The Disaster Recovery Handbook

A Step-by-Step Plan to Ensure Business Continuity and Protect Vital Operations, Facilities, and Assets

Michael Wallace, Lawrence Webber

• Publisher: AMACOM
• Year: 2017
• eBook ISBN: 9780814438770
• Edition: 3
• Topic: Sciences sociales
• Subtopic: Stratégie commerciale

The twenty-first century is an unpredictable place. While you cannot predict or prevent disasters, you can prepare for them with effort and planning.

A quick survey of the headlines for any given day in the twenty-first century will highlight global market-affecting disasters such as superstorms, data breaches, pandemics, system failures, and strikes.

With the detailed guidance found in the thoroughly updated version of this handbook, your company’s survival and the speedy resumption of business is all but assured.

In The Disaster Recovery Handbook, you will learn how to proactively:

• Assess risk
• Create and document recovery procedures
• Assemble a disaster team
• Test and debug thoroughly
• Safeguard vital records, and more!

With The Disaster Recovery Handbook by your side--including the third edition’s updates of emerging risks, developments in IT networking, and information security--you can learn how to avoid a great deal of potential trouble for your organization.

When unavoidable, unpredictable disasters occur, you will know that you have planned for every contingency and have ensured that your company is responsible, ready, and resilient.

1

GETTING STARTED

Overview of the Project

Nothing is impossible for the man who doesn’t have to do it himself.

—A. H. WEILER

INTRODUCTION

The job of a business executive requires coordination of the many activities necessary to create a successful business. Markets must be analyzed, potential customers identified, strategies for creating and delivering products and services must be developed, financial goals established and reported, legislative mandates followed, and many different stakeholders satisfied. To ensure that these objectives are met, businesses eventually develop a series of processes designed to produce the desired result. But the world is a dangerous place. Earthquakes, floods, tornadoes, pandemics, snowstorms, fire, and other natural disasters can strike at any time and interrupt these important processes. Terrorism, riots, arson, sabotage, and other human-created disasters can also damage your business. Accidents and equipment failures are guaranteed to happen. As an executive responsible for the well-being of your organization, it is critical that you have a plan in place to ensure that your business can continue its operations after such a disaster and to protect vital operations, facilities, and assets.

You do this just like you do any other important task; you analyze the situation and create a plan. A disaster recovery plan keeps you in business after a disaster by helping to minimize the damage and allowing your organization to recover as quickly as possible. While you can’t prevent every disaster, you can with proper planning mitigate the damage and get back to work quickly and efficiently. The key is having a well-thought-out and up-to-date disaster recovery plan. This chapter will lead you through the creation and implementation of a project plan for creating an effective disaster recovery plan.

Disaster recovery is to recover from a significant disaster, such as a roof collapse in the computer room or a fire in a significant portion of the offices. A disaster almost always requires rebuilding a portion of the business in a recovery area in a very short time. Business continuity, also known as business resilience, involves identifying and mitigating critical machines that may fail. For example, a failure of the database server may close down online customer orders, so a second server is clustered and the disk storage is mirrored to provide redundancy.

THE DISASTER RECOVERY PLAN PROJECT

Building a disaster recovery or business continuity plan is much like any other business project. A formal project management process is necessary to coordinate the various players and company disciplines required to successfully deliver the desired results of the project. This chapter will give you a high-level roadmap of what you should expect as you prepare to lead or manage a disaster recovery project. A sample project plan is included in the companion url accompanying this book. Adapt this chapter and the project plan to fit your business goals, company timeline, and scope of project.

Most projects tend to run in a well-defined sequence. For example, to build a new house, first you clear the land, then build the foundation, then build a floor, and so on. Many things cannot begin until the previous step is completed. A business continuity plan (BCP) project is a bit different. In the project’s early stages, most actions logically follow each other. However, once the basic elements are in place, the project bursts out onto parallel tracks, as each department documents its own area. How you proceed in your company is, of course, determined by your corporate culture, the resources available to work with to complete the process, and the level of visible support from the project’s sponsor. Most business continuity projects follow these steps:

1. An executive within the organization decides that a business continuity plan is needed. This might be due to an auditor’s report or the result of a business disruption that was more financially painful than it would have been if a plan had been in place. Or it could be that an alert employee realized that a good plan did not exist and brought this to the executive’s attention. This executive usually becomes the sponsor for the project.

2. The first (and most important) step that the sponsor takes is to select someone to lead the project. This person is most often called the Business Continuity Manager and is responsible for the successful completion of the project.

3. The project sponsor and the Business Continuity Manager meet to clearly define the scope of the project, the project timeline, and expectations. The Business Continuity Manager must be comfortable that the resources available are adequate to meet all the objectives of the project.

4. The Business Continuity Manager selects the team that will work together to complete the project. Both technical and political considerations are important in selecting a team that can successfully develop a workable business continuity plan.

5. The Business Continuity Manager together with the team now develops the project plan to be used in managing the project. Tasks are identified and assigned, task durations calculated, and activities are sequenced as the project plans are developed.

6. The project plans are executed. The Business Continuity Manager oversees the project as the plan unfolds, keeping everyone focused on completing their tasks and ensuring that milestones are met and that important stakeholders are kept informed as to the project’s progress. It is here where the actual continuity plans for the organization are created.

7. Once the business continuity plans have been developed and tested, the Business Continuity Manager closes the project by making sure that everything was documented properly and handing the project results over to the individual(s) responsible for keeping the plan up to date. Each affected department will usually have someone responsible for keeping their portion of the plan current. A report is also generated for the sponsor recapping the project and documenting lessons learned.

In many organizations, the job of Business Continuity Manager is not taken as seriously as it should be. Management in these organizations only wants you to write something, anything to make the auditors go away. That’s okay because as you build the plan, and as they begin to see the benefits, their interest and support will grow.

A project plan organizes the team so members focus their skills on specific actions to get the job done. This respects their time and brings the project to a prompt, but successful, solution.

INITIATING THE PROJECT

Every project starts with a sponsor. A sponsor should be a person with enough organizational influence to give the project credibility, financing, and strategic direction. The sponsor should also possess the management clout to ensure the willing cooperation of other departments and to ensure that the project is adequately funded. Building a business continuity plan in many cases involves changing people’s attitudes and some of their tried-and-true business processes. Business continuity planning is a logical step toward mistake-proofing a business. So, to suppress the reluctance to change or even participate in the project, it is important for the sponsor to be of sufficient stature as to overcome objections before they are raised.

Ideally, the sponsor is the company’s CEO, or the Vice President in charge of the local facility. However, sometimes it is a department manager who realizes that something must be done. Whoever assumes this role must remain involved with the project throughout its lifetime. As the sponsor’s interest fades, so will the interest of your team. Find out why they want to sponsor the project. It will tell you how much support to expect.

In some cases, the sponsor honestly believes the project is a good idea and is personally interested in seeing it is completed. In other cases, the sponsor may have been required to start this project due to an auditor’s citation of a poor business practice. In this situation, the sponsor may only want the minimum recovery plan to satisfy the audit citation. Spend some time early in the project digging out what is motivating support for this project. By understanding what motivates the sponsor, you can gauge how much time and money will be available to you. It is also possible for you to educate the sponsor on the many advantages of having a well-written company-wide plan.

The sponsor’s first task is the selection of the Business Continuity Manager, who will act as the project manager. In most companies, the cynics say that if you raised the issue, then the job is yours! This isn’t a bad way to assign projects because only the people who believe in something would raise the issues. Still, the selection of the right Business Continuity Manager will help make this project a success and the wrong one will make success much more difficult to attain.

The sponsor has the additional duties of approving the plan’s objectives, scope, and assumptions. The sponsor must also obtain approval for funding.

THE BUSINESS CONTINUITY MANAGER

The selection of the person to spearhead this project is the single most important part of building a plan. The Business Continuity Manager should be someone who can gain the willing cooperation of team members and their supervisors. To help ensure the support of everyone in the organization, the Business Continuity Manager should be publicly assigned to this task with the sponsor’s unqualified support. This is essential to overcome internal politics and to let everyone know that their assistance is important and required. As the project moves forward, regular public displays of support are required if the project is to result in a complete and usable plan. Form 1-1 (see companion url) is an example of a letter appointing the Business...

Table of contents

• Cover Page
• Title Page
• Copyright Page
• Contents
• Supplementary Materials
• Acknowledgments
• 1. Getting Started: Overview of the Project
• 2. Building the Business Case: Measuring the Impact On the Business
• 3. Evaluating Risk: Understanding What Can Go Wrong
• 4. Selecting a Strategy: Setting the Direction
• 5. Building an Interim Plan: Don’t Just Sit There, Do Something
• 6. Writing the Plan: Getting It Down On Paper
• 7. Administrative Plan: Orchestrating the Recovery
• 8. Technical Recovery Plan: Putting Humpty Dumpty Back Together Again
• 9. Work Area Recovery Plan: Getting the Office Up and Running
• 10. Pandemic Plan: The Wrath of Nature
• 11. Crisis Management Plan: Minimizing the Damage
• 12. Emergency Operations Plan: Taking Control of the Situation
• 13. Testing Your Plans: Test, Test, Test
• 14. Certifications: How Does Your Plan Measure Up?
• 15. Policies and Procedures: Get Everyone Moving In the Same Direction
• 16. Electrical Service: Keeping the Juice Flowing
• 17. Telecommunications and Networking: Your Connection to the World
• 18. Vital Records Recovery: Covering Your Assets
• 19. Information Security Response: Always Vigilant
• 20. Data: Your Most Irreplaceable Asset
• 21. Workstations: The Weakest Link
• 22. Customers: Other People to Worry About
• 23. Suppliers: Collateral Damage
• 24. Fire: Burning Down the House
• 25. Human Resources: Your Most Valuable Asset
• 26. Health and Safety: Keeping Everyone Healthy
• 27. Terrorism: The Wrath of Man
• Glossary
• Index
• About the Authors