How to write a disaster recovery plan and define disaster recovery strategies

LOGIN BECOME A MEMBER OUR USE OF COOKIES RSS

News

IT Management

Industry Sectors

Technology Topics

Blogs

Multimedia

Vendor Content

Jobs

Premium Content

Awards

Home > Topics > Storage > Disaster recovery > How to write a disaster recovery plan and define disaster recovery strategies

FEATURE

How to write a disaster recovery plan and define disaster recovery strategies
Paul Kirvan
Share 24 0

Formulating a detailed recovery plan is the main aim of the entire IT disaster recovery planning project. It is in these plans that you will set out the detailed steps needed to recover your IT systems to a state in which they can support the business after a disaster. But before you can generate that detailed recovery plan, youll need to perform a risk assessment (RA) and/or business impact analysis (BIA) to identify the IT services that support the organisations critical business activities. Then, youll need to establish recovery time objectives (RTOs) and recovery point objectives (RPOs). Once this work is out of the way, youre ready to move on to developing disaster recovery strategies, followed by the actual plans. Here well explain how to write a disaster recovery plan as well as how to develop disaster recovery strategies. Developing DR strategies Translating strategies into plans Incident response DR plan structure Further activities

Latest News
Developing DR strategies Regarding disaster recovery strategies, ISO/IEC 27031, the global standard for IT disaster recovery, states, Strategies should define the approaches to implement the required resilience so that the principles of incident prevention, detection, response, recovery and restoration are put in place. Strategies define what you plan to do when responding to an incident, while plans describe how you will do it. Once you have identified your critical systems, RTOs, RPOs, etc, create a table, as shown below, to help you formulate the disaster recovery strategies you will use to protect them.
Android mobile malware rebounds in Q2, reports McAfee Internet of things to power classroom education Legal news website Groklaw closes because of US surveillance Yahoo appoints UK TV executive Dawn Airey to run European operation

United 2013 Security Summit: How to make an insane idea acceptable

MORE NEWS

Hot Topics
Rapid7 UNITED 2013 2013 Royal Holloway info security thesis series LUN storage: LUN configuration and virtualisation
http://www.computerweekly.com/feature/How-to-write-a-disaster-recovery-plan-and-define-disaster-recovery-strategies[22/08/2013 9:29:17 AM]

How to write a disaster recovery plan and define disaster recovery strategies

Gadget Guide: All you need to know about tablets

http://www.computerweekly.com/feature/How-to-write-a-disaster-recovery-plan-and-define-disaster-recovery-strategies[22/08/2013

9:29:17

AM]

How to write a disaster recovery plan and define disaster recovery strategies

Table 1: Determining strategies

UK startups: Essential Guide

SEE MORE HOT TOPICS

Youll want to consider issues such as budgets, managements position with regard to risks, the availability of resources, costs versus benefits, human constraints, technological constraints and regulatory obligations. Lets examine some additional factors in strategy definition. People. This involves availability of staff/contractors, training needs of staff/contractors, duplication of critical skills so there can be a primary and at least one backup person, available documentation to be used by staff, and followup to ensure staff and contractor retention of knowledge. Physical facilities. Areas to look at are availability of alternate work areas within the same site, at a different company location, at a third-party-provided location, at employees homes or at a transportable work facility. Then consider site security, staff access procedures, ID badges and the location of the alternate space relative to the primary site. Technology. Youll need to consider access to equipment space that is properly configured for IT systems, with raised floors, for example; suitable heating, ventilation and air conditioning (HVAC) for IT systems; sufficient primary electrical power; suitable voice and data infrastructure; the distance of the alternate technology area from the primary site; provision for staffing at an alternate technology site; availability of failover (to a backup system) and failback (return to normal operations) technologies to facilitate recovery; support for legacy systems; and physical and information security capabilities at the alternate site. Data. Areas to look at include timely backup of critical data to a secure storage area in accordance with RTO/RPO requirements, method(s) of data storage (disk, tape, optical, etc), connectivity and bandwidth requirements to ensure all critical data can be backed up in accordance with RTO/RPO time scales, data protection capabilities at the alternate storage site, and availability of technical support from qualified third-party service providers. Suppliers. Youll need to identify and contract with primary and alternate suppliers for all critical systems and processes, and even the sourcing of people. Key areas where alternate suppliers will be important include hardware (such as servers, racks, etc), power (such as batteries, universal power supplies, power protection, etc), networks (voice and data network services), repair and replacement of components, and multiple delivery firms (FedEx, UPS, etc).
MORE ON WRITING A DISASTER RECOVERY PLAN Developing a disaster recovery strategy and detailed DR plans

Latest Blog Posts

Open Source Insider: Tizen, your next HTML5 mobile operating system Quocirca Insights: The mid-market CIO WITsend: Empowered to speak up because I'm considered different as female Computer Weekly Editor's Blog: Does it matter if government buys IT from SMEs or big multinationals? Public Sector IT: Universal Credit supplier payments
SEE ALL COMPUTER WEEKLY BLOGS

Download Computer Weekly

IN THE CURRENT ISSUE:

A business case for gameplay at work Case study: Birmingham to get free public Wi-Fi Opinion: How to avoid becoming a cyber target

DOWNLOAD CURRENT ISSUE

data

Policies and procedures. Define policies for IT disaster recovery and have them approved by senior management. Then define step-by-step procedures to, for example, initiate data backup to secure alternate locations, relocate operations to an alternate space, recover systems and

Email Alerts
Register now to receive ComputerWeekly.com ITrelated

at the alternate sites, and resume operations at either the original site or at a new location. Finally, be sure to obtain management sign-off for your strategies. Be prepared to demonstrate that your strategies align with the organisations business goals and business continuity strategies. Translating disaster recovery strategies into DR plans Once your disaster recovery strategies have been developed, youre ready to translate them into disaster recovery plans. Lets take Table 1 and recast it into
http://www.computerweekly.com/feature/How-to-write-a-disaster-recovery-plan-and-define-disaster-recovery-strategies[22/08/2013 9:29:17 AM]

Table 2, seen below. Here we can see the critical system and associated threat, the response strategy and (new) response action steps, as well as the recovery strategy and (new) recovery action steps.

How to write a disaster recovery plan and define disaster recovery strategies

news, guides and more, delivered to your inbox.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

http://www.computerweekly.com/feature/How-to-write-a-disaster-recovery-plan-and-define-disaster-recovery-strategies[22/08/2013

9:29:17

AM]

How to write a disaster recovery plan and define disaster recovery strategies

This approach can help you quickly drill down and define high-level action steps.

Table 2: Using strategies to create plan

From Table 2 you can expand the high-level steps into more detailed stepby-step procedures, as you deem necessary. Be sure they are linked in the proper sequence. Developing DR plans DR plans provide a step-by-step process for responding to a disruptive event. Procedures should ensure an easy-to-use and repeatable process for recovering damaged IT assets and returning them to normal operation as quickly as possible. If staff relocation to a third- party hot site or other alternate space is necessary, procedures must be developed for those activities. When developing your IT DR plans, be sure to review the global standards ISO/IEC 24762 for disaster recovery and ISO/IEC 27035 (formerly ISO 18044) for incident response activities. Incident response In addition to using the strategies previously developed, IT disaster recovery plans should form part of an incident response process that addresses the initial stages of the incident and the steps to be taken. This process can be seen as a timeline, such as in Figure 2, in which incident response actions precede disaster recovery actions.

Figure 2: Disaster timeline Note: We have included emergency management in Figure 2, as it represents activities that may be needed to address situations where humans are injured or situations such as fires that must be addressed by local fire brigades and other first responders. The DR plan structure The following section details the elements in a DR plan in the sequence defined by ISO 27031 and ISO 24762. Important: Best-in-class DR plans should begin with a few pages that summarise key
http://www.computerweekly.com/feature/How-to-write-a-disaster-recovery-plan-and-define-disaster-recovery-strategies[22/08/2013 9:29:17 AM]

How to write a disaster recovery plan and define disaster recovery strategies

action steps (such as where to assemble employees if forced to evacuate the building) and lists of

http://www.computerweekly.com/feature/How-to-write-a-disaster-recovery-plan-and-define-disaster-recovery-strategies[22/08/2013

9:29:17

AM]

How to write a disaster recovery plan and define disaster recovery strategies

key contacts and their contact information for ease of authorising and launching the plan. 1. Introduction. Following the initial emergency pages, DR plans have an introduction that includes the purpose and scope of the plan. This section should specify who has approved the plan, who is authorised to activate it and a list of linkages to other relevant plans and documents. 2. Roles and responsibilities. The next section should define roles and responsibilities of DR recovery team members, their contact details, spending limits (for example, if equipment has to be purchased) and the limits of their authority in a disaster situation. 3. Incident response. During the incident response process, we typically become aware of an out-of-normal situation (such as being alerted by various system-level alarms), quickly assess the situation (and any damage) to make an early determination of its severity, attempt to contain the incident and bring it under control, and notify management and other key stakeholders. 4. Plan activation. Based on the findings from incident response activities, the next step is to determine if disaster recovery plans should be launched, and which ones in particular should be invoked. If DR plans are to be invoked, incident response activities can be scaled back or terminated, depending on the incident, allowing for launch of the DR plans. This section defines the criteria for launching the plan, what data is needed and who makes the determination. Included within this part of the plan should be assembly areas for staff (primary and alternates), procedures for notifying and activating DR team members, and procedures for standing down the plan if management determines the DR plan response is not needed. 5. Document history. A section on plan document dates and revisions is essential, and should include dates of revisions, what was revised and who approved the revisions. This can be located at the front of the plan document. 6. Procedures. Once the plan has been launched, DR teams take the materials assigned to them and proceed with response and recovery activities as specified in the plans. The more detailed the plan is, the more likely the affected IT asset will be recovered and returned to normal operation. Technology DR plans can be enhanced with relevant recovery information and procedures obtained from system vendors. Check with your vendors while developing your DR plans to see what they have in terms of emergency recovery documentation. 7. Appendixes. Located at the end of the plan, these can include systems inventories, application inventories, network asset inventories, contracts and service-level agreements, supplier contact data, and any additional documentation that will facilitate recovery. Further activities Once your DR plans have been completed, they are ready to be exercised. This process will determine whether they will recover and restore IT assets as planned. In parallel to these activities are three additional ones: creating employee awareness, training and records management. These are essential in that they ensure employees are fully aware of DR plans and their responsibilities in a disaster, and DR team members have been trained in their roles and responsibilities as defined in the plans. And since DR planning generates a significant amount of documentation, records management (and change management) activities should also be initiated. If your organisation already has records management and change management programmes, use them in your DR planning.

Email Alerts
Register now to receive ComputerWeekly.com IT-related news, guides and more, delivered to your inbox.
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Read More
RELATED CONTENT FROM COMPUTERWEEKLY.COM RELATED CONTENT FROM THE TECHTARGET NETWORK

Top tips on disaster recovery planning A disaster recovery budget

template: A free download and guide disaster recovery (DR) test

9:29:17 AM]

http://www.computerweekly.com/feature/How-to-write-a-disaster-recovery-plan-and-define-disaster-recovery-strategies[22/08/2013

How to write a disaster recovery plan and define disaster recovery strategies

recovery test frequency Assessing and building disaster P l a n n i n g a n d p e r f o r m i n g l i n e a r d i s a s t e r r e c o v e r y t e s t s

D i s a s t e r

http://www.computerweekly.com/feature/How-to-write-a-disaster-recovery-plan-and-define-disaster-recovery-strategies[22/08/2013

9:29:17

AM]

How to write a disaster recovery plan and define disaster recovery strategies

Disaster recovery planning by the numbers Writing a disaster recovery plan

recovery team competence Creating disaster recovery testing scenarios The importance of a disaster recovery test

This was first published in July 2011

// Commenting policy

BACK TO TOP

News

IT Management

Industry Sectors

Technology Topics

Blogs

Multimedia

Vendor Content

Jobs

Premium Content

Awards

More from Related TechTarget Sites

CIO SECURITY NETWORKING DATA CENTER

CIO's approach to BYOD in education puts focus on productivity

Our IT Leader of the Year, Utah State University CIO Eric Hawley,

In major technology shift, CIO finds competitive business advantage

Our IT Leader of the Year, Utah State University CIO Eric Hawley, discusses
9:29:17 AM]

Facing rapid change, CIO adopts shared services model, cloud solutions
Our IT Leader of the Year, Utah State University CIO Eric Hawley, faces

http://www.computerweekly.com/feature/How-to-write-a-disaster-recovery-plan-and-define-disaster-recovery-strategies[22/08/2013

How to write a disaster recovery plan and define disaster recovery strategies DATA MANAGEMENT

approaches BYOD in education by making mobility work a productivity tool.

a technology shift in education and tapping it for competitive advantage.

rapid changes in tech by leveraging shared services model and cloud solutions.
All Rights Reserved,Copyright 2000 - 2013, TechTarget

ABOUT US

CONTACT US

PRIVACY POLICY

ADVERTISERS

BUSINESS PARTNERS

EVENTS

TECHTARGET CORPORATE SITE

REPRINTS

MEDIA CENTRE

ARCHIVE

SITE MAP

http://www.computerweekly.com/feature/How-to-write-a-disaster-recovery-plan-and-define-disaster-recovery-strategies[22/08/2013

9:29:17

AM]