Disaster Recovery vs. Business Continuity: What Leadership Needs to Decide
RTO, RPO, and the difference between recovering systems and keeping the operation running, a planning guide for non-IT executives.
When leadership asks "do we have disaster recovery?" the IT answer is often "yes, we backup." Those aren't the same conversation.
Disaster recovery (DR) is about restoring systems after failure. Business continuity (BC) is about keeping critical operations running while that happens, or when systems can't come back quickly.
Both require executive decisions about time and money, not just technical configuration.
Two numbers that matter: RTO and RPO
| Term | Question it answers | Example |
|---|---|---|
| RPO (Recovery Point Objective) | How much data can we afford to lose? | 1 hour of email vs. 24 hours |
| RTO (Recovery Time Objective) | How fast must systems be back? | 4 hours vs. 3 business days |
Lower RTO/RPO = higher cost. Leadership picks the tradeoff; IT implements it.
For admissions-heavy operations, phone and email RTO often matters more than the file server, prioritize accordingly.
Tier your systems honestly
Not everything needs the same recovery speed:
Tier 1, Restore in hours
Email, EHR/adjacent access, phones, intake forms, identity
Tier 2, Restore in 1–2 days
File shares, internal apps, reporting
Tier 3, Restore when convenient
Archives, dev/test, non-critical SaaS
Document tiers in language operations understands. IT-only DR plans sit on shelves.
Backup is necessary, not sufficient
Verified backup answers: can we get the data back?
DR answers: can we run the business on alternate systems while we restore?
Minimum DR hygiene for SMBs:
- Tested restores (not just "backup job succeeded")
- Offline or immutable copy against ransomware
- Runbook: who declares disaster, who calls whom, in what order
- Alternate communication if email is down (phone tree, SMS, secondary domain)
Business continuity beyond IT
BC includes:
- Who can authorize spending during an outage?
- Where does staff work if a site is unavailable?
- How are clients/families notified?
- Paper fallback for critical workflows (yes, still relevant)
Run a tabletop exercise once a year: 90 minutes, leadership in a room, walk through "ransomware Tuesday" or "ISP down during intake peak."
Insurance and compliance angles
Cyber insurers increasingly ask for DR test evidence. Funders and auditors ask whether BC plans exist for organizations handling sensitive data.
A one-page BC summary plus tested backup logs beats a 200-page plan nobody's read.
Partner role
Your MSP should deliver restore test results, tier recommendations, and runbook drafts, not just monitor backup jobs.
Book an audit to map your current RTO/RPO against what leadership actually expects.