Disaster and Recovery

Read following statistics.

1. The average company will lose 3 % of its gross sales within a week of sustained outage.
2. The average company that experiences a computer outage lasting longer than 10 days will never fully recover. 50 % will be out of business within 5 years.
3. The chances of surviving a disaster affecting the corporate data processing center are less than 7 in 100. The chances of experiencing a disaster are 1 in 100.

- Jon Toigo (On Disaster Recovery Planning)

What If? – Scenario is key word for disaster recovery plan. Take a pen and paper. Start with "Fish bone" diagram. List down all effects that may happen to your organization if causes are related to disaster. List down all disaster. Once you are ready with diagram, try to find out best solutions available to you. Now you are having list of alternatives with you. Select best or suitable alternative to avoid disaster.

If you are looking for creating standard disaster recovery plan, following aspects may help you.

Disaster Recovery Plan

Disaster

Fires, floods, earthquakes, and bombings are examples of disaster events. Other then natural disaster - power "brownout," a computer virus, inclement weather, flu epidemic, sabotage, negligence, disk drive failure, local telephone service failure, or software failure are also considered as problems.

Problems often take the form of unforeseen events that cause damage or lengthy disruption or threaten to do so. One can often more readily recognize the situation is a disaster with these types of occurrences. Such kind of disasters may evolve from problems that disrupt normal operations and then worsen or continue so long the disruption becomes critical.

Your plan includes –

1. List down all possible operational, legal, and financial impact from a disruption or disaster
2. List down threats that could turn your IT infrastructure and services down that cause business interruption

3. Identify probability of occurrence of each identified threat
4. Estimate the loss potential of a service area (quantitative or qualitative)

Recovery

Define your recovery strategy: The recovery strategy is an overview of the recovery process that the organization will follow if affected by a disaster.

The strategy should speak to:

1. Recovery requirements for critical business operations.
2. Provisions for off-site storage of critical data.
3. Alternative processing strategies and facilities such as.
4. Procedures for obtaining resources during both the recovery phase and the restoration phase.

Disaster recovery plans should address specific procedures for both situations.

Emergency & Escalation steps

Emergency procedures direct the response to disaster events. Escalation procedures direct the response to problems. Both sets of procedures may result in the declaration of a disaster and activation of the recovery plan.

Emergency Response

1. Life protection & Safety
2. Immediate emergency help from fire, police, and hospitals
3. Reduce loss of IT services or assets
4. Set up a crucial point coordinating the recovery plan

Problem Escalation: The purpose of problem escalation procedures is to define the steps and time intervals leading up to the declaration of a disaster.

Recovery Operations

1. Recovery flow: Define outlines and steps to follow in case of disaster situation

2. Build recovery team organization: Assign staff and management responsibilities for putting the recovery plan into effect. Include team or individual assignments of responsibility by area of expertise such as:

3. Site restoration or relocation

4. Verification and Plan maintenance

Standard recovery plan includes following details

1. Agency staff to be called in the event of a disaster:
2. Disaster Recovery Team
3. Building Maintenance
4. Building Security
5. Legal Advisor
6. Emergency services to be called (if needed) in event of a disaster: Ambulance, data processing backup, Firemen, Experts, Police, and Electricians, etc.
7. Locations of in-house emergency equipment and supplies: Electricity, Gas, Water, Ladder, IT support
8. Sources of off-site equipment and supplies
9. Salvage Priority List

Attach a copy of the records retention schedule identifying all vital/essential records series. The location and record medium of the preservation duplicate for each vital records series should be noted.

The following questions can be helpful in determining priorities:

1. Can the records be replaced? At what cost?
2. Would the cost of replacement be less or more than restoration of the records?
3. How important are the records to the agency?
4. Are the records duplicated elsewhere?

Agency Disaster Recovery Procedures: Attach a list of specific procedures to be followed in the event of a disaster in you agency, including responsibilities of in-house recovery team members.

Follow-up Assessment:

A written report, including photographs, should be prepared after recovery and attached to a copy of the disaster plan. The report should note the effectiveness of the plan, and should include an evaluation of the sources of supplies and equipment, and of any off-site facilities used.

That's what about planning. But more than plan, tackling situation in live is different. Struggling and being with actual disaster is different. William said, "Once you fully apprehend the vacuity of a life without struggle, you are equipped with the basic means of salvation". Avoiding disaster in advance is what manager taught in advance. But managing actual disaster in real life is what manager learns only when he or she actually struggles with it.

Further Readings & Source

Information Technology Disaster Recovery and Business Resumption Planning Standards Basic Guidelines for Disaster Planning

By Jay C