1

Prepare an after-action report for disaster recovery Page 1 of 11
9
u g SearchDisasterRecovery
c
Search the TechTarget Network
MANAGE
s z 3
Prepare an after-action
o
report for disaster recovery f
i by
Paul Kirvan
n
o n
Paul Kirvan discusses the importance of creating an after-action
report following a disaster recovery exercise and offers tips on
creating the report.
Perhaps just as important as a business continuity or disaster recovery

exercise is the document that summarizes...
1
2 Sign in for existing members
Continue Reading This Article

Enjoy this article as well as all of our content, including E-Guides, news, tips
and more.
corporate email address
I agree to abide by the Terms of Use and Privacy Policy. I also agree that TechTarget and
its partners may contact me regarding relevant content, products and special offers.
Continue Reading
http://searchdisasterrecovery.techtarget.com/tip/Prepare-an-after-action-report-for-disaste... 06-01-2018
u
c
s
o
i
n
what happened in the exercise, called an after-action report or AAR.
u Exercises are conducted to

c validate that what has been
developed with regard to a
s BC/DR plan and its
o processes. If the exercise
proceeds through to a
i satisfactory conclusion, the
n AAR documents that fact. If
the exercise does not
proceed as planned, the
AAR documents what worked right, what didn't work, what was created as
a workaround or alternate process, who participated in the process, and
the lessons learned in the course of the exercise.
1After-action report outline

The following table describes the AAR components, what is provided in
each section, and the value each section offers to the overall BC/DR
process and the associated plan(s).
Exercise activity Information provided Value to the BC/DR

plan
Purpose and scope Describe the reason for Sets the baseline for
the exercise and what the exercise.
is being exercised.
Exercise objectives Defines what is Defines what the

expected from the endgame is for the
u exercise, e.g., validating exercise.

that a specific recovery
c procedure works
s properly.
o
i Exercise type Identifies the exercise Indicates the rigor of
process, e.g., a the exercise, ranging
n tabletop, structured from a high-level review
walkthrough or to a detailed step-by-
systems test. step analysis.
Exercise methodology Describes how the Provides a detailed

exercise was explanation of the
performed, e.g., where exercise; this is
the exercise was held, especially important
what actions were from an audit
performed in the perspective.
exercise, what
constituted the end of
the exercise.
Participants Lists the people who Identifies who

participated in the participated in the
exercises and their exercise.
roles.
Exercise scenario Defines what situation Provides the

presumably circumstances for the
necessitated the exercise to ensure the
u launch of the exercise scenario was realistic

activity, e.g., a power and acceptable to
c failure that required management
s launching of
emergency power
o systems.
i
n Exercise findings Identifies what actually Provides a sequential
happened in the summary of what
exercise, based on happened in the
time, event, who exercise; this is also
executed the activity, important from an audit
results, what alternate perspective
arrangements were
made, how the exercise
participants performed
Summary of next Lists what should occur Demonstrates that the

steps after the conclusion of exercise is part of a
the exercise, e.g., process that results in
rewrite the plan the best possible
procedures, rewrite the BC/DR plan and its
exercise process, associated procedures.
change the participant
duties, conduct a
follow-up exercise.
Table 1
Use the above table as a framework for building your own after-action
u report. Set up the sections and prepare placeholders for you to write up
the various elements of the AAR. When preparing for the exercise, the
c AAR document should also be prepared and ready for use.
s
o Documenting the exercise
i
1
During the exercise, it is essential to have someone function as a "note
n taker." This individual can also serve as a timekeeper to ensure the
exercise is conducted along specific time frames and is completed on or
close to the desired target time. Documenting the exercise is a critical
part of the overall exercise process, as it provides the evidence for
improving BC/DR plans, as well as ways to improve future exercises.
PRO+ E-Zine
Content x The hottest data storage

technology trends for 2018
E-Zine
x Features disaster recovery-as-a-

service providers must offer
E-Handbook
Find more PRO+
content and other
member only offers,
7 Protect against ransomware with
comprehensive backup and
here. recovery
Preparing the after-action report

1
If your exercise includes an immediate post-exercise discussion, typically
u called a "hot wash," this is an important opportunity to take notes that can
be built into the after-action report. If you are the exercise facilitator and
c note taker, be sure to take time during the discussion to take notes of
s what is said, especially what worked, what didn't work and lessons
learned.
o
i Try to prepare the AAR as soon as possible following the exercise while
details are still fresh in your mind. If possible, circulate the draft AAR to
n exercise participants for their comments and input. Once you have
obtained all comments, prepare the final report for distribution.
Distribute the AAR to department heads whose operations were

exercised, internal audit, risk, IT (if IT systems and assets were exercised)
and senior company management.
An important part of the AAR is next steps, which may include

recommendations to 1) improve the BC/DR plan, 2) modify an operational
process to improve its recoverability, 3) identify recovery steps that may
be in the wrong sequence, 4) identify changes to a system or technology
that will improve its recoverability, or 5) determine changes to the exercise
process.
Use the data in an after-action report as a tool for improving your overall
BC/DR capabilities. An AAR is the ideal complement to an exercise. It also
provides an important audit tool, documenting what happened in the
exercise, what worked/didn't work, and what can be done to improve the
BC/DR process.
About the author:

Paul Kirvan, CISA, FBCI, works as an independent business continuity
consultant and auditor, and is secretary of the U.S. chapter of the

Business Continuity Institute and member of the BCI Global Membership
Council. He can be reached at pkirvan@msn.com.
u
c
m Next Steps
s
What your post-DR after-action review should include
o
i DR test mistakes you must avoid
n Security report writing best practices
This was last published in September 2014
m Dig Deeper on Disaster recovery planning -

management
ALL NE W S G ET S T AR T ED E V AL U A T E M A NA G E PR O BL E M S O LV E
3
 
Don't overlook these Best practices for

2 business resilience plan
essentials
j recovery from
ransomware and what's
next
Year's best practices Disaster recovery tools:

2 for disaster recovery aid
resilience
2 What most DR pros
want
u Load More
c
s
om Join the conversation z3 comments
i
n Share your comment
 Send me notifications when other members comment.
Add My Comment
Oldest 5
[-] manderz05136 - 29 Jun 2016 10:57 AM

t
Are there any differences between the BC AAR and the DR AAR?
Reply
[-] mcorum - 29 Jun 2016 2:35 PM

t
In my experience the two terms, business continuity and disaster recovery, are
used interchangeably in most cases. If, however, they are used to refer to what
they actually mean, then there should be a difference.
Reply
u [-] Rich Castagna - 30 Jun 2016 12:28 PM

t
Nowadays, DR and BC are typically used interchangeably. The difference--and a
c
very subtle one at that--was that DR referred to the recovery of apps and data,
s and BC referred to actually getting business systems up and running again. So
BC also factored in things like personnel, office space, communications, etc.
o
Reply
i
n
-ADS BY GOOGLE
SearchSolidStateStorage
Latest TechTarget
resources
Hybrid
SOLID STATE STORAGE
A
2 and AFA storage array
types battle for
CLOUD STORAGE
dominance
DATA BACKUP
The debate still
rages over whether all-flash arrays will
STORAGE
make hybrid arrays obsolete, and cost
is not all that matters when ...
About Us Contributors Features
u
Meet The Editors Reprints Guides
c
Contact Us Archive Opinions
s
Privacy Policy Site Map Photo Stories
o
Advertisers Answers Quizzes
Business Partners Definitions Tips

i
Media Kit E-Products Tutorials
n
Corporate Site Events Videos
All Rights Reserved, Copyright 2008 - 2018, TechTarget

1

Hochgeladen von

Dokumentinformationen

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

1

Hochgeladen von

Copyright:

Verfügbare Formate

Prepare an after-action report for disaster recovery Page 1 of 11

Perhaps just as important as a business continuity or disaster recovery

Continue Reading This Article

corporate email address

what happened in the exercise, called an after-action report or AAR.

u Exercises are conducted to

1After-action report outline

Exercise activity Information provided Value to the BC/DR

Exercise objectives Defines what is Defines what the

u exercise, e.g., validating exercise.

Exercise methodology Describes how the Provides a detailed

Participants Lists the people who Identifies who

Exercise scenario Defines what situation Provides the

u launch of the exercise scenario was realistic

Summary of next Lists what should occur Demonstrates that the

Content x The hottest data storage

x Features disaster recovery-as-a-

Preparing the after-action report

Distribute the AAR to department heads whose operations were

An important part of the AAR is next steps, which may include

About the author:

consultant and auditor, and is secretary of the U.S. chapter of the

This was last published in September 2014

m Dig Deeper on Disaster recovery planning -

Don't overlook these Best practices for

Year's best practices Disaster recovery tools:

 Send me notifications when other members comment.

[-] manderz05136 - 29 Jun 2016 10:57 AM

[-] mcorum - 29 Jun 2016 2:35 PM

u [-] Rich Castagna - 30 Jun 2016 12:28 PM

About Us Contributors Features

Business Partners Definitions Tips

All Rights Reserved, Copyright 2008 - 2018, TechTarget

Das könnte Ihnen auch gefallen