A good business disaster recovery plan considers IT, staffing
Not sure if your disaster recovery plan takes business needs into account? A good plan should cover business operations, as well as technology and staffing requirements.
When it comes to disaster recovery, most plans focus on the central task of protecting and recovering data. But recovery isn't always swift or easy, and problems related to the disaster could make it more complicated than expected. That's why DR plans must often look beyond the obvious and consider the business as a whole, as well as the people that work within it.
According to practitioners and analysts, a good business disaster recovery plan links technical goals to business continuity planning and common sense understanding of what it takes to keep a business running or to bring it back after a crisis.
Eric Leland, a partner at consultancy firm FivePaths LLC, said one of the top priorities in a business-forward disaster recovery plan is readily available personnel who can respond to disasters that may occur. "No matter how busy the company is for other reasons, skilled DR roles must be available at all times," he said. Organizations will need a well-defined and practiced roadmap for critical tasks to complete on site during recovery -- one that even nontechnical staff can help with.
When travel is impeded, you never know which staff members may be able to reach the disaster site. If those without a technical background are able to get there first, there should be a plan in place that allows them to get business continuity and disaster recovery (BC/DR) processes up and running.
It is not enough to simply worry about recovery when disaster strikes. Maintaining continuity and keeping normal operations going in a crisis is of vital importance to many businesses. "A disaster recovery plan should specifically target system recovery that enables business continuity," Leland said.
Consider business processes
Gartner analyst Mark Jaggers said it is no longer as critical for some organizations to have a physical site in place for staff to congregate during a disaster, if remote work is a possibility. However, other problems can still hinder a recovery.
A disaster recovery plan should specifically target system recovery that enables business continuity.
Eric LelandPartner, FivePaths LLC
For example, DR planners often neglect considerations of network bandwidth, latency, security settings, and user or administrative credentials, which can lead to DR failures or shortcomings. "These are things that are often assumed -- and if you haven't tested regularly you may be surprised," Jaggers said. "There is often the assumption that, in a DR situation, people will know key information like the right passwords -- but they may not."
That's why a DR plan needs to start with a tiering of business processes and associated applications, Jaggers said. That tiering should be based on the business continuity plan and a thorough business impact analysis, he added.
Leland also agreed it is helpful to plan for the continuity of the business so that you can then understand where DR plugs into that plan, and what aspects of DR are most critical to the business as a whole. However, Leland said that this does not mean business continuity necessarily must come first before disaster recovery. "It means that business continuity should shape and prioritize what disaster recovery to focus on," he said.
Long-term resilience
Leland said that BC/DR is most successful when regular work is done to be prepared to enact the plan and to drill the plan into every participant. "This is an investment of time that can be predicted and managed to avoid a substantial risk of costly confusion during an emergency response," he said. An organization must consistently update its business disaster recovery plan to ensure that it is accurate and accessible. Otherwise, staff may end up stumbling against missing or incorrect information as they work toward rapid and complete recovery. Leland recommended checking your plan for the following:
Beyond the technology, Greg Schulz, senior advisory analyst at StorageIO, said business and IT should also think about ensuring the safety of people throughout a potential emergency. "Are they protected and do you know where they are?" Schulz asked.
Because unexpected events can render even the best plans inoperable, Schulz also champions what he calls a "virtual recovery kit" or a "jumpstart tool box." This is a shortcut to various recovery tools and instructions that is located in a safe place, such as a secure file-sharing site. It can also be kept in multiple locations, so individuals trying to launch a recovery can easily access it to start the restore, unlock systems and data, and resume operations.
A business disaster recovery plan could also extend to the needs of employees beyond IT, Schulz said. "You may have the data and the keys and the settings, but how do people get to access that, how do they log in, and where will they work?"
Since very few disasters actually occur the way they were planned for, there's almost always going to be an unanticipated challenge that has to be overcome, Jaggers said. That's why exercising and practicing the plan is important. "It will build confidence in the organization's ability to execute and reinforces familiarity with the various systems."
