Difference Between BCP and DRP - CISSP

Kelly Mccormick

Hey everyone,

I'm going through my study material for the CISSP, and I'm trying to think of a good way to differentiate between Business Continuity Planning and Disaster Recovery Planning. Some of the text I've seen states that DRP steps in when BCP fails. Is that accurate? Does anyone have a good way of remembering the difference between the two concepts? Thanks!

Adam Gordon

Kelly,

DRP encompasses what we do to stabilize the environment immediately after the disaster has occurred in order to provide a stable, safe and secure environment to allow for recovery to proceed.

BCP encompasses what we do in order to "get back to normal" and reestablish the day to day operational environment that existed prior to the disaster occurring.

Hopefully that helps to give you an easy way to keep the two straight as you are studying.

Weyarn Yeh

Hi Kelly,
The BCP is the entire business process of recovering (or continuing) after a disaster (typically owned by the business - aka not IT) and the DRP, which is a subset of the BCP, is owned by IT and involves the recovery of business critical IT systems.

So the easiest way I would differentiate BCP and DRP is ownership; BCP is owned (typically) by the business and DRP is owned by IT.