Disaster Recovery
Resource Center

If a major disaster hit your organization—your IT infrastructure, your applications and databases—how long could the business survive? To help you answer that challenge, the following checklist while not comprehensive can at least help you get started from an IT perspective.

"With today's heavy reliance on constant access to information, even a few hours of downtime can have catastrophic consequences, including huge financial losses, a tarnished reputation and lost customer goodwill," said Kathleen Flaherty, chief marketing officer at AT&T. "The results of this survey demonstrate that too many businesses still do not take business continuity planning seriously." –ContinuityCentral.com

Make sure your disaster plan covers your IT infrastructure—each data center or processing center—as well as the entire organization—people, processes, and facilities. Your backup plan should include:

• Plan objectives—for example: to restore the business to full operations within 1 hour.
• An analysis of alternatives—using a hot site, warm site, information availability software, etc.
• Scalability—there will be small disasters as well as the potential nightmare scenario; your plan should take this sliding scale into consideration.
• Emergency procedures.
• Temporary disaster organizational structure—what if scenarios that include C-level executives who are unavailable.
• Written communications to users that address:
  • Formal back up procedures for files on personal computers, laptops, PDAs, etc.
  • Priority of critical applications and databases.
  • Confidentiality notices—to ensure that everyone working with backup data understands the sensitivity of the process.
• Security—to ensure that classified documents, Federally protected data or other vital information assets are protected appropriately. 

Ensure that you test your disaster plan on a regular basis, including both planned and surprise tests. While this can be time-consuming, every test will point out weaknesses in the existing plan or encounter new circumstances that were unanticipated (such as a recent merger or acquisition adding additional complexity to a data center recovery). Experts recommend that a test:

• Occur every six months or sooner.
• Include off-site stored material such as archived tapes.
• Lead to updates and enhancements in the disaster plan—no plan should remain static.

Complete a business impact analysis and risk assessment periodically. As the business changes, so will the risks and impact of a disaster. This should include:

• The total amount of financial exposure.
• A prioritized list of all applications, operating systems, databases, networks, etc.
• The maximum amount of downtime that each of the above can sustain during an outage.

Prepare a cost benefit analysis for the plan—include the initial cost, development time and effort, the cost to maintain the plan and processes.

Assign a point person—with the accountability to manage, update and maintain the disaster plan. This may include gaining any necessary training in disaster preparedness, disaster recovery and emergency management.

If your plan includes using a backup facility, you should:

• Have processes in place that will inform you immediately when your backup site vendor makes any change in hardware or software.
  • They should be able to provide you with a complete analysis of the impact any change will have on your applications, databases and networks.
  • After the change, be sure to test your plan to ensure that the analysis is correct.
• Be sure that you understand the following ramifications:
  • Is it accessible? The off-site location should be accessible 24/7.
  • Is it secure? The location should always be secure from unauthorized intrusion and include separate environmental controls for each storage facility.
  • Is the location easy to reach but sufficiently distant to reduce risks from a regional disaster? For example, a one-hour round-trip travel distance may seem a long distant, but a hurricane or typhoon can impact a region up to hundreds of miles.
  • Is what is stored there comprehensiveness enough? Off-site storage should include all documentation, program listings, etc. that will enable a “start from scratch” operation if necessity requires.

Will you be competing for resources there in the event of a large-scale regional outage or disaster? For example, if all businesses in your region were affected by a disaster, will your off-site IT services vendor be able to accommodate your recovery as well as all other recoveries for its clients in your region?