**DRP = how will the technology come back?**

For example, if the payment system will be down for 4 hours:

The BCP can define a temporary manual payment process.

The DRP, meanwhile, ensures the payment system is opened again at the DR location.

### Where Does Backup Sit in Business Continuity?

Backup is one of the fundamental technical components of business continuity.

However, on its own it is not business continuity.

Backup:

brings the data back.

DR:

brings the system back.

The BCP:

keeps the business going.

These three structures must work together.

### Where Should the Business Continuity Plan Start?

The first step is not choosing technology.

The first step is understanding the organization's critical business processes.

For this reason, at the foundation of the business continuity plan sits the:

#### Business Impact Analysis – BIA

as the starting point.

### What Is Business Impact Analysis – BIA?

BIA analyses the effects that critical business processes will create on the organization after an interruption.

The purpose is:

which business processes are critical

and

how long they can withstand an interruption

to determine these.

### Why Is a BIA Done?

Without a BIA it is difficult to determine correctly which system must be recovered first.

For example, the IT team may see the mail system as the most critical system.

But for the business unit the production ERP system may be far more critical.

For this reason technology priorities must be determined according to business needs.

### Which Questions Are Asked in the BIA Process?

For each critical process these questions can be asked:

What happens if this process stops?

What happens after 1 hour?

After 4 hours?

After 24 hours?

Does a financial loss occur?

Is the customer affected?

Does a legal obligation arise?

Is reputational damage suffered?

Do other processes depend on this system?

How much data loss is acceptable?

### How Is a Critical Business Process Determined?

A critical process;

the organization's revenue,

customer service,

legal obligations,

security

or its core operations

is one that significantly affects these.

For example;

payment,

ordering,

production,

customer support,

authentication

can be critical.

### What Is Business Service Mapping?

Business Service Mapping is mapping the relationship between a business service and the technology components supporting it.

For example:

#### Online Sales

↓

Web Application

↓

Application Server

↓

Database

↓

Active Directory

↓

DNS

↓

Network

This dependency chain carries critical importance in recovery planning.

### Why Is Dependency Mapping Necessary?

Restoring only the main application may not be sufficient.

For example, the ERP may have come up.

However, if;

DNS is not running,

AD is not running,

the database is down,

the storage is unreachable

then the service cannot be delivered.

For this reason the recovery order must be determined according to the dependency map.

### How Is RPO Used in the Business Continuity Plan?

RPO:

#### Recovery Point Objective

expresses the acceptable data loss period.

For example, if:

RPO = 15 minutes

then the goal is for the system to be brought back with at most roughly 15 minutes of data loss.

This value affects the backup frequency and the replication architecture.

### How Is RTO Used in the Business Continuity Plan?

RTO:

#### Recovery Time Objective

expresses within what period the system must be brought back.

For example, if:

RTO = 2 hours

then the system must be made usable again within roughly two hours after the interruption.

### Who Should Determine RPO and RTO?

They must not be determined by the IT team alone.

Into the process;

business units,

IT,

cyber security,

risk,

compliance,

business continuity,

senior management

must be included.

Because acceptable data loss and downtime are a business decision.

### What Is Maximum Tolerable Downtime – MTD?

MTD expresses the maximum interruption period a business process can withstand before being affected at an unacceptable level.

The RTO must generally be set within this limit.

For example, if:

MTD = 8 hours

then an RTO of 24 hours does not make sense.

### What Is Recovery Priority?

Recovery Priority determines in which order systems will be brought back.

For example:

#### Priority 1

Network, DNS, Active Directory

#### Priority 2

Database

#### Priority 3

ERP and critical applications

#### Priority 4

File servers

an ordering along these lines can be made.

The real ordering must be created according to the BIA and dependency mapping results.

### Can All Systems Be at the Same Priority?

No.

Classifying every system as “critical” makes the plan useless.

Criticality must be determined realistically.

### The Tier-Based Recovery Approach

Organizations can use, for example, this classification:

#### Tier 0

Identity, DNS, core infrastructure

#### Tier 1

Business critical systems

#### Tier 2

Important systems that can withstand a short interruption

#### Tier 3

Low-priority systems

This classification optimizes backup, DR and investment costs.

### How Is a Business Continuity Risk Analysis Done?

The BIA analyses the business impact.

Risk Assessment, meanwhile, evaluates the likelihood and impact of events.

For example;

ransomware,

earthquake,

storage failure,

human error,

cloud outage,

supplier interruption

risks such as these can be analysed.

### What Is the Difference Between BIA and Risk Assessment?

BIA:

**“If this process stops, what is the impact?”**

Risk Assessment:

**“Which threats can cause this interruption and what is the risk?”**

each answers its own question.

The two studies complement each other.

### How Should Business Continuity Scenarios Be Determined?

The plan must not be prepared according to a single disaster scenario.

For example, these scenarios must be assessed separately:

- The data centre is completely unusable
- A ransomware attack
- Active Directory is completely compromised
- A cloud provider outage
- There is no network connection
- A critical supplier is not operating
- The office cannot be reached

Each scenario can require a different recovery method.

### Are Natural Disaster and Ransomware Recovery the Same?

No.

In a natural disaster the DR Site can be trusted.

In a ransomware incident, however, the DR Site may also have been affected by the attacker.

For this reason Cyber Recovery must be planned separately.

### What Is Cyber Recovery?

Cyber Recovery is the recovery approach that aims to bring systems back reliably and cleanly after a cyber attack.

It is used particularly in events such as;

ransomware,

credential compromise,

Active Directory compromise,

supply chain attack

as the trigger.

### How Does a Cyber Recovery Plan Differ from a Normal DR Plan?

In a normal DR plan the aim may be a fast failover.

In Cyber Recovery, trust is needed first.

For example;

which backup is clean?

are the credentials trustworthy?

is there persistence?

has the DR environment been affected?

these questions must be answered.

For this reason the cyber recovery period can be longer.

### What Is a Clean Recovery Point?

A Clean Recovery Point is the trusted backup point from before the attacker's activity began.

The most recent backup may not always be clean.

For example, the attacker may have remained quietly inside the system for two weeks.

In that case the last clean restore point may be older.

### What Is a Cyber Recovery Vault?

A Cyber Recovery Vault is a secure environment where critical backup and recovery components are held under high isolation.

This environment;

immutable,

air-gapped,

a separate identity,

a restricted network

can be protected with these.

### Should There Be Immutable Backup in the Business Continuity Plan?

On critical systems it must be strongly evaluated.

Immutable backup makes it harder for a ransomware attacker to destroy the recovery capacity.

### Why Is Air Gap Important in Business Continuity?

Air gap ensures the independent recovery copy is preserved after a production compromise.

This is important particularly from a cyber resilience perspective.

### In Which Part of the Plan Does the DR Site Appear?

The DR Site enables critical systems to be run at an alternative location.

Inside the plan;

which systems are replicated to DR,

in which order they will be opened,

which network changes will be made,

who will initiate the failover

must be defined.

### How Is the Choice Between Hot, Warm and Cold Site Made?

The choice is made according to RTO and cost.

#### Hot Site

low RTO, high cost

#### Warm Site

medium RTO, medium cost

#### Cold Site

long RTO, low cost

each can offer this profile.

### When Are Active-Active and Active-Passive Used?

On systems with a very low RTO target, Active-Active can be considered.

In more economical structures Active-Passive is widespread.

However, the application architecture is decisive in the choice.

### What Is a Failover Plan?

A Failover Plan defines the process of switching from the production system to the DR system.

For example:

- Disaster declaration
- Replication check
- Starting the DR systems
- Network redirection
- DNS change
- Application validation
- Opening to users

### Why Is a Failback Plan Necessary?

When the disaster ends, the new data created in the DR environment has to be carried back to production.

If this operation is done wrongly, data loss can be suffered.

For this reason failback must be tested separately.

### What Is Disaster Declaration?

An interruption being officially accepted as a disaster is called:

#### Disaster Declaration

in continuity terminology.

This decision activates the DR plan.

### Who Should Declare the Disaster?

Predetermined roles must exist.

For example;

the CIO,

the IT Director,

the BCM Manager,

the Crisis Committee

can hold the authority.

### What Is a Crisis Management Team?

In major incidents a crisis management team beyond the technical team comes into play.

On this team;

senior management,

legal,

communications,

IT,

cyber security,

HR

can take part.

### How Do Incident Response and Business Continuity Work Together?

Incident Response, for the attack;

detects it,

analyses it,

isolates it,

cleans it.

Business Continuity, meanwhile, ensures the business keeps going.

In a ransomware incident these two processes can run in parallel.

### Who Should Decide First: IR or DR?

There is no single correct answer.

For example, performing a fast DR failover while the attack is ongoing can carry the attacker into the new environment.

For this reason coordination between the Cyber Incident Response and DR teams is required.

### What Is a DR Runbook?

A DR Runbook is the detailed list of technical steps to be applied during recovery.

For example;

network recovery,

AD recovery,

database failover,

application startup,

DNS switch

steps such as these can be defined.

### Why Is the Runbook Critical?

At the moment of a disaster the team can be under intense stress.

Relying on human memory is risky.

The runbook standardizes the processes.

### What Should Be Inside the Runbook?

For example:

system name,

owner,

RPO,

RTO,

dependency,

backup location,

restore procedure,

DR server,

DNS change,

validation steps,

rollback

this information can be included.

### Who Should Update the Runbook?

It can be updated by the technical team owning the system.

However, it must be controlled through change management.

### Where Should Business Continuity Documents Be Stored?

They must not be kept only on production systems.

For example, if the plan is only on SharePoint, it may be unreachable during a Microsoft 365 outage.

For this reason an independent or offline copy can be kept.

### What Is an Emergency Contact List?

Who will be called during a disaster must be determined in advance.

Inside the list;

management,

IT,

the SOC,

the cloud provider,

the internet service provider,

critical suppliers

can be included.

### Why Is a Communication Plan Necessary?

Major interruptions are not merely technical events.

Customers and employees expect information.

Wrong or delayed communication can enlarge the crisis.

### What Should a Crisis Communication Plan Include?

Who will make the statement?

Which channel will be used?

How will employees be informed?

When will customers be informed?

Will a regulator notification be required?

These questions must be answered in advance.

### Should There Be an Alternative Communication Channel?

Yes.

The e-mail system itself may have gone down.

For this reason;

telephone,

SMS,

alternative messaging,

an emergency platform

can be evaluated.

### What Is Supplier Business Continuity?

An organization's critical services can depend on third parties.

For example;

the cloud provider,

the internet service provider,

SaaS,

the payment infrastructure

can be cut off.

For this reason supplier continuity must be assessed.

### Which Questions Should Be Asked of the Supplier?

The supplier's;

RPO,

RTO,

DR Site,

backup,

incident response,

BCP

processes can be questioned.

### Should Contracts Contain a Business Continuity Clause?

For critical suppliers it can be evaluated.

For example;

SLA,

recovery targets,

incident notification,

backup retention

can be defined.

### Does Using a Cloud Provider Remove the Need for a BCP?

No.

The cloud provides high availability but;

a region outage,

account compromise,

a configuration error

risks such as these continue.

### Does Using SaaS Remove the Need for a BCP?

No.

For example, if Microsoft 365 is entirely unreachable, how will the company communicate?

This scenario must be assessed inside the BCP.

### What Is a Business Continuity Exercise?

It is testing the BCP and DR plans with real or simulated scenarios.

The purpose is to verify whether the document works in the real world.

### What Is a Tabletop Exercise?

A Tabletop Exercise is a desktop drill.

A scenario is given to the teams.

For example:

“On Friday at 09:00 all systems are unreachable because of ransomware.”

The teams discuss what they will do.

### What Is the Advantage of a Tabletop Exercise?

With low risk;

the decision mechanism,

communication,

role distribution,

missing procedures

can be seen.

### What Is a Technical Restore Test?

A system is restored from a real backup.

For example;

a VM,

a database,

a file server

is brought back.

This test verifies the usability of the backup.

### What Is a DR Failover Test?

Running critical systems from the DR Site is tested.

During this;

RPO,

RTO,

network,

DNS,

application

are verified.

### What Is a Full Business Continuity Exercise?

It is a wide-ranging exercise in which technical and business units take part together.

For example;

the head office is closed,

the ERP is not running,

there is no e-mail,

customer calls are coming in

a combined scenario such as this can be applied.

### How Often Should Exercises Be Performed?

There is no single universal period.

Critical systems and the risk level must be taken into account.

For example;

tabletop a few times a year,

technical restore quarterly,

full DR annually

plans such as these can be used.

However, the real frequency must be determined according to the organization's risk profile.

### Should RPO Be Measured in the Exercise?

Yes.

The last usable time of the restored data must be measured.

It must be compared with the target RPO.

### Should RTO Be Measured in the Exercise?

Yes.

The period from the start of the interruption until the service becomes usable must be measured.

### Can the RTO on Paper and the Real RTO Differ?

Absolutely.

For example, if:

Target RTO = 2 hours

Actual test = 5 hours

then the organization's real recovery capability does not meet the target.

### How Should Recovery Test Results Be Managed?

At the end of the test;

which step was delayed,

which dependency was forgotten,

which credential did not work,

which network rule was missing

must be determined.

An improvement plan must then be created.

### What Is Lessons Learned?

It is recording the lessons drawn after an exercise or a real incident.

The purpose is to prevent the same mistake from recurring.

### What Is a Corrective Action?

It is the action created to close the identified gap.

For example:

“The DR firewall policy is missing.”

Corrective Action:

“The DR firewall rules will be created and tested.”

### What Are the Business Continuity KPIs?

Sample KPIs:

RPO Compliance

RTO Compliance

Backup Success Rate

Restore Success Rate

DR Test Success Rate

Critical Service Coverage

BIA Completion Rate

BCP Exercise Completion

### What Is RTO Compliance?

It shows the proportion of systems whose recovery was completed within the target RTO.

### What Is RPO Compliance?

It shows whether the target data loss tolerance was met after recovery.

### Is Backup Success Rate Sufficient?

No.

What matters from a business continuity perspective is restore success.

For this reason:

Backup Success

and

Restore Success

must be monitored together.

### What Could a Business Continuity Dashboard Look Like?

For example, on the dashboard:

Last Backup

Last Immutable Copy

Last Restore Test

Target RPO

Actual RPO

Target RTO

Actual RTO

Last DR Test

can be shown.

### What Is ISO 22301?

ISO 22301 is the:

#### Business Continuity Management Systems

that is, the international standard for a Business Continuity Management System.

It aims for organizations to prepare systematically for interruptions and crises.

### What Does ISO 22301 Provide?

The standard;

the business continuity policy,

BIA,

risk assessment,

strategy,

plans,

exercises,

continual improvement

makes processes such as these systematic.

### Is ISO 22301 Only an IT Standard?

No.

This is an important distinction.

ISO 22301 is not only about backup and disaster recovery.

It also;

facilities,

personnel,

suppliers,

communication,

operations

covers areas such as these.

### The Difference Between ISO 27001 and ISO 22301

ISO/IEC 27001:

#### the Information Security Management System

is what it focuses on.

ISO 22301:

#### the Business Continuity Management System

is what it focuses on.

They can complement each other.

### What Does ISO 27001 Expect Regarding Backup?

In the ISO/IEC 27001 approach, the availability and recoverability of information assets are addressed on a risk basis.

Backups being;

protected,

tested,

access-controlled

is important.

### Why Is ISO 27001 Important for ICT Continuity?

Critical information systems being recoverable after an interruption supports the availability objective from an information security perspective.

For this reason DR and backup processes can be assessed inside the ISMS.

### Is ISO 27017 Relevant for Cloud Backup?

ISO/IEC 27017 can help address roles and responsibilities in cloud environments more clearly in terms of cloud security controls.

The shared responsibility subject is important in cloud backup and DR designs.

### Backup and Business Continuity from a KVKK Perspective

There can be personal data inside a backup.

For this reason backup data too;

unauthorized access,

leakage,

modification,

loss

must be protected against these risks.

### Does KVKK Determine the Backup Retention Period?

It does not give a single technical backup period for every system.

Retention;

business need,

legal retention obligations,

the purposes of processing personal data

must be assessed together.

### Should the Deletion of Backup Data Be Planned?

Yes.

Secure destruction processes must be established for data whose retention period has expired.

However, the immutable retention period must be designed technically to allow this.

### What Is DORA?

DORA is the:

#### Digital Operational Resilience Act

the European Union's digital operational resilience framework for the finance sector.

It aims to strengthen financial institutions' resilience against ICT risks.

### Why Is DORA Important for Backup and DR?

Within the scope of operational resilience;

backup,

recovery,

ICT continuity,

testing,

incident management

are assessed together.

Critical financial services being recoverable after major ICT incidents is important.

### Does DORA State a Specific RPO or RTO?

It is not correct to speak of a single universal figure for all systems.

Recovery targets must be determined taking into account the criticality of the service concerned, the risk profile and regulatory expectations.

### Can PCI DSS Be Relevant for Backup?

In environments where card data is processed, there can be card data inside the backup.

For this reason the backup repository too can fall within the scope of the relevant security controls.

### Is Taking Backups Enough for Regulatory Compliance?

No.

The backup must be;

secure,

accessible,

tested,

stored with the correct retention,

subject to authorized access

in all these respects.

### What Is a Business Continuity Policy?

It is the formal document defining senior management's business continuity approach.

For example;

purpose,

scope,

roles,

responsibilities

can be defined.

### What Is Senior Management's Role?

Business continuity is not merely an IT project.

Senior management;

risk acceptance,

budget,

priority,

defining critical services

carries responsibility in these areas.

### Who Should Be the BCP Owner?

Every business process must have its own business owner.

IT manages only the technical system.

The criticality of the business process must be determined by the business unit.

### Who Should Be the IT Disaster Recovery Owner?

For the IT infrastructure;

IT Manager,

Infrastructure Manager,

DR Manager

a role such as these can be defined.

### Who Should Be the Cyber Recovery Owner?

The cyber security and IT teams can carry the responsibility together.

During ransomware recovery in particular, the SOC, Incident Response and Infrastructure teams must work in coordination.

### What Is a RACI Matrix?

RACI;

Responsible,

Accountable,

Consulted,

Informed

defines these roles.

It can be used to clarify responsibilities in business continuity.

### A Sample RACI

For example, for DR failover:

Responsible → Infrastructure Team

Accountable → CIO

Consulted → Cyber Security

Informed → Business Units

a structure such as this can be created.

### What Is a Manual Workaround in the Business Continuity Plan?

It enables the business to continue by manual means until the technology comes back.

For example, while the ERP is unavailable, orders can be recorded temporarily on Excel or on paper.

### Is a Manual Workaround Possible in Every Process?

No.

For this reason it must be assessed during the BIA.

In some digital processes a manual alternative may not exist.

In that case the RTO can be kept very low.

### Is an Alternate Site Only a Data Centre?

No.

An alternative office may also be needed for employees.

For example, if the head office cannot be used, employees;

another location,

home office,

a shared workspace

can work from these.

### Can Remote Working Be Part of the BCP?

Yes.

However;

VPN capacity,

MFA,

endpoint security,

the internet connection

must be tested in advance.

### Must Employee Lists Be Kept Up to Date?

Yes.

Having an old telephone number or the details of a departed employee during a crisis can create a serious problem.

### Must the Critical Supplier List Be Kept Up to Date?

Yes.

The technical and contractual contacts to be reached in an emergency must be on record.

### Should Backup and DR Licenses Be Planned?

Yes.

When an application is to be run in the DR environment, a license requirement can arise.

A license problem must not be encountered during a disaster.

### Should Certificates and Secrets Be Brought into Recovery Scope?

Absolutely.

The system may restore, but if the TLS certificate or a secret is missing the application may not work.

For this reason;

certificates,

API keys,

service accounts,

secrets

must be included in the recovery plan.

### Why Is DNS Critical in the Recovery Plan?

Even if the system comes up in DR, the service cannot be delivered if users are not directed to the right address.

The DNS failover plan must be tested.

### Why Is the Firewall Critical in the Recovery Plan?

The application can run in the DR environment.

However, if firewall rules are missing the user cannot reach it.

For this reason network security configuration backup and documentation are important.

### Why Does Active Directory Recovery Require a Special Plan?

AD is the identity infrastructure of many services.

If the domain is lost entirely, an ordinary VM restore may not be sufficient.

A Forest Recovery plan may be needed.

### What Is an Active Directory Forest Recovery Plan?

It is the dedicated plan defining the controlled recreation of the AD forest from a trusted backup.

This process requires a separate exercise.

### How Is a Business Continuity Plan Made for SaaS?

If the SaaS platform is unreachable;

alternative communication,

offline export,

independent backup,

a manual workaround

options such as these must be assessed.

### A Microsoft 365 Outage Scenario Example

If Microsoft 365 is unavailable for a few hours:

How will e-mail be sent?

How will files be reached?

What will be used instead of Teams?

These questions must be answered inside the BCP.

### A Ransomware Business Continuity Scenario Example

For example:

09:00 – Ransomware was detected.

09:10 – Network segments were isolated.

09:30 – Incident Response began.

10:30 – It was determined that an automatic switch to DR was not safe.

12:00 – The last clean backup was selected.

14:00 – The Clean Room restore began.

18:00 – The critical application was validated.

This scenario differs from a normal DR.

### What Is Cyber RTO?

During a cyber attack the real recovery time;

forensics,

credential reset,

malware validation,

clean room

can be longer than the normal RTO because of these.

For this reason some organizations assess Cyber RTO separately.

### What Is Cyber RPO?

Not the last successful backup but the last trusted clean backup is taken into account.

For example, even if the normal RPO is 15 minutes, the last clean backup may be 3 days old.

This is the real cyber recovery risk.

### Should Backup Retention Be Planned According to Dwell Time?

Ransomware attackers can remain inside the system for days or weeks.

If retention is too short, the clean restore point can be lost.

For this reason retention must not be determined by storage cost alone.

### What Is a Golden Image?

A Golden Image is a trusted and hardened system image.

During Cyber Recovery, servers can be reinstalled from a clean image.

### Should Application Binaries Be in the Recovery Plan?

Yes.

Data backup alone is not sufficient.

Application installers and the correct versions may be needed.

### Can Infrastructure as Code Be Used for Recovery?

Yes.

Terraform, Ansible or similar IaC tools can enable the infrastructure to be recreated quickly.

This can lower the RTO.

### Should the IaC Repository Be Backed Up Too?

Yes.

Losing the infrastructure code can lengthen the recovery time seriously.

### What Should Configuration Backup Cover?

For example;

firewall,

switch,

load balancer,

hypervisor,

database configuration,

backup configuration

can be backed up.

### How Technical Should the Recovery Document Be?

It must be clear enough for one person to apply step by step.

Merely writing:

“The ERP is restored.”

is not sufficient.

### Should Critical Recovery Information Rest with One Person?

No.

It creates key-person dependency.

One employee being unreachable must not halt the recovery process.

### What Is Cross-Training?

It is training more than one employee so that they can perform critical recovery operations.

It is important from a business continuity perspective.

### Should Backup Personnel Be Designated?

Yes.

An alternative person can be identified for every critical role.

### How Often Should the BCP Be Updated?

It must be reviewed at least at regular intervals and after significant changes.

For example;

a new ERP migration,

a new cloud provider,

a network change,

a company merger

it must be updated after these.

### Why Is an Old BCP Risky?

Inside the plan;

IP addresses,

personnel,

telephone numbers,

server names,

suppliers

may have changed.

During a real crisis the plan may not work.

### Should the Business Continuity Document Be Versioned?

Yes.

Who changed what and when must be known.

A change history must be kept.

### Is the BCP Document Confidential?

It generally contains sensitive information.

For example;

critical systems,

telephone numbers,

DR locations,

the credentials process

may be found in it.

For this reason access must be controlled.

### Should There Be an Offline Copy of the BCP?

For critical plans it can be evaluated.

A cyber attacker can block access to the organization's document system.

### How Is Business Continuity Maturity Measured?

An organization can be assessed at these levels:

#### Level 1 – Reactive

There is no plan, or it depends on individuals.

#### Level 2 – Documented

A BCP/DRP exists.

#### Level 3 – Tested

Regular exercises are performed.

#### Level 4 – Measured

RPO/RTO KPIs are monitored.

#### Level 5 – Continually Improved

Continuous improvement is made from real incidents and tests.

### Does Backup Maturity Indicate Business Continuity Maturity?

On its own, no.

There can be an organization with a very good backup infrastructure but no BCP.

Business continuity is a broader management discipline.

### Steps for Creating a Corporate BCP

A practical business continuity process can proceed as follows:

- The scope is determined.
- Critical business processes are identified.
- A BIA is performed.
- A risk assessment is performed.
- RPO and RTO are set.
- Dependency mapping is performed.
- The recovery strategy is determined.
- The backup and DR architecture is designed.
- The BCP and DRP are documented.
- The responsibilities of the roles are determined.
- A communication plan is created.
- An exercise is performed.
- The results are measured.
- Improvements are applied.

### How Is the Recovery Strategy Chosen?

For example:

Tier 1 system → Hot DR + Immutable Backup

Tier 2 → Warm DR + Cloud Backup

Tier 3 → Backup and Restore

can be used.

These values are examples.

The real model must be determined according to the BIA and risk analysis.

### How Should the Business Continuity Budget Be Determined?

The infrastructure cost alone must not be looked at.

It must be compared with the Cost of Downtime.

For example, if 1 hour of system downtime creates 5 million TL of damage, a DR investment can be economically meaningful.

### What Should the Business Continuity Report for Management Look Like?

It must be risk-based rather than full of technical detail.

For example:

Number of critical services

RPO compliance

RTO compliance

Last DR test

Restore success

Open risks

can be reported.

### Critical Questions Management Should Ask

Senior management must be able to get answers to these questions:

Which are our critical services?

What is the RPO and RTO of each?

Which systems have a DR environment?

Which systems have an immutable backup?

When was the last restore test performed?

Did we hit the target in the last DR test?

Which clean backup will we return to after ransomware?

What will we do if production and DR are lost at the same time?

These questions show real operational resilience.

### The Most Common Mistakes in Business Continuity

The mistakes frequently seen in organizations are as follows:

- seeing the BCP as only an IT project,
- making a DR investment without doing a BIA,
- declaring all systems critical,
- letting IT determine the RPO/RTO alone,
- seeing backup and DR as the same,
- mistaking DR for cyber recovery,
- not doing dependency mapping,
- forgetting the communication plan,
- not planning failback,
- leaving suppliers outside the scope,
- testing only on paper,
- not measuring the real RPO/RTO,
- not updating the documents for years.

### Business Continuity and Disaster Recovery Checklist

Organizations can check these headings:

- Business Impact Analysis
- Risk Assessment
- Critical Service Inventory
- RPO
- RTO
- MTD
- Dependency Mapping
- Recovery Priority
- Backup Strategy
- Immutable Backup
- Air-Gap
- DR Site
- Cyber Recovery
- DR Runbook
- Failover
- Failback
- Crisis Management
- Communication Plan
- Supplier Continuity
- Restore Testing
- DR Testing
- Tabletop Exercise
- Lessons Learned
- Corrective Actions

### What ISO 22301, ISO 27001 and Business Continuity Have in Common

The common purpose of these structures is not merely to produce documents.

The real objective is:

**being able to show that the organization can sustain its critical services in the face of a real interruption.**

Having a backup is important.

However, if the backup is not restored, it is incomplete.

Having a DR centre is important.

However, if the failover has not been tested, its capacity is unknown.

Having a BCP document is important.

However, if the teams do not know the plan, it is of no use during a crisis.

For this reason real resilience must be built on three concepts:

#### Plan

#### Test

#### Measure and Improve

### Frequently Asked Questions

#### What is a Business Continuity Plan?

A Business Continuity Plan is the plan defining how an organization will continue its critical activities during serious interruptions.

#### What is a Disaster Recovery Plan?

A DRP defines how critical IT systems will be run again after a disaster.

#### What is the difference between a BCP and a DRP?

A BCP covers all business activities. A DRP focuses more on technology and IT recovery processes.

#### What is a BIA?

A Business Impact Analysis analyses the interruption effects of critical business processes and helps determine recovery priorities.

#### What is RPO?

RPO expresses the maximum acceptable data loss period.

#### What is RTO?

RTO is the targeted maximum recovery time of the system or the business service.

#### If there is a backup, is DR necessary?

On critical systems, generally yes. Backup brings the data back, while DR enables the service to be run on an alternative infrastructure.

#### What is ISO 22301?

ISO 22301 is the international standard for a Business Continuity Management System.

#### Is ISO 27001 related to business continuity?

Yes. Within the scope of information security, ISO/IEC 27001 addresses subjects such as availability, backup and ICT continuity on a risk basis.

#### Should the most recent backup be used after ransomware?

Not always. The last backup may have been taken after the attacker entered the system. For this reason the last trusted clean restore point must be determined.

### Conclusion: Real Business Continuity Is an Organizational Resilience Capability Beyond Backup

To understand whether an organization is ready for disasters, asking:

**“Do you take backups?”**

is no longer enough as a question.

The more accurate questions are these:

#### Which are your critical services?

#### How much data loss can you accept?

#### How much downtime can you tolerate?

#### Which is your last clean backup?

#### Does the DR Site really work?

#### Which environment will you return to in a ransomware event?

#### When did you last test this plan?

Business continuity ensures these questions are answered technically, operationally and managerially.

A strong structure;

#### BIA

identifies critical processes with this.

#### RPO and RTO

makes recovery targets measurable with these.

#### Backup and Immutable Backup

protects the data with these.

#### Disaster Recovery

brings the system back with this.

#### Cyber Recovery

creates a trusted environment after an attack with this.

#### BCP

keeps business processes going with this.

#### Exercises

verify that the whole structure really works with these.

ISO 22301, ISO/IEC 27001 and the related operational resilience approaches also support this process being managed corporately and continuously.

The question we asked at the start of this series was:

**“What is backup and why is it critical for organizations?”**

At the end of the series the answer is now far broader.

Backup is not merely a second copy of a file.

Backup;

**of cyber security,**

**of business continuity,**

**of disaster recovery**

and **of corporate operational resilience**

is one of the fundamental components.

And the most critical principle does not change:

**The real value of a backup emerges not on the day it is taken but on the day it is successfully restored when needed.**

Organizations' goal must not be merely to be able to say:

**“We have a backup.”**

as their answer.

The real goal is:

**“Even if we lose our main system, our data centre or our cloud environment, we know from which data, in which order, by whom and within what time we will come back; and we test this regularly.”**

to reach the maturity to be able to say this.

**This is what real Business Continuity, Disaster Recovery and Cyber Resilience are.**