Getting Started

Disaster recovery plans deserve the full attention of executives at the highest levels of an organization. To ensure that upper-level management takes ownership of the plan, experts recommend that all good disaster recovery plans begin with an official proposal. That proposal can be presented to the board of directors to the chief executive officer or to the chief information officer.

©2007 iStockPhoto Executives collaborate to create a plan.

The proposal is not the plan, but rather a "plan for making the plan." If the disaster recovery plan is going to be created in-house, the proposal should recommend which specific employees will manage the project and approximately how many work hours it should take. If the proposal recommends a third-party consultant, it should include a budget based on the consultant's proposed services.

If the company has never drafted a disaster recovery plan before, the board might need to be convinced that it's necessary. The online Disaster Recovery Guide suggests using the following reasons:

• The dependency on computer networks and electronic delivery systems increases the odds of everyday business being disrupted by failure of one of these core systems.
• A formal process to deal with potential accidents, disasters or outages is needed and in some industries, required.
• Everyone wants to lower the potential costs of dealing with a disaster.
• Because of the speed at which technology is changing, there's a greater chance of a "knowledge gap" leading to inadequate information technology security precautions.
• An effective system to backup and recover essential business data is essential in case of network shutdown.
• Most importantly, everyone wants to avoid the potential failure of the business in the face of an unforeseen, catastrophic event.

Once the proposal is approved, the real work begins. Drafting a good disaster recovery plan is a slow, methodical process. It requires that each department be broken down into its smallest units, and that each separate function of each unit be analyzed for its importance to the business.

This is why many businesses choose to hire an outside consultant to create their disaster recovery plan. Third-party disaster recovery experts have the experience and impartiality to conduct employee interviews, design questionnaires and analyze day-to-day practices in order to come up with the most comprehensive recovery plan possible.

Creating a Business Impact Analysis (BIA) is the first step. A BIA questionnaire collects all the information about a single business function so it can be ranked in the order of importance. According to the Texas State Office of Risk Management (SORM), a good BIA should include the following information and more:

• A detailed description of business functions and operations for each department
  
• Any other functions with a direct or indirect impact on this function
• When the function loss would have the most impact
  
• The time it would take the business to realize that the function had failed, both operationally and financially
• The replacement equipment needed to recover from this function's loss such as phones, PCs, software and workstations
• If the function can be accomplished by working from home, or if it can be shifted to another part of the business

The disaster recovery planning team uses this information to rank all business functions according to time tiers. For instance, Tier One includes those functions that need to be back online within a few minutes up to 24 hours. Tier Two includes those functions that need to be back online within 24 to 36 hours and so on.

Another piece of the pre-planning research, according to the Disaster Recovery Guide, is assembling important contact information and emergency procedures. You'll need emergency contact information for all employees, all vendors and partners and equipment inventory for all information technology and administrative departments. You'll also need paperwork and procedures for dealing with evacuations, floods, fires, earthquakes and insurance.

Keep reading to find out what kind of information goes into the actual disaster recovery plan.