{
  "uid": "cogitave.learn.respond-to-incidents.business-continuity",
  "kind": "moduleUnit",
  "href": "/modules/respond-to-incidents/business-continuity/",
  "title": "Business continuity and disaster recovery",
  "summary": "",
  "type": null,
  "products": [],
  "roles": [],
  "levels": [],
  "subjects": [],
  "headings": [
    "The chain, in one line",
    "Service tiers: RTO/RPO and DR strategy",
    "Activation: when this stops being a routine incident",
    "Recovery order and failback"
  ],
  "source": "A single service outage is an incident. A cloud region loss, a destructive\nransomware attack, or a critical vendor failure is bigger than one incident -\nit threatens the estate's ability to keep operating at all. That is what\n[`business-continuity/`](../../../../ops/business-continuity/README.md)\ncovers, and it runs on the same discipline as incident response, one level up.\n\n## The chain, in one line\n\nThe [BC/DR README](../../../../ops/business-continuity/README.md) states the\nprogram in one line: **BIA decides what matters -> tiers fix RTO/RPO -> backups\nand DR strategy meet them -> exercises prove it -> evidence goes to WORM.**\nThe [Business Impact Analysis (BIA)](../../../../ops/business-continuity/docs/bia.md)\nscores each service's impact and derives its **MTPD** (Maximum Tolerable Period\nof Disruption); [service tiers](../../../../ops/business-continuity/docs/service-tiers.md)\nthen assign the smallest tier band whose **RTO is always less than MTPD**.\n\n## Service tiers: RTO/RPO and DR strategy\n\nFour tiers fix how fast a service must return (**RTO**) and how much data loss\nis tolerable (**RPO**), each paired with an AWS Well-Architected DR strategy:\n**tier-0** (mission-critical, RTO <= 1 h, warm standby/multi-site), **tier-1**\n(critical, RTO <= 4 h, pilot light -> warm standby), **tier-2** (important,\nRTO <= 24 h, backup & restore), and **tier-3** (standard, RTO <= 72 h,\nbackup & restore/redeploy-from-IaC). The technical design that meets each tier\n- cross-region replication, PITR, the paired DR region - is the\n[DR plan](../../../../ops/business-continuity/docs/dr-plan.md); the backup\nmechanics (3-2-1-1-0, immutable/WORM copies, verified restores) are the\n[backup strategy](../../../../ops/business-continuity/docs/backup-strategy.md).\n\n## Activation: when this stops being a routine incident\n\nThe [Business Continuity Plan (BCP)](../../../../ops/business-continuity/docs/bcp.md)\nis explicit that it does **not** replace incident response - it **escalates**\nfrom it. A routine incident is handled under\n[`incident-response/`](../../../../ops/incident-response/README.md); the\nIncident Commander **declares** BC/DR activation when a tier-0/1 service will\nbreach its RTO, data loss may exceed RPO, a destructive or security event is\nconfirmed, a primary region is lost, or an exercise inject calls for it. As in\nincident response, the rule when uncertain is to **declare**: under-declaring\ncosts recovery time.\n\n## Recovery order and failback\n\n> [!NOTE]\n> Recovery proceeds in **dependency order**, not tier-number order alone: the\n> [DR plan](../../../../ops/business-continuity/docs/dr-plan.md) sequences\n> **identity** first, then **secrets/PKI**, then the **API/MCP gateway and\n> Core**, then observability, then tier-1 products - because nothing else is\n> operable without the layers beneath it.\n\nRecovery is not finished at failover. The BCP requires **failback**: validate\ndata consistency, drain traffic back to the primary region in a controlled\nwindow, confirm SLOs and backups are healthy, then stand down. The\n[test-and-exercise program](../../../../ops/business-continuity/docs/test-and-exercise.md)\n- tabletops, restore drills, failover drills, and an annual game-day - is what\nturns every RTO/RPO from a claim into something measured, and every\nactivation, exercise, and restore test is retained as evidence per the\n[retention schedule](../../../../compliance/docs/retention.md).\n",
  "partOf": "cogitave.learn.respond-to-incidents",
  "durationInMinutes": 9,
  "quiz": null
}