While backup and recovery technology is an important survival practice for your company and has improved, business systems are increasingly complicated, and we rely on them more than ever. My framework of best practices for disaster recovery (DR) will improve the restoration of business services if an outage occurs:
1. Make DR an official business project
Business continuity plan updates and testing must be treated as a formal business project.
Otherwise, it may get secondary treatment or even be postponed in favor of other critical business
objectives. Even in difficult economic times, DR is important enough to ensure that you maintain
testing and updates to the plan.
2. Formally organize a DR team
Plans require people and it is critical that you formally secure resources for disaster recovery
operations. Organize your DR team, hold periodic meetings and stay focused on its critical role. DR
is usually a part-time assignment of the employee, but formal job objectives and resource
commitments can help secure participation. A formal plan ensures that you properly budget for
people, technical resources and travel expenses.
3. Invite business participation
A technology-only DR approach is ineffective. The strategic business units must help rank the
importance of applications and their order of recovery. They must help test recovered systems to
ensure that all services are working, rather than just a data base was loaded.
4. Support education and training
Disaster recovery planners must continually evaluate new technologies and approaches for using it.
Emerging technologies like cloud computing or Windows 7 are new challenges in 2010, and new methods
of backup might even include looking at Carbonite or similar services for remote users. It's
important to invest in training the DR leader and team, thereby creating the most cost-effective
and protective scenarios.
5. Test the plan
A former manager once stated that "anyone can take a backup, but can they recover?" Formal testing
of mock disasters is one of the most worthwhile evaluations possible for a disaster recovery plan.
Our auditors would even periodically declare simulated disasters, where we performed on-site
recovery in a lab to save expenses. The goal is to evaluate the business recovery plan as
thoroughly as possible, so that it's successful when Murphy's Law does occur. Don't let higher
priority projects put DR testing on the shelf.
6. Involve the entire DR team
While budgets and resources are tight as our nation's economy recovers, it's important to involve
users and the business during recovery tests. It should not be a technical exercise only. Team
participation provides valuable experience and training. It also facilitates differing perspectives
that will improve the plan.
7. Sample different applications
It's always important to recover the most critical application, but other business systems should
be rotated into quarterly or annual test cycles as part of the plan. Random selections help ensure
that your team is adhering to documentation standards as application maintenance occurs.
8. Maintain security
The business of evaluating security controls is sometimes neglected in the testing process. During
recovery testing, all security controls must be carefully reviewed to ensure sensitive customer
data would not be compromised during a real recovery. For example, a weakly secured wireless LAN
may allow important customer information to leak out.
9. Formally document DR tests
Using a lessons learned approach, document all findings for each test. Look for specific areas of
improvement for the application tested. Also evaluate general areas for improvement in the disaster
recovery process itself.
10. Exercise continuous improvement
The DR process will only be as good as the plan and its supporting documentation. Standards for
change management must include updating DR considerations as applications change. The technical
foundation for IT systems is constantly changing and new technologies must be addressed, e.g.,
cloud computing.
Harry Waldron, CPCU has worked in the IT profession for over 35 years. A Microsoft MVP, he works as a senior developer for Fairfax Information Technology Services in Roanoke, VA, where he provides technical, business and leadership support on key development projects. He writes about security and best practices for several technical forums, including myITforum.com. He has earned 10 professional designations in technology, business, and insurance fields.
This was first published in January 2010
Join the conversationComment
Share
Comments
Results
Contribute to the conversation