Disaster Recovery: 6 Points to Know
Maybe you’ve seen this commercial. A maintenance man at a power plant is mopping the floor of the control room of a power plant. He accidentally knocks over a cup of coffee sitting on the control panel and the metropolis in the background suddenly goes dark. The maintenance man doesn’t panic. He quickly goes over to the ‘red button’, pushes it, and the “Energizer Bunny” suddenly drops down from his hidden compartment in the ceiling and attaches itself to the control panel. The bunny then begins to bag his familiar big bass drum ferociously. Sparks begin to fly and all of a sudden the city’s lights come back to life and all is well again. This is a light-hearted example of a very important issue. The “Energizer Bunny” in this commercial is an example of the power plant’s Business Continuity planning. The point is that bad things happen and an enterprise has to be prepared to deal with these bad events.
The Blog 3600 Vendor Management has published a very helpful article regarding Disaster Recovery entitled An Outsourcing Vendor’s Business Continuity and Disaster Recovery Plan. In it the author discusses some essential points that any Outsourcer should consider when contemplating their Disaster Recovery Plan. Since the Blog 3600 Vendor Management’s stated purpose is “to impartially discuss the down-to-earth, day-to-day fundamental basics of outsourcing … thereby make you a more effective outsourcing leader”, I have deferred to their judgment and included this post in the Outsourcing category of my Blog. I would, however, like to point out that the following points seem to me to be universal (See the “Energizer Bunny” discussion above) and should be easily applied to any IT department other than an Outsourcing Vendor. The following are those salient points contained in the 3600 Vendor Management article cited above to consider for your Business Continuity Plan:
- Consider the Impact, not the Event - Generally speaking there are four types of impacts that you need to plan for: loss of people, loss of facilities/building, loss of connectivity, and loss of applications. Any given event can cause one or more of these impacts. For example, a political coup could cause your operations team to have insufficient quantities of personnel (loss of people) and loss of connectivity (if the telecommunications company shuts down). Plan for the impacts, not the disaster.
- Consider Time Frame of Impact - An impact can last 5 minutes, 50 minutes, 5 days, 5 months, or be permanent. When an event creates an impact, your plan should provide clear direction based on the expected duration of the impact.
- Have Clear Procedures - A plan that says “open new center in a hotel conference room” is insufficiently detailed. The plan should have clear procedures for retraining, relocating personnel, reconnecting systems, and procuring goods/services necessary to recover. For example, relocation of personnel should have a clear plan for sources of transportation, roadmaps with specific routes to take, and temporary housing.
- Plan for Staged Recovery - Few serious impacts can be instantaneously resolved. For example, telecommunications circuits are generally recovered one at a time. People will return to work slowly.
- Consider Side Effects - A major weather disaster is typically followed by disease. So, while a hurricane is unlikely to cause a loss of people, the cholera, stomach diseases, or other health concerns could.
- Test the Plan - Finally, test your plan at least once per year by first calling a pre-planned meeting and role-playing resolution and actions. Later, call an emergency meeting when leaders are not prepared. Take notes on the actions (do not critique in the middle - let the disaster and recovery unfold). Afterwards, analyze the actions and provide feedback. Expect your business continuity and disaster recovery plans to improve each time you rehearse.
