Businesses may be affected by disasters directly and indirectly. For instance, businesses may not be directly caught in a disaster, but the resultant decline in trade will affect the business.
Business disruptions—whether the result of natural disasters, technology failures or criminal acts—can threaten the very survival of a company. Such disruptions cannot always be predicted or prevented, but sound planning can dramatically reduce the damage they cause. But effective preparation for disaster recovery and business continuity is a job for the entire company.
Primary objectives of the Disaster Recovery Plan are to make sufficient agreed-upon
preparations, and to design and implement a sufficient set of agreed-upon procedures for responding to a disaster of any size in the departmental area of responsibility. Other objectives of the plan are as follows:
• Risk reduction and prevention to help avert any interruption in computing system,
application, network systems and services
• Reduce confusion during any chaotic period by having a clearly defined course of action
that will reestablish services as soon as possible
• Identify critical functions with consideration of priority scheduling
• Identify alternate sites of operation that provide the same or compatible equipment.
Conclude formal backup arrangements with such sites as identified. Specify steps
necessary to relocate to the alternate site
• Identify key personnel for each application, database or service so that they can be
summoned without delay when needed
• Identify users of departmental services to be notified of delays and to be involved in the recovery process. Establish the personnel responsible for all phases of Disaster Recovery
The time it takes for a business to return to something like normal operating levels depends on a number of key issues:
• Overall damage assessment – can you trade from your existing premises and what stock,
supplies, equipment and other key assets are recoverable and what is not recoverable.
• Your insurance coverage and how quickly your claim can be processed
• Any government assistance you can access
• Communication with employees, customers and suppliers.
• An assessment of the business’s financial position
• Developing a plan to reopen your business.
Here are some considerations for creating your plan.
1. Understand what keeps your business going.
Identify those systems and resources that are absolutely critical to
run the business and focus on protecting those first. Not all
systems require the same levels of protection; in fact some may
not need protecting at all. A cost-effective and efficient business
continuity plan sets priorities to help bring the business back
online as rapidly as possible.
2. Get the data out of the building
This is the quickest and easiest way to help ensure that the
business can be recovered should it suffer a loss or outage. If a failure or loss of data occurs you need to be able to recover it.
Even if it requires being restored to a different location, at least
your data will be available.
3. Calculate the cost of downtime
This will help in setting priorities as to which areas of the business
get protected and to what levels. Note that while some systems
may not have a large dollar value associated with being down,
there may be legal ramifications should they not be available or
recoverable. Cost is not just lost revenue, but the overall impact
on the data has on enabling the business to meet employee,
customer, legal, and financial obligations.
4. Think beyond tape
While tape is probably the most common method for protecting
and recovering data, it may not be appropriate or sufficient for all
of your applications. Tape is acceptable for long-term archival and
recovery, however, it can be a lengthy process to rebuild a system
from tape. After determining the Recovery Point Objective (RPO)
and Recovery Time Objective (RTO) for each of your systems,
consider appropriate enhancements to tape solutions such as
host-based replication. Other solutions like data replication can
provide near-zero data loss and disk-to-disk recovery options for a
rapid return to productivity.
5. Continue to build and test the plan - continuously!
Be sure that your plan accounts for the various types of outages
that could affect each business location including a simple disk or
hardware failure, a building outage, a regional power failure,
environmental disasters, and natural disasters such as hurricanes
and earthquakes. Check that the necessary procedures are
documented and available for everyone to read and understand.
Everyone in your company has an important roll should an
emergency arise.Whether their role is to get themselves safely out
of the building or to help in the rebuilding process, it is important
for them to know exactly what is expected of them during a crisis.
IT organizations are very aware of the many
vulnerabilities of the networks that support the business processes—because they have the responsibility
of maintaining availability. The business groups, which use the systems over those networks, are aware of the cost of that maintenance, but not necessarily the specific IT services that support the expected
availability. Thus, an organization is pushed by the expectations—and requirements—from all sides:
• Customers expect supplies and services to continue—or resume rapidly—in all situations.
• Shareholders expect management control to remain unchanged throughout any crisis.
• Employees expect both their lives and livelihoods to be protected.
• Suppliers expect to be able to continue shipping, keeping the supply chain intact.
• Regulatory agencies expect their requirements to be met, regardless of circumstances.
• Insurance companies expect due care to be exercised.
Successful plans must be updated and tested regularly, a process which includes re-training employees
in their roles, re-training that should include practice in thinking nimbly and creatively in worst-case
scenario examples. Such nimble thinking demands thorough knowledge of available resources and other
elements of the continuity and recovery plan. Such plans share several characteristics:
• Executive and board-level support.
• Clear concise directions for action at every level.
• Integration with the corporate management culture, as an ongoing activity.
• Inclusion of risk management considerations.
• Prioritization of vulnerabilities.
• Coordination with suppliers and customers.
• Continual internal marketing to maintain participant awareness and motivation, with regular “what if”
drills in creative solution implementation
.
Elements required for continuity and recovery plans include:
• Mission Statement for the Plan—This document must be consistent with the company’s mission
statement and establish the objectives and scope of the plan.
• Executive Sponsor—Who owns the plan, has primary accountability for it and reports to the board on
corporate risk management? Who else in senior and operational management positions serves on
the “Continuity Planning Board”?
• Scope—What is included in the plan overall, and what is included in each part of an integrated plan?
What is not included at all?
• Implementation Charter—Who is empowered to develop and implement the plan, with its related
updates, tests and reports for continuous improvement?
• Regulatory Compliance—Which regulations or best-practice standards govern the plan?
• Stakeholders—What are the titles, and continuity-related activities, of the plan’s constituents?
• Key Measures—What metrics gauge the plan’s performance? These measures should be straightforward to measure an objective. Each test of the plan as well as each reality-triggered implementation of the plan should report on these metrics. Service-level agreements among the internal stakeholders and with recovery service providers should reflect related key measures.
• Policies and Procedures—What business policies apply to continuity/recovery operations? What
behaviors do they prescribe? What procedures must be carried out to satisfy the policies? How are
the policies enforced?
• Program Elements—What are the components of the continuity/recovery program necessary to
satisfy the mission statement within the scope of the program? These include the plan itself and its
maintenance as well as the elements it describes, such as contact lists, activation triggers, decision trees, information security, physical security, awareness and training programs, and budget.
The significance of each major phase of continuity planning merits attention because each phase contributes to building all four areas of business continuity: disaster recovery, business recovery, business resumption and contingency planning:
• Phase 1—Establish the foundation. These alignment and analysis steps are necessary to obtain
executive sponsorship and the commitment of resources from all stakeholders. Without a basis of
business impact analysis and risk assessment, the plan cannot succeed and may not even be
developed. The audience for the business case phase of the planning document is the executive(s)
who will authorize the plan’s implementation.
• Phase 2—Develop and implement the plan. Here, attention to detail and active participation by all
stakeholders ensure the development of a plan worth implementing. The plan itself must include the
recovery strategy with all of its detailed components and the test plan. The audience for the
implementation section of the plan document is the staff which will follow the plan’s directions for
continuity and recovery. Its existence and maintenance establish trust with the board of directors,
shareholders and customers.
• Phase 3—Maintain the plan. The best plan is only as effective as it is current. Every tactic of business resumption and recovery must be kept up to date and tested regularly. The audience for the testing section of the plan document is the implementation staff. It is important that this staff know how demanding maintenance is, what (if any) tools are provided to assist with the process and how important plan maintenance is for building trust among the company’s stakeholders.
more about DR (disaster recovery)
more from Wikipedia
more from sans.org
more from Youtube
