IT Disaster Recovery Plan Development

Overview

The DR Plan development process is a fundamental and essential step in establishing a comprehensive and extensive set of documentation on the complete business reaction, recovery and resumption procedures to counter any disaster events that may either impact the business slightly or render a standstill to the business operation in its current operation environment.

As we all know. For a DR Plan to be comprehensive it must contain the detailed roles and responsibilities for each of the DR team participants, inventory of all critical resources, procedures to activate the plan, recall of all DR teams, technical recovery steps to recover IT systems, verification steps to verify systems and vital data are recovered correctly, etc.

In other words, it has to comprehensively capture all the steps and resources required to activate the DR Plan to operate comfortably using the adopted recovery strategy and finally return to the normal operation at the original operation environment whether in the existing location or a new location.

However, we should also balance details with flexibility because the more detailed the plan is, the less scalable and versatile it will be. This will make the DR Plan inflexible in reflecting changes to the operation environment, especially when the reality of current business environment is always in the change regarding people, appointment, business direction, business strategy, business activities and business operational locations. Thus, a good DR Plan must not only be comprehensive and detailed but also adaptable to changes in business, so that it is always in line with the current business environment.

In this chapter, we will discuss the methodology for carrying out a complete DR Plan development process for DR practitioners. Also, we also provide a sample DR Plan format in Appendix F for your reference.

This document serves as a reference. You may have to tailor it to better meet the organization’s requirements – specific system, operational, and organization requirements.

Planning Considerations for Plan Development

Before you start to carry out the DR Plan development process, you should develop a content outline for the DR Plan to serve as a general guide for your development of detailed DR procedures. Thinking through the content outline, will not only help you to organize your compilation of detailed recovery procedures, but it will also help you to:

• Determine the major milestones and schedule to complete the plan.
• Identify any redundant processes and procedures that can be eliminated.
• Identify improvement to the coordination and interfaces between different teams and procedures.
• Identify the inter-dependency of DR teams and escalation flow.

Also, a standard documentation format needs to be established here, so as to ensure consistency of the look and feel. For example, a consistent information presentation style, fonts, character sizes, sections breaks and paging, will help all procedure writers to have a document frame to write on. The plan consolidator needs less effort to compile the overall DR Plan. The reviewer and management will have a clearer picture to vet and approve the DR Plan. Finally, the plan executor will be able to execute the plan correctly and effectively.

Disaster Recovery Teams

People are the key to executing and operate the recovery processes. It must be appropriately selected, evaluated, trained and re-trained so that they are equipped with the correct mindset, skill sets, and tools to execute the DR Plan.

The DR teams are be divided into the various specific types of teams to take care of the individual systems and functions. The size of team, name of team and team structure should be based on the DR requirements of the organization.

Figure 1: DR Team

DR Management Team

The Recovery Management team includes:

• Recovery Manager (Usually the Organization DR Coordinator)
• Facilities Coordinator
• Technical Coordinator
• Administrative Coordinator
• Network Coordinator
• Applications Coordinator
• Computer Operations Coordinator

Business Recovery Teams (Non-IT)

Some key business recovery teams include the following:

• Executive Management Team
• Business Recovery Team
• Business Unit Recovery Team
• Damage Assessment Team
• Facility Support Team
• Administrative Support Team
• Logistics Support Team
• Transportation and Relocation Team
• User Support Team
• Media Relations Team
• Legal Affairs Team
• Physical/Personal Security Team
• Human Resources Team
• Procurement (Equipment and Supplies) Team
• Marketing and Customer Relations team

Disaster Recovery Teams (IT)

• The DR team includes the following:
• Computer Recovery Team
• Computer Backup Team
• Offsite Storage Team
• Software Recovery Team
• Communication Team
• Applications Team
• Computer Restoration Team
• Systems Software Team
• Network Operations Recovery Team
• Database Recovery Team
• Application Recovery Team(s)
• Hardware Salvage Team

Staff Selection Criteria

Staff selection criteria for the recovery teams should be based on:

• Skill-sets and business knowledge. Ideally, teams should be staffed with the personnel responsible for the same or similar operation under normal conditions. For example, Server Recovery Team members should include server administrators.
• Staffing and sizing of the team must be optimized and remain viable, even if some members are unavailable to respond.
• Team members’ alternation is one of the ways to address staff unavailability issues. Thus, team members have to be familiar with the goals and procedures of other teams to facilitate inter-team coordination.
• The team leader must be identified to direct overall team operations, thus, he or she must be well-equipped with the knowledge, macro viewing capability and with a firm nature to be responsible for disseminating information to team members, and approve any decision that must be made within the team.

The DR Management Team is necessary for providing overall guidance following a major system disruption or emergency. The team is usually led by the Chief Information Officer (CIO) or someone with the authority to make decisions regarding spending levels, acceptable risk, and inter-organization coordination. Thus, the staff selected to be in the team must be:

• Able and capable of making a management decision on activating the DR Plan and supervising the execution of DR operations.
• Capable of facilitating communication among other teams and supervising plan tests and exercises.

Thus, the correct personnel with the correct attitude, capability, and skill-sets when put into the correct position in the DR organization structure will ensure the correct execution of the DR Plan and achieve successful results as intended in the DR Plan.