No matter how many controls we put in place, the reality is that disasters will sometimes strike our organisation and cause disruptions. Disaster recovery planning ([[Disaster Recovery Plan|DRP]]) is the discipline of developing plans to recover operations as quickly as possible in the face of a disaster. The disaster recovery planning process creates a formal, broad disaster recovery plan for the organisation and, when required, develops specific functional recovery plans for critical business functions. The goal of these plans is to help the organisation recover normal operations as quickly as possible in the wake of a disruption. ### Disaster Types From a disaster recovery planning perspective, **a disaster is any event that has the potential to disrupt an organisation's business**. The occurrence of a disaster triggers the activation of the organisation's disaster recovery plan. As part of the DRP process, organisations should conduct site risk assessments for each of their facilities. These risk assessments should seek to *identify and prioritise the risks* posed to the facility by a disaster, including both internal and external risks from both environmental and human-made disasters. ### Business Impact Analysis The business impact analysis (BIA) is a **formal process designed to identify the mission-essential functions** within an organisation and **facilitate the identification of the critical systems that support those functions**. There are four key metrics used in the BIA process that you should understand: - The **Mean Time Between Failures** (MTBF) is a measure of the reliability of a system. It is the *expected amount of time that will elapse between system failures*. For example, if the MTBF is six months, you can expect that the system will fail once every six months, on average. - The **Mean Time to Repair** (MTTR) is the *average amount of time to restore a system* to its normal operating state after a failure. - The **Recovery Time Objective** (RTO) is the *amount of time that the organisation can tolerate a system being down* before it is repaired. The service team is meeting expectations when the time to repair is less than the RTO. - The **Recovery Point Objective** (RPO) is the *amount of data that the organisation can tolerate losing during an outage*.