Getting Started with Disaster Recovery Information Technology

Introduction

Disasters of many kinds strike organizations around the world on an almost daily basis. But most of these disasters never make the news headlines because they occur at the local level. You probably hear about disastrous events that occur in or near your community — fires, floods, landslides, civil unrest, and so on — that affect local businesses, sometimes in devastating ways. Larger disasters affect wide areas and result in widespread damage, evacuations, and loss of life, and can make you feel numb at times because of the sheer scale of their effects.

 This book is about the survival of business IT systems in the face of these disasters through preparation and response. You’re largely powerless to stop the disasters themselves, and even if you can get out of their way, you can rarely escape their effects altogether. Disasters, by their very nature, disrupt everything within their reach.

 Your organization can plan for these disasters and take steps to assure your critical IT systems survive. This book shows you how to prepare.

 Part I: Getting Started with Disaster Recovery

 In Part I, I describe the nature of disasters and their effects on businesses. In Chapter 1, I take you on an end-to-end tour of the entire disaster recovery planning process.

 I start Chapter 2 with a discussion of the various ways that a disaster can affect an organization and the role of prevention. I also include how to begin planning your disaster recovery project and emergency operations planning. Then, I show how you can quickly develop an interim disaster recovery plan that can provide some basic protection from a disaster if one occurs before you finish your full disaster recovery plan

 In Chapter 3, I take you on a deep dive into the vital first phase of a DR project — creating the Business Impact Analysis, during which you discover which business processes require the most effort in terms of prevention and the development of recovery procedures.

Part II: Building Technology Recovery Plans

 Part II contains the core components of the disaster recovery plan. Chapter 4 describes how you determine which systems and underlying infrastructure support critical business processes that you identify in the Business Impact Analysis. Chapter 5 through Chapter 8 go through the work of preventing disaster and recovering from disaster in distinct groups — end users, facilities, systems and networks, and data. Chapter 9 discusses details about the actual disaster recovery plan documents — what those documents should contain and how to manage their development.

 Part III: Managing Recovery Plans

Part III focuses on what happens after you write your disaster recovery plans. Chapter 10 discusses DR plan testing and the five types of tests organizations often perform. Chapter 11 describes what activities you need to do to ensure  that your DR plans stay current. Disaster prevention is the topic of Chapter 12. If you can prevent disasters, your organization is better off. Chapter 13 discusses many disaster scenarios and what each one brings to a disaster recovery plan.

Part IV: The Part of Tens

The much loved and revered Part of Tens contains four chapters that are more than mere lists. These chapters contain references to external sources of information, more reasons to develop business recovery plans, and the benefits your organization can gain from having a well-developed recovery plan.

Getting Started with Disaster Recovery

D isaster recovery (DR) planning is concerned with preparation for and response when disaster hits. The objective of DR planning is the survival of an organization. Because DR planning is such a wide topic, this book focuses only on the IT systems and users who support critical business processes. Getting this topic alone to fit into a 400-page book is quite a challenge.

In this chapter, I describe why you need disaster recovery planning and what benefits you can gain from going through this planning. You may be pleasantly surprised to find out that the benefits go far beyond just planning for disaster.

I also take you through the entire disaster recovery planning process — from analysis, to plan development and testing, to periodic plan revisions based on business events. If you’ve never done any work in disaster recovery planning before, this chapter’s a good place to start — you can get the entire story in 20 pages. Then, you can branch out and go to the specific topics of interest to you elsewhere in this book

Disaster Recovery Needs and Benefits

Stuff happens. 

Bad stuff. 

 Disasters of every sort happen, and you may find getting out of their way and escaping their consequences very difficult. If you’re lucky enough to avoid the direct impact of a disaster, dodging its secondary effects is harder still 

Here are some of the disasters that can assail an organization

Fires                                     Security incidents

Floods                                  Equipment failures

Tornadoes                            Power failures

Hurricanes                            Utility failures

 Wind and ice storms            Arson

Severe storms                        Pandemics

Wildfires                                Sabotage

Landslides                             Strikes and work stoppages

Avalanches                            Shortages

Tsunamis                                Civil disturbances

Earthquakes                            Terrorism

Volcanoes                                 War

Each of the scenarios in the preceding list has unique primary and secondary effects that you need to take into consideration when developing a disaster recovery plan.

The effects of disasters

 The events that I list in the preceding section have the potential to inflict damage to buildings, equipment, and IT systems. They affect people, as well — killing, injuring, and displacing them, not to mention preventing them from reporting to work. Disasters can have the following effects on organizations

 Direct damage: Many of these events can directly damage buildings, equipment, and IT systems, rendering buildings uninhabitable and sys tems unusable.

 Inaccessibility: Often, an event damages a building to such an extent that it’s unsafe to enter. Civil authorities may prohibit personnel from entering a building, even to retrieve articles or equipment

 Utility outage: Even in incidents that cause no direct damage, electric power, water, and natural gas are often interrupted to wide areas for hours or days. Without public utilities, buildings are often uninhabitable and systems unable to function

 Transportation disruption: Widespread incidents often have a profound effect on regional transportation, including major highways, roads  bridges, railroads, and airports. Disruptions in transportation systems can prevent workers from reporting to work (or going home), prevent the receipt of supplies, and stop the shipment of products

 Communication disruption: Most organizations depend on voice and data communications for daily operational needs. Disasters often cause widespread outages in communications, either because of direct damage to infrastructure or sudden spikes in usage related to the disaster. In many organizations, taking away communications — especially data communications — is as devastating as shutting down their IT systems

 Evacuations: Many types of disasters pose a direct threat to people, resulting in mandatory evacuations from certain areas or entire regions.

Worker absenteeism: When a disaster occurs, workers often can’t or won’t report to work for many reasons. Workers with families often need to care for those families if the disaster affects them. Only after they take care of their families do workers consider reporting to work. Also, trans portation and utility outages may prevent them from traveling to work. Workers may also not know whether the organization expects them to report to work if the disaster damages or closes the work premises.

 These effects can devastate businesses by causing them to cease operations for hours, days, or longer. In most cases, businesses simply can’t survive after experiencing such an outage. Businesses supply goods and services to customers who, for the most part, just want those goods and services; if the customers can’t obtain those goods or services from one business, they often simply go to another that can provide them. Many businesses don’t recover from such an exodus of customers

Minor disasters occur more frequently

 Don’t make the mistake of justifying your lack of a DR plan by thinking, “Hurricanes rarely visit my neck of the woods,” or “Earthquakes occur only every one hundred years,” or “No country has ever invaded our country,” or “Mt. Rainier hasn’t erupted in recorded history.” All of these statements may be true. However, disasters on smaller scales happen far more frequently, often hundreds of times more frequently, than the big ones.

 Smaller disasters — such as building fires, burst pipes that flood office space, server crashes that result in corrupted data, extended power outages, severe winter storms, and so on — occur with much greater regularity than big disasters. Any of these small events can potentially interrupt critical business processes for days. In time-critical, service-oriented businesses, this interruption can be a fatal blow. Contingency Planning and Management Magazine indicated that 40 percent of companies that shut down for three days or more failed within 36 months. An unplanned outage may be the

beginning of the end for an organization — everything starts to go downhill from that point forward. That sobering thought should instill fear in you. You might even put that chilling thought on a sticky-note and attach it to your monitor as a reminder

Recovery isn’t accidental

From a DR perspective, the world is divided into two types of businesses — those that have DR plans and those that don’t. If a disaster strikes businesses in each category, which ones will survive?

When disaster strikes, businesses without DR plans have an extremely diffi cult road ahead. If the business has any highly time-sensitive critical business processes, that business is almost certain to fail. If a disaster hits a business without a DR plan, that business has very little chance of recovery. And it’s certainly too late to begin planning.

Businesses that do have DR plans may still have a difficult time when a disaster strikes. You may have to put in considerable effort to recover time-sensitive critical business functions. But if you have DR plan, you have a fighting chance at survival

Recovery required by regulation

Developing disaster recovery plans used to be simply a good idea. These plans are still a good idea, but they’re also beginning to appear in standards and regulations, including

PCI DSS (Payment Card Industry Data Security Standard): Although not really government legislation, it’s required for virtually every merchant and financial services firm. PCI is a great example of what I call private legislation — laws made by corporations instead of governments. All the major banks and credit card companies impose PCI.

 ISO27001: This international standard for security management is gaining considerable recognition. Many larger organizations require their IT ser vice providers to be ISO27001 compliant.

BS25999: The emerging international standard for business continuity management.

 NFPA 1620: The National Fire Protection Association standard for pre incident planning. It’s a recommended practice that addresses the protection, construction, and operational features of specific occupancies to develop pre-incident plans that responders can use to manage fires and other emergencies by using available resources.

HIPAA Security Rule: This U.S. law requires the protection of patient medical records and a disaster recovery plan for those records

Over time, more data security laws are certain to include disaster recovery planning

The benefits of disaster recovery planning

Besides the obvious readiness to survive a disaster, organizations can enjoy several other benefits from DR planning:

Improved business processes: Because business processes undergo such analysis and scrutiny, analysts almost can’t help but find areas for improvement..

Improved technology: Often, you need to improve IT systems to support recovery objectives that you develop in the disaster recovery plan. The attention you pay to recoverability also often leads to making your IT systems more consistent with each other and, hence, more easily and predictably managed.

Fewer disruptions: As a result of improved technology, IT systems tend to be more stable than in the past. Also, when you make changes to system architecture to meet recovery objectives, events that used to cause outages don’t do so anymore.

Higher quality services: Because of improved processes and technolo gies, you improve services, both internally and to customers and supply chain partners.

Competitive advantages: Having a good DR plan gives a company bragging rights that may outshine competitors. Price isn’t necessarily the only point on which companies compete for business. A DR plan allows a company to also claim higher availability and reliability of services.

A business often doesn’t expect these benefits, unless it knows to anticipate them through its development of disaster recovery plans 

  Beginning a Disaster Recovery Plan

 Does your organization have a disaster recovery plan today? If not, how many critical, time-sensitive business processes does your organization have

 If your organization has no DR plan at all, you might be thinking that even if you start now, you can’t finish your DR plan for one or two years, leaving your business exposed. Although that may be true, you can start with a lightweight interim plan that provides some DR value to the organization while you complete your full-feature DR plan.