Disaster Recovery Plan

Be it the recent Nepal Earthquake or Hurricane Sandy or the Tsunami or other disastrous events such as attacks on World Trade Center - calamities like these often catch you in an unguarded moment. Such events not only claim hundreds and thousands of lives but also become disastrous to businesses which cannot revive if they did not have disaster recovery plans in place to recover critical business data.

It is natural for business executives to think that catastrophes are not very common, but even things like virus in computer system, power failure or even a critical equipment failure can disrupt the organizational functioning.

Disaster Recovery Plan is essentially a comprehensive strategy including people, processes, policies, and technologies,

It will help you setup the right priorities in your Disaster Recovery Plan. Here, you also need to define the Recovery Time Objectives (Targeted time duration and service level within which a business function must be restored) and Recovery Point Objectives (The age of files which must be recovered from backup storage).

Define Disaster Recovery Strategy
The global standard for IT Disaster Recovery (ISO/IEC 27031) notes that the “strategies should define the approaches to implement the required resilience so that the principles of incident prevention, detection, response, recovery and restoration are put in place.” Strategies essentially define the plan to respond to a disaster.

After identifying the critical functions, RTOs and RPOs, the next step is to formulate the strategies for prevention, response and recovery. List down the critical systems, their RTOs and RPOs, the threats for the critical systems, and then go on listing the prevention, response and recovery strategies for each system.

Establish Budget
Once the risks are identified, you need to establish the budgets. For that, ask yourself

While there is no fixed ballpark on the budgets, these typically range between 2 -8 percent of the overall IT budgets. Of course, for the companies for which IT system availability is crucial, the budgets are on the higher scale than the ones which can function without it. According to Emerson, a large IT establishment typically have 15 percent as standard budget.

Develop Disaster Recovery Plans
After defining the Disaster Recovery Strategies and the budgets, the next step is define the plans. For every response strategy, you need to define response actions and for every recovery strategy, you need to have associated recovery actions. This will help you define the high-level action steps.

A detailed DR plan must include –
- Roles and Responsibilities: Details about DR recovery team members, their contact details and spending allocation in case equipment need to be purchased.
- Incident Response: Provisions to become aware of an out-of-normal situation, assess the situation for damages, determine the damage severity, try to cover the disaster to bring it under control, and notify the key