Developing recovery strategies: Five things to consider

Giraffe tightropeIf you’ve been reading this blog lately, you’ll remember we’ve talked in detail about creating your BC/DR plan—performing a business impact analysis, documenting processes, identifying dependencies, assessing risks and more.

Ticking off these check-boxes is critical work, but in a sense the work is theoretical. You made haven’t made plans—yet—for getting your hands dirty and… Well, actually recovering all the things you now know you have to recover.

Now it’s time to do exactly that. Here are five things to keep in mind.

Remind yourself why you’re doing it

Mapping out recovery strategies is important, because doing so will help you respond to a disruption as soon as one occurs and allow you to recover as many functions (and salvage as much infrastructure) as you can.But there’s an added bonus to planning in advance—the process will expose gaps between your capabilities and where you know your business needs to be. Better to know now that you don’t have the budget, or that a major RTO is unrealistic, so that you can take steps to close the gap.

Go department by department and process by process

Just as you systematically completed your BIA department by department, you’ll do the same with your recovery strategies. Each department in your organization needs to develop recovery strategies for its critical processes, based on the RTOs and RPOs identified in your BIA.

You’ll get better results if you use a template

Everyone in the business should document recovery strategies the same way. That’s why it makes sense to use a template—to ensure that anyone who reads your resulting BC/DR plan in a crisis will have to relearn as little as possible. Here’s a sample template you can duplicate to document each critical process in every department:

Functional description: a high-level overview of the process and how it works

Dependencies: a list of the people, resources, systems and applications (both internal and external) that are required for the process to function at the minimum required level

Recovery team contacts: contact information for primary contacts, alternate team leaders, team members and key vendors such as your data center
Recovery objectives: details on RTO, RPO, estimated recovery time and method you plan to use to restore the process

Expected state: a description of the state of the process after recovery, including whether or not management should expect a gap between the recovered state and the business-as-usual state

Recovery procedures: step-by-step recovery procedures in a spreadsheet or table, with information on pre-recovery, recovery, testing processes, falling back to original processes if necessary, and post-recovery.

Consider the people who’ll be carrying out the recovery

When writing your recovery strategies, know your audience—don’t pepper task descriptions intended for entry-level employees with higher-level descriptions, terminology and acronyms. Conversely, if you’re writing a highly technical procedure for a database administrator, there’s no need to explain what a database is.

Anticipate staffing issues

Depending on the nature or scale of the crisis you might face, you may have to deal with staffing problems. Medical issues, for example, may put other recovery plans on hold—especially if you have to tend to injuries or deaths. (Don’t forget, either, about planning for crisis counseling and notifying family members in situations such as these.)

Include well-documented and rehearsed procedures. Plan for evacuating and accounting for your personnel, transporting staff, relocating to alternate sites, retrieving personal items like jackets or purses that people leave behind, and making plans—such as daycare or elder care—that will help displaced staff take care of their families at home.

Documenting recovery strategies can be an arduous process, but here’s the good news—if you keep these five considerations in mind as you’re doing them, you should be able to simply copy and paste your work into your BC/DR plan in progress.

Now that’s smart planning.

Learn more about BC management with The Definitive Guide to Business Continuity Planning.