Everyone is well aware of all of the recent natural disasters and political upheavals, and the tendency is to focus on these headlines and structure our preparedness accordingly. But in the real world and work environment that we function in daily, these sensational events are hectares apart from the more likely disaster and recovery scenarios that will test an organization’s ability to recover if and when they occur. This is the very reason why turning one’s attention away from blockbuster disasters to the more commonplace disruptions is the practical solution. And for this reason we focus on recovery steps, which are by their very nature a bit elusive. They can be identified with a little common sense but many times are not recognized as a vital part of the recovery planning process. What exactly are "recovery steps?" Why are they necessary and who would use them?
Recovery steps are merely a well defined list of actions performed before, during, or after a business interruption. They are known to the organization as a result of careful planning done as a preemptive measure to minimize the effects of a business disruption. Recovery steps provide structure to a chaotic environment, whether large or small. When used efficiently, they will minimize recovery efforts and costs associated with the recovery. All levels of an organization greatly benefit from the development, clarification, and testing of recovery steps designed to ensure they fit a unique organization in the event of a business disruption. The types of recovery steps will differ according to the user but all of these steps will in most cases facilitate a favorable recovery outcome.
Categories of Recovery Steps
There are various categories of recovery steps that may change with the complexity of the organization, but here are some general categories.
1) Emergencies
a. Pre-Emergency
b. Post-Emergency
2) Crisis Response
a. Logistics
b. Facilities
c. Management
d. Technologies
3) Business Unit / Department Recoveries
Emergency – Pre- and Post-Interruption
Emergency recovery steps can be "pre" or "post" business interruption. When a hurricane is threatening, then there are "pre" recovery steps that could be identified to help mitigate losses. After the hurricane, "post" recovery steps would apply and provide structure for responding to personnel issues.
Samples – Pre-Interruption Recovery Steps
1) Review list of public service agencies and be prepared to contact them.
2) Create backup system tapes and leave the area.
3) Review support contracts and contact vendors to ensure readiness.
Samples – Post-Interruption Recovery Steps
1) Determine staff that will be available to assist.
2) Determine missing staff and locate them.
3) Determine how to assist critical staff members.
Crisis Response
Crisis response recovery steps are focused on immediate responses after a business interruption occurs and on activities that will assist the whole organization in its recovery efforts. These responses stabilize the environment, conduct damage assessment and protect facilities, activate and setup alternate workspace areas, track efforts, provide travel assistance, activate recovery of technology, control the media, determine outage duration, secure additional resources, interact with regulatory agencies, respond to personnel issues, adjust Web sites, interact with public agencies, collect information needed for insurance companies and place claims, manage salvage efforts, replace lost assets, repair facilities, oversee all departmental recovery efforts, provide high level direction during recovery, work with the public sector to enter affected facilities, and work with legal counsel.
Samples – Crisis Response Recovery Steps
Logistics:
1) Track all disaster related expenses.
2) Re-route mail and related courier activity.
3) Ensure staff entering restricted areas have proper identification.
Facilities:
1) Conduct quick and in-depth assessments of damage and document findings.
2) Review assets inventory listing.
3) Activate alternate power sources.
Management:
1) Develop media releases and execute as often as needed.
2) Contact emergency agencies.
3) Activate communication methods for internal staff.
Technologies:
1. Recover system backup tapes to new equipment.
2. Order new equipment.
3. Forward critical phone lines.
Business Unit Recoveries
These activities are different than those of crisis responses. They are focused on the recovery of the department; a single unit; versus the total organization. They analyze the status of the department, prioritize work, determine lost work, determine immediate and long term alternate workspace needs, assign staff, review contingency processes, and evaluate work-in-progress.
Samples – Business Unit Recovery Steps
1) Determine work-in-progress at time of business interruption and the effect the interruption has had.
2) Review contingency processes and determine what can be done manually and how it will be done.
3) Determine how to recreate lost work.
Recovery Steps Development
After determining the categories for the various recovery steps, it is time to develop a comprehensive list that will fit your organization. This is the most important part of the planning process. If the development of recovery steps is carefully laid out and addressed, the chances for successful recovery after a business disruption is greatly increased. On the other hand, lack of careful development will leave an organization poorly equipped to deal with a disaster and have a strong negative affect on the company’s long term future.
Developing Recovery Steps
First, ask yourself what activities would need to be done and when. You can flush some of these out by conducting a tabletop exercise and documenting your discussions. You can also use the plethora of publications and Web sites available for business continuity. Then you would adjust the activities so they exactly fit your environment versus being generic to many organizations.
Prioritizing Recovery Steps
After the recovery steps are developed, a critical priority number needs to be assigned to each step. It is reasonable that some recovery steps will take place right in the beginning of recovery efforts and others will need to be addressed later in the recovery process. It is understood that recovery steps will not follow a neatly organized list as several recovery steps could be occurring simultaneously within various parts of your organization. Assigning critical phases in addition to a critical number to each recovery step will facilitate the organized recovery effort. This is accomplished by simply doing the more important things first.
Assigning Recovery Steps
So now your organization has a comprehensive list of recovery steps for all business units. Who will do them? Will it be a by a group or will steps be assigned to an individual or to a functional title? Before determining how to assign recovery steps here are some things to think about:
1) Effect of loss of staff: What will happen to your recovery efforts if communication infrastructure is destroyed or if public or private transportation is affected resulting in staff assigned recovery steps not being available to you?
2) Cross training/knowledge level of staff: Will the available personnel at the time of the disruption be trained to go through the recovery process utilizing the recovery steps?
3) Location of personnel: Where does staff reside in relation to the affected location and how will their location help/hinder recovery steps being activated promptly?
Exercising Recovery Steps
After the process of developing and assigning recovery steps is completed, every organization will want to ensure that the plan developed will actually work. By scheduling exercises to validate your plan content, you can determine with some assuredness that your plan will work. The exercises will assist your organization in determining the effectiveness and comprehensiveness of the recovery steps list developed and how you can adjust to ensure a more reliable outcome. By being creative in your exercises so as to discover as many recovery steps as possible, your organization will be better served in finding every possible step needed in the recovery process.
Summary
Recovery steps are like creating a grocery list for an ultimate dining event. Some of the items on the list are vital to a successful evening and others are nice to have but putting all things aside, you can create a terrific nourishing meal that is well balanced without many of the garnishments. The meal, however, could be much appreciated if the garnishments are in just the right places. How tasteful it can be if done properly.
Conversely, the more effort you put into developing comprehensive recovery steps that are native to your organization, the more effective the recovery will be. In addition, exercising recovery steps will lead the organization to determine where more planning efforts need to be focused. If your organization can be creative and think beyond your normal thought processes, you will step out of the normal day to day operations and be able to prepare for the unexpected if and when it does happen.
Sara Williams, CBCP is certified with DRII International. She is currently a business continuity consultant for Jack Henry & Associates."Appeared in DRJ's Winter 2007 Issue"
