Preparing to handle disasters

To successfully manage business continuity during a disaster and restore normal operations, organizations require a good disaster recovery plan.

When disaster strikes, organizations must mobilize all the talent and resources needed to continue their operations and return to a normal state. Every department in an organization has responsibilities during a disaster. Planning for a disaster and then dealing with one is a team effort by people from all parts of an organization.

If any part of this team does not have a good grasp of the whole plan, then the groups are merely working side by side, instead of working together in an integrated fashion to solve a problem. It requires much more than a battalion of dedicated sandbaggers to survive most disasters. When the alarm sounds, the organizations that most successfully deal with disasters are the ones that run like proverbial well-oiled machines.

The underlying philosophy of disaster recovery needs to be rooted in an organization’s desire to protect and preserve its positive public image, as well as its physical assets and the lives of employees. This image includes the high levels of customer satisfaction and the faith of stockholders and other stakeholders that an organization has worked so hard to develop. The author of the book Guide to Disaster Recovery surveyed over 250 organizations to determine trends and problems in disaster recovery planning and preparation. The status of disaster planning in these organizations varied considerably:

One out of every ten of the organizations surveyed do not have a plan in place

Two out of every ten of the organizations surveyed have plans in the development stage

One out of every ten of the organizations surveyed have had plans in place less than one year.

Three out of every ten of the organizations surveyed have had plans in place from 2 to 5 years

One out of every ten of the organizations surveyed have had plans in place from 6 to 10 years

Two out of every ten of the organizations surveyed have had plans in place for over ten years

Disaster recovery planning activity has intensified considerably since September 2001. Three out of every ten organizations surveyed for the book report that disaster recovery planning spending has increased slightly and one our of ten reported that spending has increased dramatically:

Three out of every ten organizations report that disaster recovery planning spending has stayed about the same

Three out of every ten organizations report that disaster recovery planning spending has increased slightly

One out of every ten organizations report that disaster recovery planning spending has dramatically

None of the organizations report that disaster recovery planning spending has decreased dramatically

Three out of every ten organizations stated that disaster recovery planning spending trends cannot be revealed

The Basic Principles of Disaster Recovery Planning

This book provides a step-by-step process for determining which elements belong in a disaster recovery plan and how to implement, test, and manage this plan over a long period of time. The following principles provide a foundation for understanding disaster planning. They will help guide the people in an organization who need to develop the plan.

• Developing a solid disaster recovery plan requires the support and participation of upper-level managers, the directors of all functional departments such as human resources, facilities management, information technology (IT), corporate security, and legal counsel, and the managers of all business units.
• Assessing an organization’s risks requires time-consuming, detailed analysis based on a realistic understanding of the environmental, economic, social, and political conditions in which the organization, its suppliers, and its customers operate.
• All policies and procedures in the disaster recovery plan must support the critical needs of business operations, comply with all relevant laws and regulations, be understood by the parties responsible for implementing them, and be approved by upper management.
• The disaster recovery plan must clearly delineate and document the chain of command of the managers responsible for declaring, responding to, and recovering from a disaster. The plan must also document the role of each department and outside support organization in a disaster.
• The disaster recovery system must facilitate and allow control of communications among decision-makers, managers, and staff, as well as with external support organizations, law enforcement, emergency services, and media.
• All policies and procedures in the disaster recovery plan must be documented clearly so that all participating employees can understand and implement them.
• Disaster recovery policies and procedures must be available to all departments, managers, and staff at all times during disaster response and recovery.
• All employees involved in disaster response and recovery must be trained to implement documented procedures and to address unanticipated problems.
• Disaster recovery procedures must be tested and rehearsed. Planners should evaluate each test and rehearsal to determine weaknesses in the plan, and use the results of these evaluations to modify the plan, procedures, or training.
• Planners must continually evaluate new threats and business conditions as they develop, and then update disaster recovery plans and procedures accordingly.
• During disaster response and recovery, the organization must evaluate the effectiveness of its procedures and monitor the physical safety and mental health of employees at all times. The results of these evaluations should be used to improve the disaster recovery abilities of the organization.

Understanding the basic principles of disaster recovery planning can keep team members from getting lost in the long process of developing a solid plan for their organization. As the team is assembled, all members should be briefed on the basic planning principles and the eight steps of developing a plan, as discussed later in this chapter. This information will help team members understand how the pieces fit together to form an integrated, comprehensive plan.

Disaster Recovery Planning Steps

Disaster recovery planning can be broken down into eight major steps. Each step is interrelated and builds upon the others. The disaster recovery planning team is responsible for developing the disaster recovery plan. Every member of the team needs to be familiar with the following steps and how they relate to each other:

• Step One: Organizing the team
• Step Two: Assessing risks in the enterprise
• Step Three: Establishing roles across departments and organizations
• Step Four: Developing policies and procedures
• Step Five: Documenting disaster recovery procedures
• Step Six: Preparing to handle disasters
• Step Seven: Training, testing, and rehearsal
• Step Eight: Ongoing management

These basic steps provide a guide for project managers to organize and plan their efforts over a long period of time. The steps also serve as important milestones for the planning team. Building a solid disaster recovery plan can take many months and, in some cases, years. When team members understand where they are in the planning stages, they will be less frustrated by what many people consider a long and tedious process.

Team members also need to know that the plan will require ongoing evaluation and maintenance once it is developed. To be effective, the plan must be updated to assure that business operations are sustainable over long periods of time.