If you’ve been reading this blog lately, you’ll remember we’ve talked in detail about creating your BC/DR plan—performing a business impact analysis, documenting processes, identifying dependencies, assessing risks and more.
Ticking off these check-boxes is critical work, but in a sense the work is theoretical. You made haven’t made plans—yet—for getting your hands dirty and… Well, actually recovering all the things you now know you have to recover.
Now it’s time to do exactly that. Here are five things to keep in mind.
Mapping out recovery strategies is important, because doing so will help you respond to a disruption as soon as one occurs and allow you to recover as many functions (and salvage as much infrastructure) as you can.But there’s an added bonus to planning in advance—the process will expose gaps between your capabilities and where you know your business needs to be. Better to know now that you don’t have the budget, or that a major RTO is unrealistic, so that you can take steps to close the gap.
Just as you systematically completed your BIA department by department, you’ll do the same with your recovery strategies. Each department in your organization needs to develop recovery strategies for its critical processes, based on the RTOs and RPOs identified in your BIA.
Everyone in the business should document recovery strategies the same way. That’s why it makes sense to use a template—to ensure that anyone who reads your resulting BC/DR plan in a crisis will have to relearn as little as possible. Here’s a sample template you can duplicate to document each critical process in every department:
Functional description: a high-level overview of the process and how it works
Dependencies: a list of the people, resources, systems and applications (both internal and external) that are required for the process to function at the minimum required level
Recovery team contacts: contact information for primary contacts, alternate team leaders, team members and key vendors such as your data center
Recovery objectives: details on RTO, RPO, estimated recovery time and method you plan to use to restore the process
Expected state: a description of the state of the process after recovery, including whether or not management should expect a gap between the recovered state and the business-as-usual state
Recovery procedures: step-by-step recovery procedures in a spreadsheet or table, with information on pre-recovery, recovery, testing processes, falling back to original processes if necessary, and post-recovery.
When writing your recovery strategies, know your audience—don’t pepper task descriptions intended for entry-level employees with higher-level descriptions, terminology and acronyms. Conversely, if you’re writing a highly technical procedure for a database administrator, there’s no need to explain what a database is.
Depending on the nature or scale of the crisis you might face, you may have to deal with staffing problems. Medical issues, for example, may put other recovery plans on hold—especially if you have to tend to injuries or deaths. (Don’t forget, either, about planning for crisis counseling and notifying family members in situations such as these.)
Include well-documented and rehearsed procedures. Plan for evacuating and accounting for your personnel, transporting staff, relocating to alternate sites, retrieving personal items like jackets or purses that people leave behind, and making plans—such as daycare or elder care—that will help displaced staff take care of their families at home.
Documenting recovery strategies can be an arduous process, but here’s the good news—if you keep these five considerations in mind as you’re doing them, you should be able to simply copy and paste your work into your BC/DR plan in progress.
Learn more about BC management with The Definitive Guide to Business Continuity Planning.