How To Write A Disaster Recovery Plan

Transcription

1 GETTING A DISASTER RECOVERY PLAN STARTED PureCNS Information Leaflet 002 August 2014 Getting a Disaster Recovery Plan Started Having a disaster recovery plan for your organization could be one of the most vital elements in your organization's long-term stability. For some, the process of creating a disaster recovery plan can seem overwhelming at the outset, but this effort could one day save your organization. Disasters take many shapes and sizes and can strike at anytime. In the shadow of daily commitments making a disaster recovery plan may seem cumbersome and peripheral. But when a catastrophe does come, the process - hopefully not left until it's too late -- will immediately become a top priority. Company Awareness The first step in disaster recovery planning is realizing that there is a need for this type of preparation. Organizations that value their businesses need to establish and maintain effective disaster recovery plans. In times of need, these plans can minimize interruptions in normal business operation and will limit the extent of damage and disruption in business productivity. The responsibility to setup disaster recovery plans falls to an organization's board and executives. They must organize and maintain a clear outline of what actions they want taken and which employees need to play a part in the process of disaster recovery should unforeseen events occur. Disaster recovery plans should be well known and well rehearsed by all who will have a role in the recovery process. All management and staff should be aware of the disaster recovery plan and what is required of them in the event of a serious disaster. The Planning Project There are several fundamental elements that should be included in any disaster recovery pan. Every plan should involve basics such as emergency response protocol, procedures for backing-up data, software, etc., and detailed outlines of which staff should be involved in the recovery process and what specific actions they should take in order to get the organization up and running like normal again with the least amount of cost and in the shortest amount of time. When an organization is ready to begin creating its disaster recovery plan, the first thing it should do is set goals for its disaster recovery plan: for example, what should the plan accomplish, and it what sort of time frame? Second, the organization should create an accurate, up to date list of personnel for each of its departments. The third part of the plan involves making a list of all essential network applications, the personnel essential to run them, and how frequently the information should be backed-up. The fourth task would be to take an inventory of all physical elements needed to run the organization's Local Area Network and Wide Area Network lines. Fifth, the organization needs to make note of the procedures involved in backing-up its information services. Sixth, a detailed outline of all disaster recovery procedures should be made. And the list goes on. Making a disaster recovery plan will take some effort but it does not have to be difficult. In fact, to assist you in the development of your disaster recovery plan, we offer a free booklet and template that will help you get your plan started. To assist you in the development of your disaster recovery plan we offer a free template to help get you started.

2 Impact and Risk Assessment Risk Assessment is one of the key components of disaster recovery planning. In order to create the most effective plan for recovering after a calamity, an organization must first consider what the potential disasters are that they could feasibly encounter, and how each of these might impact their business continuity. To make their efforts the most efficacious, executives and board members should consider every possible scenario when analyzing the potential risks their organization might face. This means that all potential risks should be taken into account, from somewhat mundane hazards like in-house power failures to extremely perilous events like acts of war or terrorist attacks. As the purpose of a disaster recovery plan is to outline what actions will be taken in the event that an organization does experience disaster, these crises should not only be contemplated, but their potential impacts must be evaluated as well as what steps will be taken to overcome the impact if one's disaster recovery plan is going to truly be effective and practical. In the process of disaster recovery, the primary function of risk assessment is to predetermine as many types of disasters as possible that an organization may encounter, and then to figure out how the organization will deal with each crisis if it occurs. Unfortunately, disaster recovery assessments can sometimes become very complex. In order to alleviate some of the confusion and to assist you with this task, we have provided a free booklet and disaster recovery template to guide you and help get your organization's analysis started. Below we have included a brief list of some of the disruptive events that could have an affect on your normal operations and that should be taken into consideration when preparing your disaster recovery plan. Possible crises and disasters for consideration: Hard drive meltdowns Building fires Floods Power failures Internet failures Data line failures Earthquakes Epidemic illness, which would cause a sudden and significant decrease in staffing, including those employees who hold vitally important positions Transport shut-downs due to weather, strike, or more serious events (again could cause serious staffing problems) Terrorist attacks Acts of war It's important to keep in mind that this list of possible disasters is far from exhaustive and does not include many of the specialized concerns your particular organization may need to consider and/or include in its disaster recovery plan. For example, if yours is a smaller corporation, lesser events can have a greater impact on staffing, or who is on premises with the necessary knowledge to perform certain tasks, etc.

3 Creating Your Disaster Recovery plan Your company's disaster recovery plan is one of the most important (if not the most important) documents you will have on file at your organization. This is the document your entire organization will turn to for instruction, guidance, and protocol in the event of a serious crisis, particularly one that could cause major disruptions to the day-to-day functions of your organization, or could have a marked affect on your company's ability to maintain productivity. This document will help your organization recover faster and can even help you avoid loss of revenue. Even in the face if its importance, many organizations are tempted to procrastinate creating their disaster recovery plan because the process can feel a bit overwhelming. It is for this very reason that we have provided a free template to assist you in the creation of your disaster recovery plan. Our template covers a range of important topics that your organization will need to consider when creating your disaster recovery plan (also sometimes call a business continuity plan). Our template is designed to cover everything form the initial impact a catastrophe can have on a business to the steps that will need to be taken to return your organization to its normal state of operation. We have provided places for you to take inventories of your personnel, your software, and your equipment. We have also provided space for you to plan how you will back-up your systems, select back-up locations, and plan for problems should something happen to the structure of your building. Finally we have sheet for you to make clear the chain of command that should be followed in the event of a disaster. Each of these elements has been included to help ensure a rapid recovery of your business and the quickest possible return to normalcy. The step-by-step process outlined in the template will take you through the necessary elements of disaster recovery planning. It can help you create not only a recovery plan, but also a chain of accountability among the people of your organization that participate in the disaster recovery and emergency planning. Each business and its specific needs are unique. No "one size all" disaster recovery plan would be adequate. That is why this template has been created with a sufficiently flexible format. There is enough structure to keep you focused and grounded, while still maintaining enough malleability to allow you to modify the plan and fit it to your organization's particular needs. Using this easy and manageable template, you will be able to harness information from some of the industry's most experienced IT experts and integrate it with the expertise and insights of your own staff. Your Disaster Recovery Plan is Policy Disaster recovery plans are useful, but can only be semi-helpful if they are not made into company policy. Thus, board members and management need to issue clear statements that make awareness of their disaster recovery plans policy. In order for the plan to be most effective it needs to move from paper to practical reality. It should be tested, updated, and maintained on a regular basis by all personnel in the organization who are engaged in the planning or who hold any responsibility in the implementing of what has been planned. Disaster recovery plans need to be kept up-to-date and every member of the organization should be made aware of the plan. All employees should know the plan's procedures and what their role will be in the recovery process in the event of an emergency.

4 Testing the plan in a simulated environment can be very useful. It will show if the plan can be implemented in real life should a disaster or serious emergency occur. Live practice will also bring to light any unforeseen gaps or disconnects in the plan. Plus it will help employees remain calm and confident about what actions they will need to take if there is crises, which by extension, will help your business return to a state of normal operation with greater speed. Turning your disaster recovery plan into company policy is a key step in the disaster recovery process. Disaster Recovery Plan Maintenance Implementing a disaster recovery plan that will run smoothly and be successful largely depends on the performance of the people who are assigned responsibilities to help implement the plan. In order to have the most successful outcome, the people involved must thoroughly understand each of their roles in the process and what affect their performance will have on the rest of the disaster recovery plan process. It is important to train all staff involved in the disaster recovery process. They should regularly review their responsibilities and participate in "dry run" practices at least twice a year, preferably quarterly. It is also important for an organization to keep the list of its staff that is intended to be engaged in the disaster recovery process current and up-to-date. Changes such as promotions, firings, and resignations must be noted in the disaster recovery plan and replacements for these people should be added. Having the list of employees that are trained in their disaster recovery roles current makes for an effective disaster recovery process. Practiced employees will be better able to implement the plans made for ensuring your organization's business continuity in the face of disaster. Without practice, an unexpected disturbance or emergency can overwhelm staff and undermine the organization's ability to implement its disaster recovery plan, resulting in a loss of productivity and most likely revenue. Also, whenever your company undergoes changes in infrastructure or makes network upgrades, these changes need to be incorporated into your disaster recovery plan. An out of date plan is little better than no plan at all.

5 "Backup is my computer's shepherd, my data shall not want. It lets me download software with good pleasure, knowing my data is untroubled like still waters. It restores my system, It lets me surf the paths of cyberspace for information's sake. Yea, though I walk through the Silicon Valley of the shadow of death, I will fear no evil: For my backup system is on standby. My backup software and online backup, they comfort me. They prepare me a fresh backup in the presence of mine enemies. They anoint my head with peace, my cup runneth over. Surely goodness and security shall follow my data all the days of my life, and my data will continue to live on forever." T.E. Ronneberg Contact Us Give us a call for more information about our services and products Pure Computer and Networking Services Ltd The Brick Barn, Tyland Corner, Tyland Lane Sandling Maidstone Kent. ME14 3BH Tel: [email protected] Visit us on the web at