A Guide To Disaster Recovery And Business

Published Date: 02 Nov 2017

Abstract

Disaster recovery and business continuity work together to ensure that a business can fix and recover from a catastrophic event. A proper plan needs to been in place to get a company running as soon as possible after an event to it may continue to generate revenue. The business must build a team involving key personnel, assess threats and vulnerabilities, formulate a plan, and test the plan. The plan should be updated frequently to include new procedures and identify new threats or risks to the company.

A Guide to Disaster Recovery and Business Continuity Planning

Disaster Recovery and Business Continuity go hand in hand when developing a plan to keep a business running after a catastrophic event. Disaster Recovery is the actual ability a company has to recover and how will they perform it. Business continuity is how critical infrastructures will continue to operate to generate revenue after a disaster. There are many different kinds of disasters which can affect a company. Some of the most obvious are lack computer security which would include hackers, viruses, spam, and physical aspects as well; Death of important employees and personnel which can limit accessibility to certain critical information for a period of time; Strikes, accidents, spills, explosions, technological breakdowns, hardware and software failure, sabotage and terrorism, heating, ventilation, air conditioning, and natural disasters are but a few.

There are many reasons why a company should plan for disasters and business continuity. Insurance companies sometimes require that an organization have proper planning in order to gain insurance. According to IBM regarding their Customer Information Control System, a company should ask themselves one simple question to determine if they need a plan: "Can my business continue to function without my CICS® system?"(IBM, 2013) and if the answer is no, then you should have a plan in place that will reduce the downtime of critical systems to ensure that the company can start generating revenue again as quick as possible. If a company cannot get it’s critical systems back on then it is losing money, sometimes millions of dollars per hour and there have been many business that have failed because they could not get things running in a timely manner. Disaster Recovery is all about implementing a plan that will reduce the length of time it takes to get systems online and operating. Sometimes outside sources can also pressure businesses to create a plan. One reason is that "Stakeholders, shareholders, clients, or venture capital firms have made a formalized request that the organization make the effort to be fully recoverable."(Wells, Walker, Walker, & Abarca, 2007). When other people have invested money into your company you should always aim to please them for fear of them withdrawing.

The next step in developing a plan is to establish a team of key people involved in the business. These people must know the business very well (or at least a respective department) and what it will take to recover from a disaster. Each of these people will help to prepare strict guidelines so that whoever is a part of the recovery process can follow each task in order. The team should include upper management, information technology staff, business members, support staff, end users, maintenance, and security officers. Outside sources such as police, fire department, banks, insurance, and anyone else involved with the company should be notified.

Next, a business should audit the current vulnerabilities in the company and try to determine what steps can be completed immediately. One of the most critical things to accomplish is the Business Impact Analysis or BIA. A BIA will identify all of the critical systems in the business and will determine the effect of a disaster on the business. After this, different assessments should be run that will help identify resources that are required to support critical functions such as electricity and communication. Risks must be prioritized and there are many different ways to do this. For a company involving financials, an approach that involves an asset-based and disaster-based assessment as well as a tiered approach is recommended. This approach will allow a company to determine what risks, vulnerabilities, and threats a company has and it will put them into one of three tiers. The first tier will include critical systems; The second tier will include assets, functions, and processes that are important and which need to be recovered promptly; The third tier will include systems and processes which are not essential but must be recovered within a few days.

The final stages of the process are to develop and test the plan. The business should collect important documentation regarding licenses, installation instructions, and user data. Companies, vendors, suppliers, emergency services, customers, personnel, and management should all be listed on a contact sheet which should be distributed to everyone. In case of disaster, the right people must be contacted and not having this information readily available will increase the time it takes to recover. There should be plans and procedures regarding how information is and will be backed up now and at the time of a disaster. Most companies should have an additional hot site where data is continuously updated in case of disaster to the main data. This will allow businesses to be able to instantly recover data but will also be very expensive. The data assets which were labeled tiers 1 and 2 will be the highest priority in backup data.

Service level agreements should be made with customers stating that in the case of a disaster, expected downtime will be a number of hours or days. If these agreements are not adhered to it could cost a business a lot of money as it disrupts the customer as well. Also, policies should be set in place within the company that will outline proper use of equipment and what is expected of employees and management.

After the plan has been formulated it needs to be tested. A disaster recovery plan should be tested so you can determine what changes need to be made if things aren’t working correctly or could be improved. The test will serve dual purpose because it will also train the people involved with recovery so if a disaster actually occurs they will be comfortable with what they have to do. Everything that happens during the test should be recorded and reviewed. A disaster recovery plan should be updated routinely to ensure that any new assets are added or simply if better procedures can be implemented.

Disaster recovery and business continuity plans should be implemented in every business that could not function without certain assets. Too much risk is involved if you do not have one and you are leaving your company up to chance. Planning for disasters and creating strategies will be expensive but in the long run your business will save money especially if a disaster where to occur. Hurricane Katrina saw many small, medium, and large businesses go under because of improper planning or no plan at all. The most important aspect of these plans is that it will allow a company to continue to generate revenue and reduce down time.References

Wells, Walker, Walker, Abarca (2007). Disaster Recovery Principles and Practices. Upper Saddle River, New Jersey: Pearson Education.

Slater, D. (2010, July 1). Business continuity and disaster recovery planning: The basics [Web log message]. Retrieved from http://www.csoonline.com/article/204450/business-continuity-and-disaster-recovery-planning-the-basics

(n.a) (n.d.). Why Have a Disaster Recovery Plan?. Retrieved January 24, 2013, from http://publib.boulder.ibm.com/infocenter/cicsts/v3r1/index.jsp?topic=%2Fcom.ibm.cics.ts31.doc%2Fdfht2%