IT DR Program Management

Overview of IT DR Program Management

The DR Plan is a “living” document that needs to be adequately maintained to ensure its reliability and accuracy. This is because any changes to the typical operating environments such as systems, networks, utilities, applications and business environment would invalidate the particular contents of the DR Plan, such as the inventory list, contact list, recovery process, and procedures, and render the DR Plan useless.

Thus, practical change control and management procedure that ensures all the following areas are covered must be established and practiced so that the DR plan is updated with the latest development in the organization, especially in the IT support field.

The appropriate evaluation of any change that could impact the DR Plan is done when the difference arises due to business re-direction, systems upgrades or enhancement, application upgrades or introduction of new services.

The Organization DR Coordinator must be informed of any DR plan changes. He/she will then realign the DR Plan to address the changes and test and re-test the updated DR Plan to ensure that it can still cover the recovery requirements of the business in the new environment.

Also, a formal audit and review of the DR Plan should be conducted at least once a year to assess the readiness of the DR Plan and to confirm that those changes that happened since the last review are captured in the DR Plan. The audit and review process should pay particular attention to configurations of recovery equipment to ensure that the required equipment is available to restore the business functionality as quickly and smoothly as possible

In this chapter, we will go through the major topics of having an actual and effective DR Plan maintenance process (Goh, 2010b)

Major Considerations for Maintaining DR Plan

The major considerations for setting up the DR Plan maintenance processes are:

Define clear accountability of individuals to maintain relevant procedures so that every individual within the DR team is responsible for keeping his or her section up-to-date with the setups in the existing working environment
Ensure change control and management process that include evaluation of any impact on the DR Plan and tracking of appropriate updates are carried out accordingly
Conduct regular DR tests to validate the reliability, accuracy and efficiency of the DR Plan
Enforce periodical inspection and assessment programs to audit and review that all changes to the DR Plan are made according to the change control and management procedure and the DR Plan is updated with the latest information

DR Plans are distributed promptly, correctly and effectively to all the DR team and management when an update is done

Plan Maintenance Process

For a DR Plan to be reliable and accurate, it must be up-to-date. Some guidelines are discussed in the following sections.

Define Clear Accountability of Individuals to Maintain Respective Procedures

The Organization DR Coordinator should be responsible for maintaining the master DR Plan. Respective subject matter experts responsible for maintaining systems, networks, utility software and applications should be accountable for maintaining the respective recovery procedures.

Change Management Process

The Change Management process is critical to the DR Plan. The organization should institute a mandate to evaluate the impact of changes to the DR Plan. These changes can be due to the new implementation, upgrade or maintenance. The organization should adopt a policy on changes that invalidate the DR Plan and its recovery procedures and for the revised DR Plan to be retested within a specific timeframe. The Organization DR Coordinator will need to be in the loop of such changes, especially in the following areas:

Personnel changes
Business Mission changes
Business Priority changes
Backup procedures
Recovery procedures
Facilities relocation or consolidation
Software changes (operating system, application programs)
Hardware changes (addition of new peripherals, upgrades to CPU, RAM, Hard disks)
Communications Networks extensions, expansions or consolidations

Periodic Inspection and Assessment Programs

The periodic inspection and assessment programs ensure that the designed DR processes are followed and maintained up to date. Independent review and testing of the plan will maintain its high quality and consistency.

Some typical periodic inspection and assessment programs to be considered are:

Verify that all contact lists specified in the DR Plan are the latest
Review the currency and the frequency of updates of the recovery procedures, hardware configuration information, system software, and network and application systems inventory
Validate that the applications recovery priorities are established
Validate that the DR requirement is included in the development life cycle
Review periodically the backup arrangements made with suppliers and vendors
Test the DR Plan regularly to ensure its functionality
Evaluate the adequacy and effectiveness of the alternate recovery site for contingency needs when the alternate recovery site agreement expires

Plan Distribution Process

The DR Plan is a highly confidential document as it contains sensitive information on your entire network infrastructure and detailed configurations of all your servers and applications. At the same time, your DR Plan also records critical contacts of your organizations, business partners, suppliers, and the list of vital records. Thus, a proper document distribution and control access process must be established to ensure that only people who need access to the DR Plan are given a copy.

For proper tracking and management of all copies of the distributed DR Plan, a distribution matrix that indicates who should receive copies of the DR Plan must be documented and updated as and when there are changes to this staff list. In general, a distribution list for the DR plan should include the following people:

Executive Management
Data Centre Management
Computer Operations Management
DR team members
Internal Auditor
DR Site Operator
A copy of the DR location

Some good practices for organizing the DR Plan for easier management of distribution and collection are listed as follows:

Assign a unique number to each copy of the DR Plan
Link each numbered DR Plan with the staff who is holding it
Print unique page number, version number, and date of update on every page of the DR Plan by Chapters or Sections
Remove information that changes more frequently, such as hardware and software inventories and staff contact list, from the main DR Plan document and put them under appendices to the DR Plan
If you are familiar with the documentation structure of the ISO 9000 documentation format, use it for the DR Plan

A good DR Plan distribution process is to always exchange the latest release of the DR Plan with the existing copy that the staff listed in your DR Plan distribution matrix is holding and destroy the old copies.

Make a Multi-Year Investment in Recovery

Finally, after obtaining accurate estimates for improving application recovery, you may reasonably plan for a multi-year investment that improves the most critical applications in the first year and less-critical applications in subsequent years. Alternatively, you can use staged investments to incrementally improve recoverability.

Reference

Goh, M. H. (2016). A Manager's Guide to Implementing Your IT Disaster Recovery Plan. Business Continuity Management Specialist Series (2nd ed.). Singapore: GMH Pte Ltd.

Extracted from "Chapter 4: Project Management: Step 1: Establish the Need for DR Planning"