|
There's
More Than One Way to Get Your Disaster Recovery Plan
The call
came at 6 a.m. "Our system crashed and we cannot get
it restarted." That call woke Bill Brown out of a sound
sleep, and it would be four days before he would sleep normally
again.
Fortunately
for Bill's customers, this situation is an extremely rare
occurrence. In this case, the client company had a scheduled
backup every night of the week, including Sunday, an unattended
backup with a detailed log of the results provided on a daily
basis. The full system was backed up each night.
So what
went wrong? The only action requiring human intervention was
not completed properly. Each day the tape needed to be changed.
The backup was successful on Thursday night, so the tape should
have been removed on Friday morning, but was not. So, Thursday's
tape was used on Friday night, and again was successful. On
Saturday morning the tape should have been changed, but it
did not get switched.
Sometime
on Saturday, the primary disc drive began to fail. Saturday
night, the system attempted a backup and failed because the
drive was already failing. The only good backup was Wednesday
night's.
In a large
operation such as this, there is no good way to re-enter all
the data updates, changes and postings which occur over a
three day period. In this instance, most of the data from
the intact primary database file could be restored, but the
recovery process took four to five days based on the piece-meal
process required.
Can your
company wait four days to get back online? This disaster was
totally avoidable if the business continuity plan had been
attended to. In this case, fortunately, all of the data was
recovered, but not all disasters end up with so favorable
a result.
Most businesspeople
today agree that a disaster recovery plan is essential for
every business, whether large or small. Do you have one? Is
it up to date? If you backup fails tonight, do you and your
staff know what to do tomorrow morning? Even if you want to
say yes, take a moment now to review your disaster recovery
procedures. Does everyone know their part? Is everything written
down? Has it been tested recently?
If you
are hesitating in your answers, you need to commit to preparing/updating
your disaster recovery plan right now. Remember that it is
more than just arranging for a separate facility and equipment
for your staff. You must take steps to ensure you do not lose
customers, that your customers know what is going on and how
long it will be before you are back to normal. You must assure
that the world at large does not lose confidence in your company
or its senior managers, because that will surely lead to loss
of customers, as well.
And don't
make the mistake of thinking that disasters can affect only
your facility and business. What would you do if one of your
key vendors had a disaster? Do you keep enough of this vendor's
product in-house to allow you to continue to do business for
several months? Or do you rely on weekly shipments to keep
your operation going? For your own protection, you should
be discussing contingency planning with every organization
with whom you do business.
Now, before
you decide how to prepare your disaster recovery plan, it
is important to consider the following:
Know where
your business is vulnerable; this is commonly referred to
as "risk assessment" or "risk analysis".
You must identify and minimize your exposure to problems that
threaten your operation. Do you rely on one salesperson to
generate most of your new business? What kinds of adverse
weather conditions could affect your facility? Are you located
in an area where businesses are regularly targeted by burglars
or vandals? You cannot address disaster recovery until you
identify the potential disastrous events.
Make the
commitment to the business continuity planning process, and
make sure employees at all levels share that commitment. This
may sound too obvious to mention, but we all know of businesses
that have been devastated by a disaster they never saw coming.
The tendency in most businesses is to place a low priority
on disaster recovery planning, even today, assuming the worst
will never happen. Other businesses make the mistake of believing
that because they back up their data every night, no further
disaster recovery planning is needed.
Don't
minimize the planning process and don't expect one single
individual to be able to handle the whole project, unless
your operation is extremely small.
So you
know you need a disaster recovery plan, or you need to update
your existing plan, and you've made the commitment. There
are three ways to proceed: (1)Appoint someone on your staff
to do the job; (2)Purchase one of the software programs on
the market which will guide you or your employee through the
job; or (3)Hire an outside specialty firm to do the job.
The
Good and Bad of Each Approach
If you
appoint someone on your staff to prepare/update your disaster
recovery plan, you will enjoy the complete security of knowing
all the information gathered during this process will stay
in-house. Confidentiality can be preserved much more easily.
Also, other employees may be more willing to cooperate with
someone they already know.
However,
the person you appoint may not have the expertise to complete
the task, which demands outstanding organization skills, attention
to detail, and intimate knowledge of every aspect of company
operation. This individual may also suffer from a time crunch,
trying to fit the task into the existing workload. Preparing
and enforcing contracts with other companies who will provide
certain services and facilities in the event of a disaster
requires negotiating skills and a level of corporate authority
which your chosen person may not possess.
You can
purchase an over-the-counter software program which will guide
you or your employee through the process of preparing a plan,
circumventing the problem of lack of knowledge or experience.
The software is no more difficult to use than any other product
and can be tailored to your needs. Here again, your confidentiality
is assured, because you will be relying on internal personnel
to complete your plan.
However,
no matter how complete the software appears to be, it may
not contain everything you need to organize a plan that is
complete and applicable to your particular business. The last
thing you want is to find out your plan has holes in it while
you're trying to recover from a disaster.
The third
alternative is to hire an outside, specialty firm to complete
your disaster recovery plan. While you will be giving a great
deal of sensitive information to this firm, they will be prohibited
from revealing it by a confidentiality agreement, which is
standard procedure in this situation.
The biggest
advantage to hiring an outsider is that they will see potential
flaws in your plan where you will not. They have also been
trained to do disaster recovery only, as a profession; you
may even be able to hire a certified business continuity specialist,
who has higher education and credentials in the field.
The down
side is, of course, giving up control of this sensitive undertaking
to people you hardly know, unless your best friend happens
to be a disaster recovery expert. However, take comfort in
the fact that the firm you hire has performed this service
for many companies before yours. Their approach to the task
will be professional and straight to the point, saving you
time and, therefore, money.
How
To Do It On Your Own
Your first
step after identifying your business vulnerabilities is to
design and circulate a survey to department heads. The survey
must be neither too long nor too short. It should encourage
your department heads to consider exactly how they could continue
to operate after the unthinkable happens.
Once the
surveys are returned to you, sort through to make sure they
are complete. Get back to the department heads with any questions
or concerns; you may need to insist they spend this extra
time on the task. In fact, one of the most frustrating parts
of preparing a plan is convincing people that their portion
and any corrections/changes must be completed in a timely
manner.
When
it comes time to writing the plan, it is best to follow an
outline. There are several web sites that offer a comprehensive
outline of a good disaster recovery plan. Why reinvent the
wheel if you don't have to? At the end of this article, you
will find useful links.
Once you
have a first draft of the plan, it is time to submit it to
senior management for their review and approval. This will
take more time, and you may have more dfficulty in getting
senior managers to make the time for this task.
Approval
of the actual plan is not the final step, however. After approval,
make sure department heads receive a copy of the overall plan.
Then make sure they understand their individual department
plan.
Now it's
time for testing. This is another time-consuming task, setting
up the time for the test, communicating that time to everyone
in the company so they will be prepared, then staging the
test and evaluating the results.
How
to Choose the Right Disaster Recovery Software
If you
elect to purchase a software package to assist you in preparing
your disaster recovery plan, you will have quite a few from
which to choose. The process of selecting one should be no
different than the way you consider any other software purchase.
Make a
list of what you want the software to accomplish for you.
Then look at what's out there. Don't be afraid to ask for
references from any company you are considering, and check
with those references. The newest software by an unknown company
may appear complete, but without a proven track record, it's
basically an unknown. For an application as important as disaster
recovery, you need a more stable, proven product.
Don't
neglect to learn how much support you will receive after the
sale of the software. If the package is complete, you should
need minimum support, of course, but the unexpected does happen.
If you have no one to call with questions or concerns, you
will have wasted your money.
The process
after you purchase the software is pretty much the same as
that outlined above. Using the forms/templates provided within
the software, you will gather the information from the department
heads, put the recovery plan together, obtain approval from
senior management, then test the plan. You will be saving
time, however, by not having to develop your own department
surveys or having to do all the initial research into what,
exactly, constitutes a good disaster recovery plan.
Hiring
An Outside Firm
If you
prefer to have a professional firm handle the preparation
of your disaster recovery plan, beginning to end, there are
certain guidelines to follow here, as well. They are, however,
not different from how you would hire any other vendor or
service provider for your company.
Research
the companies that are providing this service, and choose
the top three to five that offer the best fit for your company.
Ask for bids, and don't forget to ask for references that
include current clients. Check those references as carefully
as you would any other, especially if you're talking to a
relatively young company.
Once you
hire a firm and they agree to provide your plan, communicate
to the rest of your staff the importance of the disaster recovery
plan. Stress that the firm you have hired has your complete
confidence and support, and you expect everyone to cooperate
to the fullest with the firm's representatives. This is an
essential step, because your employees may be very unwilling
to share information with an outsider.
As part
of the contractual agreement between your company and the
disaster recovery firm, the disaster plan will be submitted
to your senior management and tested, and the results communicated
to you. For an additional fee, the firm may come back to you
at regular intervals to update the plan.
No matter
how you elect to prepare your disaster recovery plan, the
most important thing is not to leave yourself and your company
twisting in the wind if the worst should happen. Address your
recovery issues today, and your business will move forward
without interruption for years to come, no matter what else
is going on in the world.
Business
Continuity Planning Model by DRJ.com
The best
place to start when creating or revising a disaster recovery
plan is with an outline, and this is one of the most comprehensive.
Besides the quality of the outline, if you register with the
site, you will gain access to all the fantastic background
articles that link to the outline.
Small
and Medium Size Business Guide to a Successful Continuity
Program
Even if
you're not officially classified as a small or medium size
business, this article is worth your time. Besides giving
practical advice about business continuity, it offers estimated
times to complete each task, allowing you to calculate a cost
for preparing and testing your recovery plan.
|
