Your expert in backup and data protection!The solution tailored to your needs
DRP and BCP
What is a BCP?
A business continuity plan (BCP) aims to keep essential services running during an outage, with an interruption short enough that users barely notice it. The standby is ready before the incident: it is not ordered on the day the server goes down.
Key points
- A company BCP covers premises, people, suppliers and IT; the IT component is only one part of it.
- On the IT side, it requires a second instance already fed with data and a mechanism that sends traffic to it when the first one stops responding.
- The most frequently overlooked point: switching back to the original server without losing the data entered on the standby.
- A BCP handles outages; it does not remove the need for a backup with version history against ransomware and deletion.
The official definition
The SGDSN, the French body responsible for national security, defines in its reference guide the BCP as the set of measures intended to ensure, under various crisis scenarios, the continuation of the company’s essential services and tasks, temporarily in degraded mode if necessary, followed by the planned resumption of activities. Two ideas stand out: a reduced service is accepted, and continuity includes recovery.
NIST, the US standards body, makes the same distinction between the business continuity plan, which sustains business processes during and after the disruption, and the disaster recovery plan, focused on restarting systems. The international reference standard for a business continuity management system is ISO 22301.
Business continuity, not just IT continuity
A company’s BCP goes beyond servers: premises, people, suppliers, telephony, the ability to invoice. The IT component is only one part of it. This page deals with that component. A perfect IT BCP will not save a company where nobody knows how to take a customer’s payment any more.
How the IT standby is built
- A copy of the critical systems runs, or is kept up to date, in another location.
- Something monitors production (an agent, a load balancer, an address witness).
- In the event of a clear-cut failure, traffic fails over. Workstations keep calling the same address, or a standby address they already know.
- When the original comes back, you fail back in the opposite direction, without losing the data entered on the standby in the meantime. This is the most frequently overlooked point, and it is what makes BCPs fail on paper.
The cost is permanent: you pay for the standby on days when everything is fine. That is the price of a takeover in minutes rather than hours. The details are in How much does a BCP cost?.
What a BCP requires of applications
- A possible network failover (same IP address on site, or DNS with an accepted propagation delay).
- Consistent data on the standby. A database copied in the middle of a transaction may start and still be wrong.
- Licences that allow running on the standby.
- Enough bandwidth between the site and the standby for remote users to work.
- One person authorised to declare ‘this is an outage’, to avoid phantom failovers.
- Security maintained in degraded mode: the CNIL (the French data protection authority) makes this point in its fact sheet on business continuity and recovery.
If any of these points is missing, the advertised BCP is in fact a DRP: you will be able to restart, later.
BCP and backup
A BCP does not remove the need for backup. The standby can itself be compromised if replication is too faithful and too fast (it copies the ransomware). Backup history, ideally immutable, remains the way back to a clean state. The BCP deals with outages. Backup deals with corruption and deletion.
In the event of ransomware, Europol and the No More Ransom project advise against paying the ransom: the way out runs through the business continuity and disaster recovery plans, then restoring data from a backup made before the attack. The two tools work together: see Ransomware has just been triggered.
At WeDoBack
The WeDoBack BCP keeps cloud instances permanently running. An agent installed on the customer’s network handles the takeover to these instances over an IPsec VPN, without any change of IP address: users do not reconfigure their workstations. When the original server has been repaired, the agent can hand traffic back to it. Replication or synchronisation of data between the BCP instance and the original server is not supported natively: it requires a specific process, defined according to need (database, files, business application), including to carry over to the repaired server the data entered on the instance during the incident. WeDoBack can set this up on quotation. Storage starts at €8.75 excl. VAT per month for 50 GB (i.e. €175 excl. VAT per TB), and instances at €50.22 excl. VAT per month, plus one agent per server. These amounts run permanently, including when there is no incident. Copies are encrypted on the machine before they are sent and stored on dedicated servers, separate from production. Endpoint control and anti-ransomware tools are included, as with the DRP; automated vulnerability remediation remains a paid option.
Frequently asked questions
Is a BCP more expensive than a DRP?
Generally yes, on a monthly basis: the standby instances run permanently, whether or not there is an incident. That is the price of a takeover in minutes rather than hours. NIST, the US standards body, also ranks ‘hot’ standby sites, ready immediately, as the most expensive.
Does a BCP protect against ransomware?
Not on its own. If replication to the standby is fast and faithful, it can copy files that have already been encrypted. You need to keep a backup with version history, ideally immutable, so you can return to a version from before the attack.
Should every server be covered by a BCP?
Rarely. A BCP is reserved for services whose downtime, even brief, costs more than permanent standby. The other servers are covered by a DRP or a well-tested backup.
Further reading
Sources
Documents consulted in October 2026.
- Guide to drawing up a business continuity plan (2013 edition, in French) — SGDSN (France)
- SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems — NIST
- ISO 22301 – Business continuity — ISO
- GDPR practical guide – Personal data security (2024 version, in French) — CNIL (French authority)
- No More Ransom: advice and decryption tools against ransomware — Europol and partners
- BCP offer: immediate business continuity — WeDoBack
Planning a backup, DRP or BCP project?
More than 20 years of experience protecting business data.
Request a quote+33 9 72 50 78 28Protect your data with WeDoBack
Encrypted offsite backup, immutable storage, DRP and BCP: tell us about your servers and we will recommend the right combination.