Disaster recovery guidelines

Transcription

1 The Right Approach to Disaster Recovery Some images 2002 www artto Disaster recovery guidelines Banks Group Services Pty Ltd ABN Burwood Road HAWTHORN VIC 3122 Phone: (03) Fax: (03)

2 Disaster Recovery Guidelines Version 1 The Right Approach to Disaster Recovery Introduction to Disaster Recovery Plans Welcome to the Right Approach to Disaster Recovery. This guide has been designed to help you prepare for a potential disaster in your business. Although it is hoped a disaster never happens to you, as recent events show us, even the unimaginable can sometimes happen. Every business faces the possibility of some event happening that may prevent it from maintaining normal activity. This may be something like hail damage, a flood, vandalism, fire, security breach, system breakdown etc. How quickly your business gets back to normal operations is dependent on how well the recovery is planned. Every one wants to get back to business as quickly, inexpensively and smoothly as possible. Many of us have experienced the numbing inaction that can come as the result of a major trauma. A well prepared disaster recovery plan removes the need to think in these situations because all the thinking has been done well before the event. This guide contains: Section 1 Risk Management versus Disaster Recovery Section 2 Disaster Recovery Plan process The Right Approach to Disaster Recovery Page 2

3 Disaster Recovery Guidelines Version 1 Section 1 - Risk management vs disaster recovery Risk Management A risk management plan looks at those situations that may prevent you from achieving your business goals. Risks may be, for example, such things as: Economic or legislative changes Skill levels of staff Increased competition. Careful planning and preparation helps minimise the impact of risks to your business. Disaster Recovery A disaster recovery plan looks at those situations that prevent you from carrying on business. Careful planning helps your business get back to normal operations as quickly as possible. A risk management plan and disaster recovery plan should form part of every business s strategy. Use the Risk Management Plan document that forms part of the Right Approach to Risk Management Series. The Right Approach to Disaster Recovery Page 3

4 Disaster Recovery Guidelines Version 1 Section 2 Disaster Recovery Planning Process There are six steps to creating a disaster recovery plan. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Preparation Assessing impact Putting the plan together Testing Training the team Maintaining the plan Each of these steps is explained in detail below. When preparing your disaster recovery plan, do not skip any step. The steps have been designed to ensure your disaster recovery plan is properly prepared and sufficiently robust to meet your needs. Step 1 Preparation Do it now! Do not leave your disaster recovery plan for when things are quieter or there is more time. Disaster can strike at any time and you need to be prepared. Form a project team to create your disaster recovery plan. The project team should be made up of key people from every area or team of your business. This is because recovery, for say the audit team will be very different to that required by the technical/systems team. The needs of each key area must be captured in your plan. If your business does not have defined teams, involve others in the plan as this gives you the opportunity to debate ideas and generate additional suggestions. Step 2 assessing impact 1. Your project team should brainstorm ideas of possible disasters, no matter how unlikely. 2. Once a comprehensive list is created, using the template in Appendix 1, assess each situation for: Likelihood, that is the probability of the event occurring Severity, that is how badly is it likely to affect the business. The Right Approach to Disaster Recovery Page 4

5 Disaster Recovery Guidelines Version 1 Use the following scales: Likelihood Never happen Unlikely Possible Likely Definite Severity None Minimal Moderate Significant Major Step 3 putting the plan together Once the assessment is completed, you can start putting your disaster recovery plan together. Your plan will contain four sections: Part 1 Immediate contact list Part 2 All staff contact list Part 3 Our action plan Part 4 Contingency plans Here are some hints on documenting your disaster recovery plan: Part 1 Immediate contact list 1. Not everyone in your business will need to be told of the disaster at the same time. Your project team is to decide who are the critical people in the organisation who have to know and in what order. For example: CEO Managing Partner Chairman Using Section 1 of the Disaster Recovery Plan template in Appendix 2, complete the contact information your plan will contain, and the communication structure your business will use in the event of a disaster. Part 2 All staff contact list 2. Identify all other staff in your business that need to be notified of the disaster and complete their contact details in Section 2 of the plan. These individuals will have a thorough working knowledge of the plan and know exactly what their role and duties are under the plan. 3. Schedule regular reviews of the contact list to ensure it remains up to date. The Right Approach to Disaster Recovery Page 5

6 Disaster Recovery Guidelines Version 1 Part 3 Our action plan 4. Consider all of the functions in your business and decide what critical actions need to be completed in case of a disaster. Ask the following questions What happens immediately after the disaster occurs? Do we need to call emergency services? Police, fire, ambulance, SES? Who else needs to be told immediately? What are the critical functions in the business? 5. Decide on what activities need to be resumed and in what order and complete this information in Section 3 of your plan, noting: Who is required What actions will be undertaken The equipment required etc Part 4 Contingency Plans 6. Unfortunately no plan is completely foolproof, no matter how well it is prepared. As you develop your plan and consider the above three points, think about contingencies in the event that a step cannot be followed. For example: The Managing partner cannot be contacted so who do we contact? All the phone systems are down, how is everyone told? The three key people to contact are all out of the state, who takes charge? Our alternative office site was also involved, where do we go? At each step of your plan, think about what can go wrong and what you can do to overcome it. Prepare your contingency plans and complete Section 4 of the disaster recovery plan. The Right Approach to Disaster Recovery Page 6

7 Disaster Recovery Guidelines Version 1 Step 4 testing You now have a good working first draft of your plan. It is pointless, however, to wait for a disaster to see if your plan works. That is why thorough testing of your plan is recommended to test for weaknesses and areas that do not work effectively. The testing process requires you to replicate one of your disaster scenarios as closely as possible. For example, assume that there has been a fire in your building and the damage is extensive. You are first on the scene, what do you do? Using your created plan, enact each step of your disaster recovery plan and record: How easily key people were notified Whether critical activities were carried out in accordance to plan What worked well What went wrong What changes need to be made Did contingency plans work? Test everything. If it doesn t work in the test, it is unlikely to work in a disaster. You may also want to ask your local emergency services for assistance. Fire/Police/Ambulance/SES are usually happy to help people prevent disasters and may suggest useful improvements to your plan to help make their job easier. Step 5 - training Once your plan has been tested and all necessary changes made, it is critical that it be communicated to your staff. Staff members must be aware of what happens and what activities they are responsible for under the plan. As with the entire process, this is a serious matter and it is essential that everyone understands the steps to be taken in case of a disaster. Remember that a disaster can result in people being badly shocked. People experiencing severe shock can rarely think with clarity. Training will not completely deal with these situations however, but the objective is to develop a mechanical reaction to following the plan. In other words, on discovery of the disaster, everyone knows exactly what they have to do. Importantly, where activities are dependent on others, staff should be aware of who is responsible for those activities and what actions are required in the event of a disaster. This avoids duplications or actions omissions. For example, Staff Member A is responsible for notifying clients. This requires access to system records. Staff Member B is responsible for reconnecting system access and so A will need to approach B to access the system. The Right Approach to Disaster Recovery Page 7

8 Disaster Recovery Guidelines Version 1 Step 6 maintaining the plan Your plan is created! As with most things in business, your disaster recovery plan is not a set and forget. It is essential that your plan is regularly maintained to keep up to date with changes to your staff, business processes and environment. The final step in your disaster recovery plan is to assign responsibility for the plan to a senior staff member or partner or manager. This person will be responsible for regularly reviewing the plan and making all necessary changes to the plan as they occur. Where any changes are made, retest the plan to ensure that the changes work. Remember, it is pointless testing the plan when the disaster happens. Here is a suggested review schedule: Contact information Brief review Monthly Quarterly Half yearly Annually P P Full review P P (min) A lot can change in 12 months and leaving your plan to lapse can be, well, a disaster. Don t let it happen to you. The Right Approach to Disaster Recovery Page 8

9 Appendix 1 brainstorming sessions Event Likelihood Severity Never Unlikely Possible Likely Definite None Minimal Moderate Significant Major The Right Approach to Disaster Recovery Page 9

10 Appendix 2 disaster recovery plan template Section 1 Immediate contact list Order Name Address Phone 1 Phone 2 Fax Mobile Pager The numbering order is the priority in which these key people will be notified. Subsequent contact will be made as follows: Person 1 Person 2 Person 3 Person 4 Person 5 Person 6 Person 7 Person 8 Person 9 Person 10 The Right Approach to Disaster Recovery Page 10

11 Section 2 - All staff contact list Priority Name Address Position Phone 1 Fax Mobile Pager The Right Approach to Disaster Recovery Page 11

12 Section 3 Our Disaster Recovery Plan Staff required (names) Phones/ mobiles faxes computers laptops # desks & chairs System access Files Activities Day 0 B Smith N/A Initiate communication Day 1 B Smith CEO S Jones PA N/A Day 2 A Bett Staff contact # Secure premises Notify insurers Determine loss of records Finalise communication Settle offsite office Reestablish system access Secure temporary hardware Day 3 etc etc etc etc etc etc etc etc etc Day 4 etc etc etc etc etc etc etc etc etc Day 5 etc etc etc etc etc etc etc etc etc Week 2 All staff All client All clients notified Tax work recommences Week 3 Week 4 Month 2 Month 3 The Right Approach to Disaster Recovery Page 12

13 Section 4 - Contingency Plans If Bob Smith cannot be located Bob Smith and Murray Glass are out of state All office phones destroyed Ring Murray Glass Jenny Rock is in charge Staff to ring central number Then The Right Approach to Disaster Recovery Page 13

14 Appendix 3 blank templates Staff required (names) Phones/ mobiles faxes computers laptops # desks & chairs System access Offsite office Activities Day 0 Day 1 Day 2 Day 3 Day 4 Day 5 Week 2 Week 3 Week 4 Month 2 Month 3 The Right Approach to Disaster Recovery Page 14

15 Contingency Plan If Then The Right Approach to Disaster Recovery Page 15