Disaster Recovery is a _________.

Disaster Recovery (DR) is fundamentally a business-centric strategy. While it involves technical operations (recovering servers, data, networks), its objectives, priorities, and scope are dictated by business needs. The Business Impact Analysis (BIA) process identifies critical business functions and sets the Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for the underlying technology. Therefore, the entire DR strategy is designed to support business continuity and resilience, making it business-centric.

A. Operation-centric strategy: This is too narrow; DR is driven by business requirements, not just the operational mechanics of recovery.
B. Security-centric strategy: DR is a component of a comprehensive security program, but its primary goal is availability and continuity, not security itself.
C. Data-centric strategy: While data recovery is a critical part of DR, the strategy also encompasses systems, applications, personnel, and facilities.

1. National Institute of Standards and Technology (NIST). (2010). Special Publication 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems. Section 3.2, "Business Impact Analysis (BIA)," emphasizes that contingency planning efforts are guided by the BIA, which identifies and prioritizes the organization's critical business processes.

2. Uhlig, R., et al. (2017). Dependable and Secure Computing. Lecture Notes, CS 598, University of Illinois Urbana-Champaign. The courseware discusses how DR objectives are derived from business-level requirements for continuity.