Why The Need For Disaster Recovery Policies

Published Date: 02 Nov 2017

Disaster is sometime inevitable and unpredictable and therefore it is vital for any organization to have strategy and plan which set out the procedure for organization to return to normal business operation after disaster strike. Researching on disaster recovery policy requirements and the approaches relating to the disaster recovery plan (DRP), is provided much needed understanding to develop and improve DR plan in both government and private organization in the present global information security context. There is requirement in my current organization to formulate disaster recovery policy and plan. So, researching on subject matter will greatly help me to improve the knowledge and enable me to provide considerable contribution towards developing disaster recovery plan in my organization.

Disaster recovery policy (DR) comprise of senior management’s directives regarding disaster recovery goals, scope within which it should be applied, key responsibilities related to DR plan and also it address general and specific legal compliance and issues. Disaster recovery policy provide systematic approach and framework for safeguarding vital IT systems and data managed by Information Technology and Service Department. Also it provide guidance and commitment of management to towards building, implementing and maintaining disaster recovery plan.

Sometimes it can be seen that both "business continuity" and "disaster recovery" terms are interchangeably used, but both are having distinct meaning and differences. Business continuity planning is involved all aspect of business functions rather than information systems in an organization and provide complete guideline and procedure to return to normal business operation in an event of disaster which disrupt all or part of business operation. Whereas disaster recovery is subset of business continuity plan. It mainly focus on information technology services and infrastructure and provide a recovery plan to restore IT systems operations when disaster occur.

Most of the time disaster recovery and business continuity address same basic issue and number of areas focus on get overlapped between two processes. Many organization tend to build disaster recovery plan before going for overall business continuity plan.

Type of disasters

Disaster would cause disruption to one or more business operation of enterprise organization or complete failure in all business function causing damages to total business shutdown for days or months sometimes fatal damage to the business. The causes of the disaster can origin from various sources and identified as follows:

Power failure

Water damage or flooding

Fire or smoke Damage

Earthquakes, tornado or storm damage

Terrorist attack or explosion

Equipment or hardware failure result from server failure, network equipment and connectivity failure,

System/Application/Software Failure

Network connectivity failure within and outside of the corporate network

Accident and human error causing file loss, database record loss, data corruption or sabotage

Why need for disaster recovery policies ?

Today, all most all enterprise organizations are heavily depend on Computer systems and information technology services and these are vital and critical for running the business. Any disruption or failure in the key information technology system would cause interruption to the services offered by organization and thereby revenue and time loss and also frustration among internal and external users who use the systems for their day to day business requirements. If operations of the bank get halted due to the power failure, the bank would have get considerable impact in their revenue and having risk of losing valuable customers and their confidence. Therefore, it is necessary to have disaster recovery policy and plan in the organization, which assess the risk and damages, before disaster is happened and set the contingency plan required. If the contingency plan in place and also well informed among the relevant staff, users are not get panic and frustrated when the disaster happened and saving organization money, time and creditability.

According to various type of organizations, DR policy and plan to be in place to compliance with rules, regulations and standards with which, these organizations are governed. Even though, law and regulation are not specifically mandate for certain types of organization to have disaster recovery policy and plan, requirement of data integrity and availability bring additional demand to have contingency plan in place.

The Sarbanes Oxley Act of 2002 set recommendation for DR planning though it is not explicit requirement by this law but mandatory for the organizations to provide certain corporate data available when needed.

Banks and financial institutions, stockbrokers, power utilities, telecommunication utilities, health care providers are having varying degree of commitment to have disaster recovery plan by the law and regulations.

The disaster recovery policy and plan provide below benefits:

Senior management personal are provided relevant guidance and procedures to respond effectively and reduce operational and business effects in an event of disaster.

Enable to manage crisis situation in an organized and coordinated manner

Minimizing magnitude and impact of the disaster to the various organizational units

Provide preventive measures to avert the disaster.

Minimize the time elapse between the failure and the time, when IT system and services are available for use otherwise it is called "Recovery Time Objective" (RTO) or "Service Delivery Objective" (SDO). This factor is varied according to criticality of the system and impact of the disaster

Minimize the data loss incurred and establish "Recovery Point Objective" (RPO) which is the acceptable level of data loss in the event of disaster agreed by organization