Information Technology Reference
In-Depth Information
Following the business impact analysis, each identified business process
must be decomposed into a full inventory of services and requirements for
recovery, complete with contact information and contract details neces-
sary for procurement of hardware or software if necessary.
Risk Assessment (RA)
Once a full decomposition of the BIA has been completed, each identi-
fied service and resource should be cross-checked against the risk register.
Before beginning the recovery planning process, a complete risk analysis
is necessary, including identification of contingencies, alternatives, and
workarounds for elements that are critical to high-priority process recov-
ery efforts. Many times, this assessment during the COO/DR planning
process may reveal areas which require additional contingency reserves,
alternate sites, backup equipment, and cost consequences arising from
fees, fines, or other negative impacts due to service loss or failure to meet
regulatory or contractually mandated service-level criteria.
Construct a Plan
After the BIA and risk assessment have been completed, you will need
to create two recovery plans: one for immediate-to-short-term continuity
requirements, the second for mid-to-long-term full disaster recovery. The
requirements for developing a detailed plan vary widely between organi-
zation types and functions, and go well beyond the limits of this single
chapter. Once the plan is completed, it is critical to test its assumptions to
ensure that theoretical recovery procedures will function when applied to
real-world organizational environments.
Because an actual emergency is not likely to coincide with your test-
ing events (hopefully), develop scenarios based on identified risks and test
a walk-though of the plan against each scenario. Scenarios might be a
simple as a loss of power in the area, requiring a test of on-site generators
and battery power backup systems, or may be as complex as a simulated
pandemic in which a large portion of the workforce might be unable to
leave their homes or too ill to participate in recovery actions. Testing
backup personnel, alternate contact mechanisms, and strategies for pro-
curing replacement materials by alternate personnel can aid in identifying
potential points of failure and areas for additional training.
