An organization’s business continuity plan or disaster recovery plan does not typically include a retention schedule for storage and destruction of information. A retention schedule is a document that specifies how long different types of information should be kept by an organization before they are disposed of or destroyed. A retention schedule is usually based on legal, regulatory, operational, historical, or archival requirements. A retention schedule is part of an organization’s information governance or records management policy, not its business continuity or disaster recovery plan.
A business continuity plan (BCP) is a document that outlines how an organization will continue its critical functions and operations in the event of a disruption or disaster. A BCP usually includes:
Contact information and service level agreements (SLAs) for key personnel, stakeholders, providers, backup site operators, etc.
Business impact analysis (BIA) that identifies the potential impacts of disruption on all aspects of the business, such as financial, legal, reputational, etc.
Risk assessment that identifies and evaluates the likelihood and severity of various threats and vulnerabilities that could cause disruption or disaster.
Identification of critical functions that are essential for the survival and recovery of the business.
Communications plan that specifies how to communicate with internal and external parties during and after a disruption or disaster.
Testing plan that specifies how to test and update the BCP regularly to ensure its effectiveness and validity.
A disaster recovery plan (DRP) is a document that outlines how an organization will restore its IT systems, data, applications, and infrastructure in the event of a disruption or disaster. A DRP usually includes:
Recovery time objectives (RTOs) that specify how quickly each IT system or service needs to be restored after a disruption or disaster.
Recovery point objectives (RPOs) that specify how much data loss is acceptable for each IT system or service after a disruption or disaster.
Emergency response guidelines that specify how to respond to and contain a disruption or disaster, such as activating the DRP, declaring a disaster, notifying the stakeholders, etc.
Statement of organizational responsibilities that specifies who is responsible for what tasks and roles during and after a disruption or disaster, such as initiating the DRP, executing the recovery procedures, restoring the IT systems or services, etc.
Recovery procedures that specify how to recover each IT system or service from backup sources, such as backup tapes, disks, cloud services, etc.
Testing plan that specifies how to test and update the DRP regularly to ensure its effectiveness and validity. References: [Business Continuity Plan (BCP) Definition]; [Disaster Recovery Plan (DRP) Definition]
