Delve Tech Due Diligence · Meta-Analysis
Business continuity, disaster recovery, and the policy-vs-practice gap
Resilience Feature Adoption
The Policy-vs-Practice Gap
Every company has a BCDR policy (100%). But the drop-off from policy to practice is dramatic:
The critical gap: 100% have a BCDR policy, but only 51% test it annually and only 28% have multi-region failover. Most companies have a plan they've never tested for a disaster they can't recover from quickly.
What this means for investors:
A BCDR policy without annual testing is a checkbox, not a capability. Ask to see DR test results — the date, the scenario, the recovery time, and what was fixed afterward.
Only 22% have cyber insurance. For companies handling sensitive data, this is a material gap in financial risk transfer.
Multi-AZ (88%) is nearly universal — the industry has standardized on AZ-level redundancy. Multi-region (28%) remains expensive and rare.
Generated from bcdr & resilience module · 485 SOC 2 compliance reports · 2026-03-24