Business Continuity and Disaster Recovery Services
CyberCrest provides business continuity and disaster recovery (BCDR) services to help companies prepare for disruptions and minimize downtime and data loss. An engagement starts with a business impact analysis and a data criticality analysis, which prioritize your critical assets and processes. From there, we set out what each plan must cover, review your team's drafts, and prepare the test scenarios.
METHODOLOGY
Our Business Continuity and Disaster Recovery Methodology
Our business continuity and disaster recovery consulting follows four steps, from scoping to the test of your plans.
Scoping
You decide which processes and systems your plans cover and which framework or customer request they have to answer. Scoping starts with a kickoff call and a walkthrough of your environment. We guide you through each choice and document the scope you decide on.
Business Impact and Criticality Analysis
We run the business impact analysis and the applications and data criticality analysis with your process owners, leadership, and business managers, who tell us how much downtime each process can bear. Together, the two analyses rank the processes and data your plans have to restore first.
Plan Review
In our review, we check each draft of your continuity and recovery plans against what the plan must cover and identify gaps for your team to close. Your team writes and approves the plans and chooses the backup strategy.
Testing
For the test, we prepare the scenario and stay with your team while they run it. We document the results, and your team revises the plans based on them.
SERVICES
What Our BCDR Services Include
Our business continuity & disaster recovery services start with two analyses that set your recovery priorities. The plan requirements, backup requirements, and test scenarios follow from them.
WHY US
Why Choose CyberCrest as Your Business Continuity and Disaster Recovery Company
Our work on your business continuity program sits inside a compliance practice, so the people who review your plans also know the frameworks that will examine them.
Each Plan Mapped to Its Framework
We map the parts each plan has to contain to the clauses of the framework in scope, then check your drafts against that map. Our review shows your team the gaps before an assessor or a customer reads the plan.
Accreditations Across Our Compliance Practice
Across our compliance practice, we are a PCI DSS Qualified Security Assessor Company (QSAC) and an Authorized External Assessor Organization for HITRUST. Our organization-level accreditations also include CMMC Registered Practitioner Organization (RPO).
Ready to Start
Some compliance firms take months to start work. We staff up in advance, so your BCDR engagement can begin right away with the kickoff call.
TESTIMONIALS
Hear from Our Clients
I have worked with CyberCrest on multiple compliance engagements over the past several years including HITRUST, NIS 2 and ISO 27001. Without exception, CyberCrest has consistently exceeded expectations for my clients through a combination of highly experienced consultants, and a practical approach to achieving compliance. They are willing to roll up their sleeves and help organizations fully understand and address their compliance challenges, not just function as external auditors.
“I have used the CyberCrest team for a variety of critical information security compliance engagements over the years including successfully attaining ISO 27001 and HITRUST certifications. All of our engagements have exceeded expectations!”
"We have worked with CyberCrest on multiple penetration testing and cybersecurity risk and maturity assessments. The CyberCrest team has consistently produced high quality deliverables at fair prices. We give their client prospects our strongest recommendation."
ABOUT BCDR
What Is the Difference Between Business Continuity and Disaster Recovery?
Business continuity keeps your business processes running during and after a disruption, and disaster recovery restores the information systems those processes depend on. Our guide to business continuity and disaster recovery walks through the steps of building a BCDR program. NIST's Contingency Planning Guide (SP 800-34 Rev. 1) describes the disaster recovery plan as information system-focused and notes that it may support a business continuity plan. NIST's guide identifies acceptable downtime in three ways:
- MTD (maximum tolerable downtime): the total time the system owner is willing to accept for a business process outage or disruption, including all impact considerations.
- RTO (recovery time objective): the longest a system resource can stay unavailable before the impact on other resources, on the business processes it supports, and on the MTD becomes unacceptable.
- RPO (recovery point objective): the point in time before an outage to which business process data can be recovered from the most recent backup; it reflects how much data loss the process can tolerate.
WHEN TO PLAN
When Your Organization Needs a Continuity Plan
Three situations can bring a company to us for business continuity planning: a customer asks, a regulator asks, or a plan has never been tested.
RELATED SERVICES
Additional CyberCrest Services
Frequently asked questions
What is a disaster recovery consultant?
A disaster recovery consultant is an outside expert who helps an organization prepare to recover its systems and data after a disruption. At CyberCrest, the consultant runs the impact analysis with your process owners, sets out what each plan must cover, and reviews your drafts. Your organization writes, approves, and maintains its own plans and runs the tests from scenarios the consultant prepares.
What does a business continuity plan typically include?
In NIST's Contingency Planning Guide (SP 800-34 Rev. 1), a business continuity plan focuses on sustaining an organization's mission and business processes, such as a payroll or customer service process, during and after a disruption. It may cover one business unit, the whole organization, or only the functions deemed priorities. Because those processes use information systems, the planner coordinates with the system owners so the plan's expectations and the systems' capabilities match.
What elements should a disaster recovery plan cover?
Under NIST SP 800-34 Rev. 1, a disaster recovery plan restores the operability of a system, application, or computer facility at an alternate site after an emergency. It may be supported by system-level contingency plans that hold the detailed recovery procedures for each system. The HIPAA Security Rule asks the disaster recovery plan to set procedures to restore any loss of data.
What is disaster recovery testing?
Disaster recovery testing checks whether a recovery plan works before a real disruption does. NIST's Contingency Planning Guide puts it this way: "Testing validates recovery capabilities, whereas training prepares recovery personnel for plan activation and exercising the plan identifies planning gaps." Among the test methods NIST SP 800-53 names are walk-through and tabletop exercises and simulations.
What is a business continuity disaster recovery policy?
NIST's Contingency Planning Guide calls this document the contingency planning policy statement, the first of its seven steps. In the guide's words, "A formal policy provides the authority and guidance necessary to develop an effective contingency plan." The policy sets the program's objectives and responsibilities and its testing and maintenance schedules, with senior management's support.
What is a business impact analysis?
A business impact analysis (BIA) shows which processes and systems an organization needs back first after a disruption. NIST SP 800-34 Rev. 1 says the BIA "helps identify and prioritize information systems and components critical to supporting the organization's mission/business processes." It records outage impacts, estimated downtime, resource requirements, and recovery priorities, which set each system's recovery objectives.
