Understanding the Disaster Recovery Planning Process

Volume 4 Issue 44

July 2005

If any part of this team does not have a good grasp of the whole plan, then the groups are merely working side by side, instead of working together in an integrated fashion to solve a problem. It requires much more than a battalion of dedicated sandbaggers to survive most disasters. When the alarm sounds, the organizations that most successfully deal with disasters are the ones that run like proverbial well-oiled machines.

The underlying philosophy of disaster recovery needs to be rooted in an organization’s desire to protect and preserve its positive public image, as well as its physical assets and the lives of employees. This image includes the high levels of customer satisfaction and the faith of stockholders and other stakeholders that an organization has worked so hard to develop. The author of the book Guide to Disaster Recovery surveyed over 250 organizations to determine trends and problems in disaster recovery planning and preparation. The status of disaster planning in these organizations varied considerably:

• One out of every ten of the organizations surveyed do not have a plan in place
• Two out of every ten of the organizations surveyed have plans in the development stage
• One out of every ten of the organizations surveyed have had plans in place less than one year.
• Three out of every ten of the organizations surveyed have had plans in place from 2 to 5 years
• One out of every ten of the organizations surveyed have had plans in place from 6 to 10 years
• Two out of every ten of the organizations surveyed have had plans in place for over ten years

Disaster recovery planning activity has intensified considerably since September 2001. Three out of every ten organizations surveyed for the book report that disaster recovery planning spending has increased slightly and one our of ten reported that spending has increased dramatically:

• Three out of every ten organizations report that disaster recovery planning spending has stayed about the same
• Three out of every ten organizations report that disaster recovery planning spending has increased slightly
• One out of every ten organizations report that disaster recovery planning spending has dramatically
• None of the organizations report that disaster recovery planning spending has decreased dramatically
• Three out of every ten organizations stated that disaster recovery planning spending trends cannot be revealed

This book provides a step-by-step process for determining which elements belong in a disaster recovery plan and how to implement, test, and manage this plan over a long period of time. The following principles provide a foundation for understanding disaster planning. They will help guide the people in an organization who need to develop the plan.

• Developing a solid disaster recovery plan requires the support and participation of upper-level managers, the directors of all functional departments such as human resources, facilities management, information technology (IT), corporate security, and legal counsel, and the managers of all business units.
• Assessing an organization’s risks requires time-consuming, detailed analysis based on a realistic understanding of the environmental, economic, social, and political conditions in which the organization, its suppliers, and its customers operate.
• All policies and procedures in the disaster recovery plan must support the critical needs of business operations, comply with all relevant laws and regulations, be understood by the parties responsible for implementing them, and be approved by upper management 
• The disaster recovery plan must clearly delineate and document the chain of command of the managers responsible for declaring, responding to, and recovering from a disaster. The plan must also document the role of each department and outside support organization in a disaster.
• The disaster recovery system must facilitate and allow control of communications among decision-makers, managers, and staff, as well as with external support organizations, law enforcement, emergency services, and media.
• All policies and procedures in the disaster recovery plan must be documented clearly so that all participating employees can understand and implement them.
• Disaster recovery policies and procedures must be available to all departments, managers, and staff at all times during disaster response and recovery.
• All employees involved in disaster response and recovery must be trained to implement documented procedures and to address unanticipated problems.
• Disaster recovery procedures must be tested and rehearsed. Planners should evaluate each test and rehearsal to determine weaknesses in the plan, and use the results of these evaluations to modify the plan, procedures, or training.
• Planners must continually evaluate new threats and business conditions as they develop, and then update disaster recovery plans and procedures accordingly.
• During disaster response and recovery, the organization must evaluate the effectiveness of its procedures and monitor the physical safety and mental health of employees at all times. The results of these evaluations should be used to improve the disaster recovery abilities of the organization.

Disaster recovery planning can be broken down into eight major steps. Each step is interrelated and builds upon the others. The disaster recovery planning team is responsible for developing the disaster recovery plan. Every member of the team needs to be familiar with the following steps and how they relate to each other:

• Step One: Organizing the team
• Step Two: Assessing risks in the enterprise
• Step Three: Establishing roles across departments and organizations
• Step Four: Developing policies and procedures
• Step Five: Documenting disaster recovery procedures
• Step Six: Preparing to handle disasters
• Step Seven: Training, testing, and rehearsal
• Step Eight: Ongoing management

These basic steps provide a guide for project managers to organize and plan their efforts over a long period of time. The steps also serve as important milestones for the planning team. Building a solid disaster recovery plan can take many months and, in some cases, years. When team members understand where they are in the planning stages, they will be less frustrated by what many people consider a long and tedious process.

Team members also need to know that the plan will require ongoing evaluation and maintenance once it is developed. To be effective, the plan must be updated to assure that business operations are sustainable over long periods of time.

In next issue you will read:
How to Counter Security Threat
Reporting A Computer Crime
Information to Help Investigators
Information to Determine Damages or Loss

About the author

Michael Erbschloe is an information technology consultant, educator, and author. He has also developed technology-related curriculum for several universities and speaks at conferences and industry events around the world. Michael holds a Master Degree in Sociology from Kent State University. He has authored hundreds of articles on technology and several books including Guide to Disaster Recovery published by Course Technology. When instructors select the Guide to Disaster Recovery for use in their school Michael provides support to help develop their course on a gratis basis. He also provides onsite presentations for an honorarium that is customary for their institution.

Email this article to a friend

Email a friend a link to our web site

Have you seen a safety device you think our readers should know about?
Does your company make or sell a safety device you would like to see featured in this column?
If so, please e-mail the information about the device to Safety Issues.
The purpose of this column is to make your life safer with the use of the latest technology.
Neither Safety Issues nor its affiliated companies are responsible for any opinions expressed in this column.
Thank you for reading this column.

  © 2008 SafetyIssues.com, Inc. All Rights Reserved.