DR/BC Planning and Employee Awareness
- Published on October 28, 2007
Once upon a time in the very distant past, disaster recovery planning was not something that you worried about. That is, if you thought about it, or even heard the terminology. Things were basically taken for granted, (that) someone was looking after 'that', or 'it' will take care of itself. No one lost any sleep over things like: loss of communications service or data files, building inaccessibility, and the like. These things just didn't happen. Welcome to the real world. Now, people not only lose sleep but could very well lose their jobs - over the very things once taken for granted.
So let's assume that your company has a disaster recovery plan which has been reduced to writing. How then do you ensure that the plan would not gather dust or become hopelessly outdated?
The problem I have found with disaster recovery planning exercises is that there is no repeated emphasis once the initial flurry of activities subsides. After the plan is completed - more often than not - a company's internal operating practices do not reinforce disaster recovery awareness. The challenge, therefore, is how can you ensure that this awareness is maintained? And where should this awareness program begin?
Let's look at where the opportunities to broadcast the company's attitude towards emergency preparedness can be found. Four readily identifiable areas come to mind which offer the greatest visibility for reinforcing the company's disaster recovery planning policy and strategy:
 Personnel orientation
 Staff reviews
 Departmental annual budgeting
Starting with the receptionist: I have often phoned companies requesting to speak to the person responsible for disaster recovery planning, only to be asked which department would that person be in. More often than not I'm told, - 'Well I'm not sure but let me transfer you to ...so and so... who should be able to help you.' This is usually followed by another transfer, and if I haven't by this time fallen victim to 'accidental disconnection'...(ooops, didn't you just call), I finally speak to someone who understands what I am enquiring about.
Try it out within your own company. Have someone phone anonymously and ask for the disaster recovery planning officer, and see how quickly they get through to the correct person?
Your receptionist should not only know who is responsible for disaster recovery planning, but should have at his/her fingertips the names of the individual(s) to whom all questions relating to disaster recovery planning should be directed. Why keep the listing of disaster recovery leaders, recovery/restoration team members etc., buried inside the disaster recovery planning manual? Include these names and functional responsibilities on the internal telephone directory listing, prominently, and for all to see and know.
And don't stop with the receptionist. Make the company's disaster recovery program a part of the new employee orientation program. To accomplish this, include a separate and noticeable signoff sheet, to be returned by the new employee, which clearly states that they have received and read the plan prepared for the department/area in which they will be working, will participate in recovery planning exercises from time to time, and will continue to have knowledge of and participate in the preparations of the recovery plans for all future departments they may work in within the corporation. This will not only alert the employee to the seriousness of this topic, but will further serve to reinforce the company's commitment to business continuity planning.
Human Resources department on the other hand, should not be concerned with having to keep current copies of all departments' plan. They should be able to call the respective department and request a copy of their most current plan (which should be dated) as and when needed. When it is received, it is included in the orientation kit and passed to the new employee.
We all know that some of the things signed at orientation are seldom if ever looked at again or remembered for that matter. To ensure that this does not happen to the disaster recovery signoff sheet, include disaster recovery as part of the annual employee review process. This could be accomplished by including a section, on the employee's evaluation form, which asks (for) what activities has the employee engaged in to support the company's disaster recovery effort. This section should not be used as a grading tool; rather it is to ensure that the employee maintains an interest in the disaster recovery planning efforts of the company. Neither is the quantity of activity important - it could simply be that the employee participated in an offsite test of his/her department's recovery plan. The point is, this section should not be left blank - the employee should have done something and more importantly - know why it was done!
Finally, make managers accountable. Include as part of the annual budgetary review process, a signed statement by each department head that he/she has in place an updated disaster recovery plan, in line with the company's policy, that the staff under his/her direct responsibility are aware of such plans, and are in adherence to the requirements - that is, maintain current software, equipment configuration, supplies and records offsite, etc. - and has conducted at least one general staff session, to discuss the department's disaster recovery plan, or a test of the state of preparedness of the department.
By now you would have concluded that the intent is to ensure that disaster recovery awareness follows an employee throughout the organization. And the only way to ensure this is to include it at the points where they are likely to be most visible to the employee.
Furthermore, if buildings require prominent postings of Fire Warden signs, then why shouldn't companies insist on a similar posting to identify their recovery personnel? Maybe the day when the building's list will be expanded to include a section for a company's personnel is not too far off! Now this does not mean that people will automatically read it, but [a] they will know where it is, [b] if posted close to elevators the chances of it being read while waiting for an elevator is greater, and  there is the possibility that it will be read at least once a day.
A note on credibility of listings: Any list which is not current to within one month will lose credibility faster than an elected politician. Therefore assign the task of ensuring the currency of these lists to a specific area ( I would start with the mailroom).
This is not to advocate more work for an already lean staff. On the contrary, this should be so automatic that it becomes second nature. Too many plans are left to wither, to the point where when they are found, they bear little representation to what is currently in place. Like any good contract, the things to pay attention to are not the ones which are obvious now, but those which will haunt you in the future.
Again, the important points to remember if you want to maintain disaster recovery/continuation awareness throughout your organization, year round, are:
- Include it as part of the orientation package.
- Make it a part of the overall annual budget process.
- Include a recovery personnel section as part of the internal telephone directory listing.
- Make all department heads responsible for timely advise of changes.
- Ensure that teams and members are prominently posted... not stuck on the cafeteria bulletin board, and hidden below...Looking for one bedroom apartment possible share...
- Include it as a part of the employee annual review process.
And tell the receptionist.
Franz McConney, CDRP, is President of TVI Corp. in Englewood, NJ.