Start for free Start for free

Business Continuity and Disaster Recovery

Business continuity and disaster recovery (BCDR) is a vendor's plan for keeping its service running during a major outage and restoring systems and data afterward. Two numbers sum it up: how much data could be lost (RPO) and how long recovery takes (RTO).

What is business continuity and disaster recovery?

Business continuity is the plan for keeping a service running when something big goes wrong, such as a data center outage or a cyberattack. Disaster recovery is the plan for restoring systems and data afterward. Together they are often called BCDR, or BCP and DR.

Two numbers sum up the plan:

  • Recovery point objective (RPO): how much data you could lose, measured in time. An RPO of 24 hours means you could lose up to a day of work.
  • Recovery time objective (RTO): how long the vendor aims to take to get the service back.

What it looks like in vendor documents

Atlassian's security practices page says it plans around RTO and RPO for each service, using a four-tier system, but does not publish the numbers. It keeps daily database snapshots for 30 days, and says backups are not used to undo deletions customers make themselves.

Its Security Measures add quarterly disaster recovery tests and exercises, with analysis after each test.

Why it matters to you

If a key vendor goes down, your product or team may stop with it, and your own customers will ask what happened. Your SLA may pay service credits, but credits rarely cover your real loss.

Backups do not always protect you from yourself. If someone on your team deletes data, the vendor's disaster backups may not help, so you may need your own data export.

What to check

  • Ask for the RPO and RTO for the product you use, in writing.
  • Check how often backups run, how long they are kept, and where they are stored.
  • Ask when the plan was last tested and what the result was.
  • Check whether the SOC 2 scope includes the availability category.
  • For vendors you cannot work without, plan your own fallback. See concentration risk.

How Venpo helps

Venpo monitors your vendors' SLAs, security addenda and trust center pages, and emails you in plain English when uptime, backup or recovery commitments change. Each vendor gets a change history you can use in reviews.

Start for free

Frequently asked questions

What is a good RPO and RTO for a SaaS vendor?

It depends on how much you rely on the tool. For a system your business stops without, ask for hours, not days, and get the numbers in writing.

Is a backup the same as disaster recovery?

No. A backup is a copy of data, while disaster recovery is the whole plan for restoring the service, including people, systems and testing.

Related terms

Vendor Documents Service Level Agreement (SLA) A service level agreement (SLA) is a vendor's written promise about how well its service will run, usually a monthly uptime percentage. If the vendor misses it, you typically get only small service credits. Vendor Management Concentration Risk Concentration risk is the danger that many of your vendors rely on the same cloud provider, AI model or other supplier underneath. If that one supplier fails, changes its terms or has a breach, several of your tools are hit at once. Liability and Risk Service Credits Service credits are discounts on a future bill that a vendor gives when it misses its promised uptime, often a percentage of the monthly fee that you must request before a deadline. How Vendors Use Your Data Data Export and Portability Data export and portability is your ability to download your data from a vendor in a usable format, such as CSV or JSON, so you can keep it or move it to another tool. Security and Compliance SOC 2 Scope SOC 2 scope is the boundary of what a SOC 2 report covers: which products, systems, locations, legal entities, trust services categories and time period. Anything outside it was not examined, even if it carries the same brand. Vendor Management Vendor Risk Assessment A vendor risk assessment is a check of how much risk a vendor brings, based on the data it gets, how much you depend on it and what its documents promise. You do it before you sign and again when something important changes.

Sources

Last reviewed