The
plan provides step-by-step disaster recovery strategies for recovering
disrupted systems and networks to minimize negative impacts to company
operations. A risk assessment identifies potential threats to the IT
infrastructure; the DR plan outlines how to recover the elements that are most
important to the company.
The
plan itself should include the following:
-
Statement, overview and main goals of the plan.
-
Contact information for key personnel and disaster recovery team members.
-
Description of emergency response actions immediately following a disaster.
-
Diagram of the entire IT network and the recovery site. Don’t forget to include
directions on how to reach the recovery site for personnel that need to get
there.
-
Identifying the most critical IT assets and determining the maximum outage
time. Get to know the terms Recovery Point Objective (RPO) and Recovery Time
Objective (RTO). RPO indicates the maximum ‘age’ of files that an organization
must recover from backup storage for normal operations to resume after a
disaster. If you choose an RPO of five hours, then the system must back up at
least every five hours. The RTO is the maximum amount of time, following a
disaster, for the business to recover its files from backup storage and resume
normal operations. If your RTO is three hours, it can’t be down longer.
-
List of software, license keys and systems that will be used in the recovery
effort.
-
Technical documentation from vendors on recovery technology system software.
-
Summary of insurance coverage.
-
Proposals for dealing with financial and legal issues, as well as media
outreach.
-
Building a disaster recovery team
The
plan should be coordinated by IT team members responsible for critical IT
infrastructure within the company. Others who need to be made aware of the plan
include the CEO or a delegated senior manager, directors, department leaders,
human resources and public relations officials.
Outside
the company, vendors associated with disaster recovery efforts (software and
data backup, for example) and their contact information should be known.
Facility owners, property managers, law enforcement contacts and emergency
responders should also be known and listed within the plan (and updated
frequently as names or phone numbers change).
Once the plan is written and approved by management, test the plan and update if necessary. Be sure to schedule the next review period and/or audit of the disaster recovery functions. Update as events transpire (large or small). Don’t just put the plan in a desk drawer and hope that a disaster doesn’t occur.
User questions & answers