The Disaster Recovery Handbook

Lawrence Webber, Michael Wallace

• Publisher: AMACOM
• Year: 2010
• ISBN:
  9780814416143
• Topic: Social Sciences
• Subtopic: Global Development Studies
• Index: Social Sciences

The twenty-first century is an unpredictable place. While you cannot predict or prevent disasters, you can prepare for them with effort and planning.

A quick survey of the headlines for any given day in the twenty-first century will highlight global market-affecting disasters such as superstorms, data breaches, pandemics, system failures, and strikes.

With the detailed guidance found in the thoroughly updated version of this handbook, your company's survival and the speedy resumption of business is all but assured.

In The Disaster Recovery Handbook, you will learn how to proactively:

• Assess risk
• Create and document recovery procedures
• Assemble a disaster team
• Test and debug thoroughly
• Safeguard vital records, and more!

With The Disaster Recovery Handbook by your side--including the third edition's updates of emerging risks, developments in IT networking, and information security--you can learn how to avoid a great deal of potential trouble for your organization.

When unavoidable, unpredictable disasters occur, you will know that you have planned for every contingency and have ensured that your company is responsible, ready, and resilient.

CHAPTER 1
GETTING STARTED
Overview of the Project

Nothing is impossible for the man who doesn’t have to do it himself.
—A.H. Weiler

INTRODUCTION

The job of a business executive requires coordination of the many activities necessary to create a successful business. Markets must be analyzed, potential customers identified, strategies for creating and delivering products and services must be developed, financial goals established and reported, legislative mandates followed, and many different stakeholders satisfied. To ensure that all of these objectives are met, businesses eventually develop a series of processes designed to produce the desired result. But the world is a dangerous place. Earthquakes, floods, tornadoes, pandemics, snow storms, fire, and other natural disasters can strike at any time and interrupt these important processes. Terrorism, riots, arson, sabotage, and other human-created disasters can also damage your business. Accidents and equipment failures are guaranteed to happen. As an executive responsible for the well-being of your organization, it is critical that you have a plan in place to ensure that your business can continue its operations after such a disaster and to protect vital operations, facilities, and assets.

You do this just like you do any other important task; you analyze the situation and create a plan. A disaster recovery plan keeps you in business after a disaster by helping to minimize the damage and allowing your organization to recover as quickly as possible. While you can’t prevent every disaster, you can with proper planning mitigate the damage and get back to work quickly and efficiently. The key is having a well thought out and up-to-date disaster recovery plan. This chapter will lead you through the creation and implementation of a project plan for creating an effective disaster recovery plan.

THE DISASTER RECOVERY PLAN PROJECT

Building a disaster recovery or business continuity plan is much like any other business project. A formal project management process is necessary to coordinate the various players and company disciplines required to successfully deliver the desired results of the project. This chapter will give you a high-level roadmap of what you should expect as you prepare to lead or manage a disaster recovery project. A sample project plan is included on the CD-ROM accompanying this book. Adapt this chapter and the project plan to fit your business goals, company timeline, and scope of project.

Most projects tend to run in a well-defined sequence. For example, to build a new house, first you clear the land, then build the foundation, then build a floor, and so on. Many things cannot begin until the previous step is completed. A business continuity plan (BCP) project is a bit different. In its early stages, most actions logically follow each other. However, once the basic elements are in place, the project bursts out on to parallel tracks, as each department documents its own area. How you proceed in your company is, of course, determined by your corporate culture, the resources you have to work with to complete the process, and the level of visible support from the project’s sponsor. Most business continuity projects follow these steps:

1. An executive within the organization decides that a business continuity plan is needed. This might be due to an auditor’s report or the result of a business disruption that was more painful than it would have been if a plan had been in place. Or it could be that an alert employee realized that a good plan did not exist and brought this to the executive’s attention. This executive normally becomes the sponsor for the project.

2. The first (and most important) step that the sponsor takes is to select someone to lead the project. This person is most often called the Business Continuity Manager and is responsible for the successful completion of the project.

3. The project sponsor and the Business Continuity Manager meet to clearly define the scope of the project, the project timeline, and expectations. The Business Continuity Manager must be comfortable that the resources available are adequate to meet all the objectives of the project.

4. The Business Continuity Manager selects the team that will work together to complete the project. Both technical and political considerations are important in selecting a team that can successfully develop a workable business continuity plan.

5. The Business Continuity Manager together with the team now develops the project plan to be used in managing the project. Tasks are identified and assigned, task durations calculated, and activities are sequenced as the project plans are developed.

6. The project plans are executed. The Business Continuity Manager oversees the project as the plan unfolds, keeping everyone focused on completing their tasks, and ensuring that milestones are met and that important stakeholders are kept informed as to the project’s progress. It is here where the actual continuity plans for the organization are created.

7. Once the business continuity plans have been developed and tested, the Business Continuity Manager closes the project by making sure that everything was documented properly and handing the project results over to the individual(s) responsible for keeping the plan up to date. Each affected department will normally have someone responsible for keeping their portion of the plan current. A report is also generated for the sponsor recapping the project and documenting lessons learned.

In many organizations, the job of Business Continuity Manager is not taken as seriously as it should be. Management in these organizations only wants you to write something, anything to make the auditors go away. That’s OK because as you build the plan, and as they begin to see the benefits, their interest and support will grow.

A project plan organizes the team so members focus their skills on specific actions to get the job done. This respects their time and brings the project to a prompt, but successful, solution.

INITIATING THE PROJECT

Every project starts with a sponsor. A sponsor should be a person with enough organizational influence to give the project credibility, financing, and strategic direction. The sponsor should also be in a position to ensure the willing cooperation of other departments and to ensure that the project is adequately funded. Building a business continuity plan in many cases involves changing people’s attitudes and some of their tried-and-true business processes. Business continuity planning is a logical step toward mistake-proofing a business. So, to suppress the reluctance to change or even participate in the project, it is important for the sponsor to be of sufficient stature as to overcome objections before they are raised.

Ideally, the sponsor is the company’s CEO, or the Vice President in charge of the local facility. However, sometimes it is a department manager who realizes that something must be done. Whoever assumes this role must remain involved with the project throughout its lifetime. As the sponsor’s interest fades, so will the interest of your team. Find out why they want to sponsor the project. It will tell you how much support to expect.

In some cases, the sponsor honestly believes the project is a good idea and is personally interested in seeing it is completed. In other cases, the sponsor may have been required to start this project due to an auditor’s citation of a poor business practice. In this situation, the sponsor may only want the minimum recovery plan to satisfy the audit citation. Spend some time early in the project digging out what is motivating support for this project. By understanding what motivates the sponsor, you can gauge how much time and money will be available to you. It is also possible for you to educate the sponsor on the many advantages in having a well-written company-wide plan.

The sponsor’s first task is the selection of the Business Continuity Manager, who will act as the project manager. In most companies, the cynics say that if you raised the issue, then the job is yours! This isn’t a bad way to assign projects because only the people who believe in something would raise the issues. Still, the selection of the right Business Continuity Manager will help make this project a success and the wrong one will make success much more difficult to attain.

The sponsor has the additional duties of approving the plan’s objectives, scope, and assumptions. The sponsor must also obtain approval for funding.

THE BUSINESS CONTINUITY MANAGER

The selection of the person to spearhead this project is the single most important part of building a plan. The Business Continuity Manager should be someone who can gain the willing cooperation of team members and their supervisors. To help ensure the support of everyone in the organization, the Business Continuity Manager should be publicly assigned to this task with the sponsor’s unqualified support. This is essential to overcome internal politics and to let everyone know that their assistance is important and required. As the project moves forward, regular public displays of support are required if the project is to result in a complete and usable plan. Form 1-1 on the CD-ROM is an example of a letter appointing the Business Continuity Manager.

Some sponsors begin a business continuity project by hiring an outside consultant to build the plan. This can be a good way to get the project started and to mentor someone in the organization to assume the Business Continuity Manager position. Generally speaking, it takes more effort and expertise to organize and develop the plan than it does to administer it. As the plan is built, the consultant can teach the Business Continuity Manager the ropes.

Understand that even though the consultant is guiding the project, the consultant should not assume the role of Business Continuity Manager. Every company, every facility, every computer site is unique. The actions necessary to promptly restore service are the result of the key people at each site writing down what to do and how to do it. Outside consultants can provide considerable insight into the basic services (electrical, telephone, water, data processing), but lack in-depth experience at your company. They don’t know your business processes. They don’t understand the pulse of your business and what its key elements are.

Building a solid plan will take a lot of time. An experienced consultant working with an internal Business Continuity Manager can help move the project along quicker. The Business Continuity Manager is also the logical candidate to become the plan’s ongoing administrator once the initial project is completed. This person will be responsible for keeping the plan rel...

Table of contents

• Cover Page
• Title Page
• Copyright Page
• Contents
• CHAPTER 1 Getting Started: Overview of the Project
• CHAPTER 2 Building the Business Case: Measuring the Impact on the Business
• CHAPTER 3 Evaluating Risk: Understanding What Can Go Wrong
• CHAPTER 4 Selecting a Strategy: Setting the Direction
• CHAPTER 5 Build an Interim Plan: Don’t Just Sit There, Do Something
• CHAPTER 6 Writing the Plan: Getting It Down on Paper
• CHAPTER 7 Administrative Plan: Orchestrating the Recovery
• CHAPTER 8 Crisis Management Plan: Minimizing the Damage
• CHAPTER 9 Technical Recovery Plan: Putting Humpty Dumpty Back Together Again
• CHAPTER 10 Work Area Recovery Plan: Getting the Office Up and Running
• CHAPTER 11 Pandemic Plan
• CHAPTER 12 Emergency Operations Center: Take Control of the Situation
• CHAPTER 13 Testing Your Plans: Test, Test, Test
• CHAPTER 14 Electrical Service: Keeping the Juice Flowing
• CHAPTER 15 Telecommunications and Networking: Your Connection to the World
• CHAPTER 16 Vital Records Recovery: Covering Your Assets
• CHAPTER 17 Data: Your Most Irreplaceable Asset
• CHAPTER 18 Workstations: The Weakest Link
• CHAPTER 19 Customers: Other People to Worry About
• CHAPTER 20 Suppliers: Collateral Damage
• CHAPTER 21 Fire: Burning Down the House
• CHAPTER 22 Human Resources: Your Most Valuable Asset
• CHAPTER 23 Health and Safety: Keeping Everyone Healthy
• CHAPTER 24 Terrorism: The Wrath of Man
• Index
• About the Authors