How Disaster Recovery Plans Work

Disaster recovery plans deserve the full attention of executives at the highest levels of an organization. To ensure that upper-level management takes ownership of the plan, experts recommend that all good disaster recovery plans begin with an official proposal. That proposal can be presented to the board of directors to the chief executive officer or to the chief information officer.

The proposal isn't the plan, but rather a "plan for making the plan." If the disaster recovery plan is going to be created in-house, the proposal should recommend which specific employees will manage the project and approximately how many work hours it should take. If the proposal recommends a third-party consultant, it should include a budget based on the consultant's proposed services.

If the company has never drafted a disaster recovery plan before, the board might need to be convinced that it's necessary. The online Disaster Recovery Guide suggests using the following reasons:

Once the proposal is approved, the real work begins. Drafting a good disaster recovery plan is a slow, methodical process. It requires that each department be broken down into its smallest units, and that each separate function of each unit be analyzed for its importance to the business.

This is why many businesses choose to hire an outside consultant to create their disaster recovery plan. Third-party disaster recovery experts have the experience and impartiality to conduct employee interviews, design questionnaires and analyze day-to-day practices in order to come up with the most comprehensive recovery plan possible.

Creating a Business Impact Analysis (BIA) is the first step. A BIA questionnaire collects all the information about a single business function so it can be ranked in the order of importance. According to the Texas State Office of Risk Management (SORM), a good BIA should include the following information and more:

The disaster recovery planning team uses this information to rank all business functions according to time tiers. For instance, Tier One includes those functions that need to be back online within a few minutes up to 24 hours. Tier Two includes those functions that need to be back online within 24 to 36 hours and so on.

Another piece of the pre-planning research, according to the Disaster Recovery Guide, is assembling important contact information and emergency procedures. You'll need emergency contact information for all employees, all vendors and partners and equipment inventory for all information technology and administrative departments. You'll also need paperwork and procedures for dealing with evacuations, floods, fires, earthquakes and insurance.

Keep reading to find out what kind of information goes into the actual disaster recovery plan.

The safety of personnel and their families should be the first priority of any disaster recovery plan. In a white paper published by SunGard called "Lessons Learned from Katrina", the authors say that successful plans not only account for the transportation and safe lodging of employees, but of their families as well. Once family members are safe, employees have a greater chance of being able to concentrate on helping the company.

Each employee should be trained in his role in the disaster recovery plan. Back-up personnel should be designated in the case that an employee is not available, and obviously the back-ups need to receive the same training. Frequent audits of the plan should be made to ensure that the same people are still employed in the same roles with the same contact information.

Multiple lines of communication are crucial to any good disaster recovery plan. Detailed lists of employee and vendor contact information are a minimum. Some companies sign up with third-party conferencing and emergency communications services to send automated messages in times of crisis. The messages can be sent from any platform (phone, e-mail, SMS) and received on any platform.

An advantage of these conferencing services is that individuals can easily update their contact information and indicate the fastest way to reach them in an emergency. Emergency communications services also have the ability to call everyone on the contact list at the same time, ringing pagers, cell phones and sending e-mails until receipt of the message is confirmed.

A third-party disaster recovery specialist can also provide a company with alternate workspaces in the event that the regular office is unavailable. Not only do these workspaces have all of the necessary equipment to do business (desks, phones, PCs, Internet access), but they also have access to all of the company's data. This is because the disaster recovery company has been regularly backing up and storing the company's data in an off-site facility.

After personnel, data back-up and recovery comes next. Experts recommend that data either be backed up on hard disks and stored in an off-site facility or be uploaded to third-party servers at on off-site facility. Depending on the business, this upload process can happen once a month or in real-time.

As part of the BIA process, certain types of data should be identified as crucial to running the business. The back-up and recovery plan should reflect those priorities. Security measures should also be included in this section of the plan so that all employees are trained in the safeguarding of the company's systems and sensitive data.

Read on to find out about insuring relationships with vendors and some more advantages of third-party disaster recovery services.

A company is both a vendor and a client to dozens if not hundreds of other companies. What happens in the event of a disaster? What are your vendors' obligations to you? What are your obligations to your clients and partners?

Company attorneys draw up a Service Level Agreement (SLC). According to The Business Continuity Institute, an SLC is a binding agreement between two companies, or between suppliers within the same company, that covers the "nature, quality, availability and scope of the service provider." Within the SLC are special provisions related to emergencies, so that one side can be legally liable if it fails to deliver an essential service, even in time of crisis.

We've already talked a little about third-party disaster management services. We've mentioned that they can assist with the interviewing and research process to make sure the disaster recovery plan is thorough. We've also mentioned that they can provide alternative workspaces in the event of an emergency and can host and store data off-site.

But perhaps the most useful service of a disaster management company is regular testing and auditing of the disaster recovery plan. A disaster recovery plan won't do any good if it's five years old and collecting dust in the CEO's drawer. Frequent testing for multiple contingencies ensures that a disaster recovery plan works. It's equally important to diligently audit and update the contact lists of employees and vendors. A company should maintain detailed records of its hardware, software and network equipment.

Creating and updating a comprehensive disaster recovery plan is not a simple task. It's not cheap either. Surprisingly, a number of companies create incomplete plans or ignore them. According to a survey done by the Association for Financial Professions months after Hurricane Katrina, only 24 percent of respondents said that their companies had recently tested their disaster recovery plans. A full 50 percent admitted they had no intention of testing their plan.

To find out more about disaster recovery plans and how you can safeguard your business against unforeseen events, check out the helpful links on the next page.