Disaster Recovery Planning and Plan Maintenance

Implementation of Risk Analysis Results

Once the assessment has been completed and a 'value' applied to the possible threats to continuity the recovery plan can be developed. It will contain a series of steps that need to be covered with interim goals being reached as normal operations and services are gradually re-established.

The first step in the recovery will be dealing with the immediate consequences of the disaster and will vary according to the cause and may involve emergency services or other specialists. Once the cause of the disaster has been addressed critical business functions and services will be the next target areas.

In tandem with budgetary considerations each area of the organization can be considered according to the weighted risk ranking. Individual areas may require their own procedure variations within the plan, but at a general level there are several steps we can consider in the recovery.

Recovery Personnel

Designating a team of employees who each have a role in the recovery is a good place to begin the plan. A supervisor needs to be appointed who will have been involved in the risk analysis and impact studies. The supervisor will have a thorough knowledge of the machinations and procedures of the business and will then be responsible for the development, implementation and continued maintenance of the plan.

The supervisor will also need to be prepared to effectively handle any employee, customer and press concerns during the recovery period. Also liaising with any affected partner companies and suppliers.

Next the team will need to be selected and trained in the DR procedures. They can also be instrumental in the development of the plan as they will most likely represent all areas of the organization and can offer advice and make suggestions as the plan is assembled. As an example, a Customer Service manager may have suggestions about the best ways to inform customers of the emergency, plus have a procedure in mind for keeping clients informed during the recovery.

Evacuation and Staff Co-ordination

Depending on the type of emergency, evacuation of staff and visitors may be necessary. The health and safety of personnel is a priority and planning should include procedures acknowledging the various scenarios depending on the type of emergency.

Fire drills are already a part of recovery planning and should include a variety of procedures taking into account the location of the fire such as which floor, plus a safe meeting place should be decided upon. In the case of Flooding or severe weather it might be preferable to keep everyone indoors. Any on-site hazardous materials will need to be accounted for and secured.

Staff involved in the recovery will be instrumental in supervising the activities of people during the initial emergency phase and the subsequent recovery.

Protection of Permanent Records

Vital physical records such as financial and insurance records, building plans and permits, contracts and employee records need to be stored out of harm's way and additionally copied to a different location. The records still need to be easily accessible in the event of downtime as they will be needed in the recovery process.

Establishing a method of preserving permanent business records as part of a recovery plan is essential in quickly re-establishing normal business activities once a disaster has occurred.

IT Protection and Backup

With most business heavily reliant on IT and Communications it is essential that both hardware and software applications are protected, possibly with full back up.

Hardware considerations can be anything from a simple surge protector and uninterruptible power supplies (UPS) through to environmentally controlled fire proof locations for the primary computer systems, or entire duplication of the computer system elsewhere.

Software should be virus protected with a firewall and proxy servers insulating intranet from the Internet. Data should ideally be backed up to an external off-site location making it retrieveable in the event of total loss from the in-house systems.

Communications Recovery During any emergency it's clearly important to maintain communications between staff and customers. In fact communications downtime is itself a disaster scenario with dire consequences for any business, small or large.

A useful service is to provide an advertised dial-in hosted noticeboard number where information is generally available but which can be used to good effect during any communications downtime.

A full communications recovery service such as that offered by 999Alert should also be considered. A copy of an entire in-house phone system can be hosted externally with communications switched to the hosted service within minutes of any disaster.

Relationship with Services and Media

Important phone numbers such as Fire and Emergency Services will always be on hand, but it's worthwhile establishing a connection with relevant services so they are familiar with internal emergency procedures and will co-ordinate correctly with the recovery plan. If possible, involve the local brigade in fire drills and ensure staff co-operate with the requirements of the professionals.

The media can also be instrumental in advising the public of any emergency and keeping them updated during the recovery process. Establish a contact at the local newspaper and radio stations and have a skilled and confident media spokesperson maintain the connection and keep them informed once an emergency has occurred.

In the event of a large outage, with major disruption to business, the public perception may involve a loss of confidence in products and/or services. The media have the power to restore public confidence and as such business media personnel need to get the message across via press releases, press conferences and media packs.

Recovery Plan Maintenance

As a business changes so will the requirements of any DR plan. It is important to correctly maintain all aspects of the plan to include changes to personnel, in-house systems and equipment, changes in office layouts and networks, changes to external services and agencies, new suppliers and service providers and anything else that may impinge on the smooth handling of the initial emergency phase and during the recovery.