One plan keeps the business running, the other brings the systems back

The short answer

A business continuity plan describes how the whole business keeps operating during a disruption: who does what, where people work, how you reach customers and which functions come first. A disaster recovery plan is narrower. It describes how you restore IT systems and data after they fail, are destroyed or are encrypted by ransomware.

Continuity asks, how do we keep serving customers while things are broken? Disaster recovery asks, how do we get the systems back, and how fast? Disaster recovery is one part of business continuity. FEMA’s Ready.gov guidance treats the IT recovery plan as something developed alongside, and documented inside, the business continuity plan. A small business needs both, and the continuity work should come first because it tells IT what to recover first.

Side by side

What each plan contains

Business continuity plan

• Critical functions ranked by urgency, with an owner for each
• Recovery targets for each function
• Emergency contacts for staff, customers, suppliers, landlord, insurer and bank
• Alternate ways of working: remote work, a second site, manual processes
• Communication plan: who tells staff, customers and suppliers what, and how
• Decision rules: who declares a disruption and who can spend money
• Supplier backups for anything you cannot operate without

Disaster recovery plan

• Inventory of systems, data and where each is hosted
• Backup details: what, how often, where copies are kept and how long they are retained
• Step-by-step restore procedures for each critical system, in priority order
• Admin credentials and recovery codes stored safely offline
• Vendor and support contacts with account numbers
• Expected restore times, confirmed by testing
• Steps for a cyberattack specifically: isolating devices, checking backups are clean, resetting credentials

How RTO and RPO connect the two plans

Two numbers link continuity and recovery. Ready.gov recommends setting both during a business impact analysis.

• Recovery time objective (RTO): how long a function can be down before the damage becomes serious. If invoicing can wait three days but phones cannot be down for more than four hours, those are your RTOs.
• Recovery point objective (RPO): how much data you can afford to lose, measured in time. If losing a day of orders is survivable but losing an hour of patient notes is not, those systems need different backup frequency.

A practical way to set them is to sort systems into three tiers. Tier 1 must be back within hours, such as phones, email and the system you take orders in. Tier 2 can wait a day, such as accounting and file shares. Tier 3 can wait a week, such as archives and reporting tools. Each tier then gets its own backup frequency and restore order.

The continuity plan sets these targets from the business side. The disaster recovery plan proves IT can meet them. Ready.gov specifically advises confirming data restoration times and comparing them with the recovery time objectives. If your RTO is four hours and your last restore test took two days, the plans do not match, and you have found that out before a disaster rather than during one.

A simple example

Consider a 50-person distribution company hit by a ransomware attack on a Monday morning.

• Continuity plan in action: the operations manager switches order taking to phone and a shared spreadsheet, tells the three largest customers what is happening, moves shipping to a printed pick list and assigns someone to handle press and supplier calls.
• Disaster recovery plan in action: IT isolates affected machines, confirms which backups are clean, restores the order system to new hardware or the cloud, resets credentials and verifies data before reconnecting users.

Without the continuity plan, the business stops while IT works. Without the recovery plan, the workarounds run for weeks instead of days.

Do you know how long your systems would take to come back? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, applications, integration, automation, AI opportunities, technology spending and business continuity, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

Common mistakes

• Treating backups as a recovery plan. Backups are an ingredient. The plan says what to restore first, where, by whom and how long it takes.
• Writing the recovery plan without business input. IT ends up restoring the file server first when sales needed the phone system.
• Ignoring cloud services. Microsoft 365, Google Workspace and line-of-business software still need backup, admin access recovery and an outage plan.
• Never testing. A plan that has not been walked through usually fails at the first step, such as an expired password or a missing phone number.
• Storing the plan only on the server it describes. Keep printed and offline copies.

How a small business writes both, in order

1. List critical business functions. Taking orders, serving clients, payroll, shipping, billing. Rank them by how quickly their loss hurts.
2. Set RTO and RPO for each. Agree these with leadership, not just IT.
3. Map each function to the systems it needs. Email, phones, the CRM, accounting software, file shares, internet.
4. Write continuity workarounds. What staff do while each system is down, and who decides to switch.
5. Write recovery steps for each system. Where the backups are, who can restore them, credentials, vendor contacts and expected restore time.
6. Test both together. Run a tabletop exercise for one scenario, then a real restore test for one critical system.
7. Review every year and after any major change such as a new office, new system or staff turnover in key roles.

Our companion guide, a business continuity plan template for small businesses, walks through the continuity document section by section. For the IT side, our backup and disaster recovery guide covers backup design and restore testing.

Which standards to reference

You do not need a formal standard to write a useful plan, but these help if a customer, insurer or auditor asks:

• Ready.gov business continuity guidance (FEMA): free, plain-language steps for smaller organizations.
• NIST SP 800-34: contingency planning guidance for information systems, useful for structuring the IT recovery side.
• ISO 22301: the international standard for business continuity management systems, mostly relevant if a large customer requires it.

JLB USA includes monitored backups, tested restores and a written recovery plan in our managed IT service for businesses with roughly 25 to 100 employees, and our cybersecurity services cover the controls that make ransomware recovery possible.

Keep reading

• Business continuity plan template for small businesses
• Hurricane preparedness plan for business: the IT side
• How to reduce IT costs without making your business riskier
• Employee offboarding checklist: the IT and security steps

Related services

• Managed IT services
• Backup and disaster recovery guide
• Free Technology Health Assessment