Do you know your own disaster procedure ?

What do you do when your information technology stops working? Read on to discover tips to include in your procedure.

Do you rely on technology?

Disaster occurs more often than you think, and it’s very important to be prepared for bad surprises. Nowadays more and more companies rely on their IT infrastructure to be able to do their business. For this reason IT managers do their maximum to increase the redundancy of their infrastructure. That's for sure a good thing.

What does a recovery procedure entail?

However in some cases the redundancy is not enough and a disaster can still occur. As an example you could think about a fire, but more and more, we see cyber attacks are a big threat. In those cases it’s good practice to have a disaster recovery procedure. This procedure describes many topics:

• who will take the lead to make sure everything is back up and running
• who will take the responsibility of communicating towards the collaborators but also towards the outside (customers and providers)
• which tool will be used to communicate (for example in case your mail system is down)
• in which order do you have to restart each component (based on the dependencies of each component)
• where will your collaborators work if your offices are not accessible
• and so on ...

What if you do not have a procedure?

Unfortunately many companies don't have such a procedure. They think that the probability a major incident occurs, is low, but they are wrong. Mainly due to cyber attacks (such as crypto viruses) the probability is not so low and has even increased over the years. It’s of the utmost importance to pitch the usefulness of a procedure to your management. Just imagine the time you will lose to get yourself organized last minute. It will only make your situation worse.

What do you need to include in your procedure?

If you are going to take your time to write your disaster procedure, it’s important to know that is a part of your business continuity plan.

• Start with your business impact analysis (analyze the impact of possible gaps or losses)
• Write down your recovery strategy/strategies (identify your resource requirements, explore recovery strategy options,
• Work on your development your procedure plan (organize recovery teams, write procedures, document workarounds, let the management validate your plan)
• Test your procedure (set up regular tests, document maintenance requirements)
  
  

If we’re looking only at your IT recovery strategy, there are four main keywords:

• Hardware,
• Software,
• Data
• and Connectivity.

Even without one component, you can run into serious trouble.

So what do you prioritize?

Simple, just take a look at your business impact analysis. Your priorities should be consistent with the priorities to recover your business functions and processes. If you identified IT-resources that are required for time-sensitive business functions and processes than you need to take those into account as well.

Let’s not forget prevention. Your strategy should certainly mention how you anticipate and prevent the loss of one of your system components. Some examples:

• Write about how you secure your computer room with climate control, work with conditioned and backup power supply…
• Document how you will handle data and restoration.
• Describe how you will manage office productivity, software applications, data exchange, and your resource management.
• What you will implement in terms of connectivity or which arrangements you have made with your service provider (fiber, cable, WiFi…)
• And how you will handle situations concerning problems with your hardware (networks, servers, wireless devices, your desktops, laptops…)

Why do you need a test?

Once you have documented your disaster procedure, there is another point you would have to pay attention to: a regular test of the procedure.

Why is this important ?

Because your IT environment is something that lives and changes through time. Think about all the variable factors. New providers, new tools to integrate, new governance rules… But even new collaborators weigh into the equation. The people managing your IT infrastructure might not stay the same throughout the years.

A check will allow you to update the procedure with the changes that have occurred since the last test... Even if you only do this once every year, you’ll happy you did so. You definitely do not want to discover during a disaster that your main password written in the procedure is not the same anymore (since it has been changed every 3 months as requested by your security policy). You will be surprised by the number of changes that has happened since your last test.

It may seem like a lot of work, but the time you invest in this check, will allow you to gain so much time when you are facing a disaster. It will help you to decrease your stress during this difficult period.