Eight Best Practices for Disaster Recovery

Members of the CIO Executive Council offer their advice on building, testing and deploying disaster recovery plans. Given the number of blackouts, hurricanes and other disasters that have come our way over the past few years, many business owners are wisely reexamining their disaster recovery strategies. Here are some of the tried-and-true methods.

1) DEDICATE AND EMPOWER STAFF. Dedicate a group to manage business continuity planning and disaster recovery. Ensure that the leader has access to upper-level management. You can't just set it up and expect them to run on their own, you must pay constant attention to the group and set of resources."

2) DIVIDE AND CONQUER. In order to ensure business involvement in the development and maintenance of the business continuity plan, separate business continuity planning and disaster recovery into two initiatives, each with its own governance and goals. For disaster recovery, the goal is technical recovery, and the plan is created and managed by your technical support personnel. Business continuity's goal is business process stability, and that plan is developed-in partnership with Tech Support-by business unit representatives.

3) MAKE SURE THE PLAN CAN STAND ALONE. "When a disaster strikes, the person in charge of the recovery plan may not be available to execute it. "You have to make sure your disaster recovery plan will work with or without the internal key people who developed it." The person in charge of financial applications, for example, should be responsible to test the recovery.

4) CHALLENGE THE BUSINESS. "If you need an application recovered quickly, but that application is not exactly providing revenue generation or financial compliance, change the order of priority and recover those that ere more critical. Determine how long the business can really go without that application. The same goes for staffing an offsite facility during a disaster. Determining the right people to involve-as well as the right services to recover-is part of the negotiation process.

5) ALIGN DISASTER RECOVERY WITH APPLICATION DEVELOPMENT. The plan must incorporate disaster recovery into your business application processes. Develop an isolated test environment that enables full-time access and continuous testing of all systems and applications. A business-continuity plan should include a report on application-testing status, so you know when a system was last tested and whether it demands your attention to assure its performance in recovery."

6) TABLETOP TESTS WON'T CUT IT. Regularly reviewing your plan on paper is important, but it is not enough. In addition to tabletop tests, mock up disasters with your crisis management team, which can be made up of staff and board members, who must set up a replica systems in another site so that it is operational within a few hours.

7) TRY (AND TEST) BEFORE YOU BUY. When looking at a new technology for creating systems images (snapshots of the operating system disk and registry settings that allow for a relatively simple recovery process), not only employ a "try before you buy" approach, but actually use the product in a test at no charge. Have a real test: entirely offsite with a different network, firewall and environment.

8) HOLD POSTMORTEMS AND ADJUST. What you do with the results of the test is a critical part of disaster recovery planning. "If you are recovering without third-party services, create an action-item checklist out of your review of what worked well and what didn't. If you are working with a vendor, document what went wrong and use that report to outline your expectations for the next test.

Techsite American can help you define and implement your Disaster Recovery planning and Business Continuity Planning. Call us for a free consultation.