Key elements of disaster recovery and business continuity planning

Andre Gold discusses the key aspects of developing a successful business continuity and disaster recovery plan, including location, technology, crisis management and communications. The text transcript of Gold's comments is included below.

So we have gone out there and we have all of this great data as it relates to what is most important to the firm, how much is it going to cost the firm. As we said earlier, eventually, things will fail, and when they fail, we will have to restore those respected services. So now let's look at a couple of key aspects of recovery. Within disaster recovery one of the first things you are going to want to quickly identity is a location. Where are you going to restore the technology, the people, the processes; all of the things that make up your respected organization?

Now when you are looking at locations, there are fundamentally three types of locations that you can partake in. One can be a cold site. A cold site is a location in which you have no infrastructure, no assets and you are going to have to bring all that to the table in the event and in the time of recovery. You also have a warm site, a site that has some of your infrastructure; it can be readily made available in the event that it is needed for a disaster. And then the last site is a hot site. A site that has your infrastructure in place; it is already running transactions and supporting the business processes from the day. So as I mentioned you have hot sites, you have warm sites and you have cold sites. I am from Texas, which is a hot state, and that just so happens to be my preference when I look at locations. Now there is a cost associated with that and you have to be mindful and you have to be mindful of the cost, but considering that most companies already have multiple data centers, it is very plausible to actually leverage one of your alternate data centers as potentially a hot site location.

One of the other key aspects of recovery is technology as well as third-party management. When you think about purchasing software these days, historically they would send you a CD or a DVD with the content on it. These days, what they typically do is send you an email that says, "Thank you for your business, and oh by the way go to this URL to download the software." In the event of a disaster, you need to make sure you have a repository that is readily available and that has that key software and supporting applications if an event does arise. The third thing we have to do is be mindful of our third-party relationships. Of course over the last decade or so, outsourcing became vogue again, so it is highly probable that your organization leverages somebody else to do or support aspects of business fulfillment. You need to make sure you have good relationships, established relationships, probably contracts that have strong SLAs embedded in them, because in the event of a disaster, you actually really are going to need and be dependent upon that third party to help the restoration of your business.

Another key element of disaster recovery is crisis management and communications. Crisis management is really going to drive the overall recovery process; it's going to be the method by which you communicate to your constituents -- whether or not they are integral employees, external stakeholders -- the status of restoration. It is also going to be the event that helps you engage local authorities, federal and perhaps even your state agencies as well. And then the last key element that we are going to discuss as it relates to the context of recovery is really testing -- you need to practice and practice often. Now, there are several different ways you can practice. One can be doing table-top exercises, which are very scenario-based type of exercises, and that are very valuable. But at the end of the day, I would like to ensure that my organization is ready, equipped and capable of restoring the business in the event that a disaster does occur, and I think the only true way you get there is by going through and doing live walkthroughs. One other thing that comes to mind is whether or not you have a good succession plan. Meaning, if Joe the database administrator is not available, who is going to restore the content? If your chief executive office is not available, who is going to provide leadership within the firm? All these types of things will come out in practice.

And then the last key element that we are going to discuss as it relates to the context of recovery is really testing -- you need to practice and practice often. Now, there are several different ways you can practice. One can be doing table-top exercises, which are very scenario-based type of exercises, and that are very valuable. But at the end of the day, I would like to ensure that my organization is ready, equipped and capable of restoring the business in the event that a disaster does occur, and I think the only true way you get there is by going through and doing live walkthroughs. One other thing that comes to mind is whether or not you have a good succession plan. Meaning, if Joe the database administrator is not available, who is going to restore the content? If your chief executive office is not available, who is going to provide leadership within the firm? All these types of things will come out in practice. 

Bussiness Continuity and Disaster Recovery Video Series table of contents:

Disaster recovery and business continuity planning basics
Availability, business continuity and disaster recovery
Defining internal risk management policies
Elements of disaster recovery and business continuity planning
Disaster recovery and business continuity planning problems
Preventing business continuity, disaster recovery problems

More on disaster recovery: 

Read about virtualization strategies for disaster recovery
Discover hot trends in business continuity and disaster recovery