DRJ's Spring 2019

Conference & Exhibit

Attend The #1 BC/DR Event!

Spring Journal

Volume 32, Issue 1

Full Contents Now Available!

June 1 is the date that most of your Disaster Recovery (DR) Coordinators, Business Continuity (BC) Planners and Contingency Planners (CP) circle on their calendars down here in Sunny Florida. That is the official start of Hurricane Season. Time to get those DR plans updated and ready to roll in case of a hurricane. At least that's what management tells us! The Hurricane season is always a scare, but what about other disasters? I have been in so many meetings in the past couple of years trying to convince others that Hurricanes are not the only worry. What about fires, floods, tornadoes, employee sabotage? What about the local airport that has hundreds of planes and helicopters taking off and landing directly over your building? Not too long ago, a small Cessna took off and abruptly crashed less than 2 miles from this building. The plane did land in water in the everglades, but what if it had crashed directly into the building? Does your plan include a scenario for that?

Your DR plan should cover EVERY disaster that you can think of, no matter what the odds are. Your backup tapes should be sent offsite at an interval that you have agreed to with your DR team and management. Your contract with your HotSite vendor should be reviewed at least every six months and maybe even more if your company has a lot of changes to its configurations. Make sure all of your DR team members contact numbers are updated, such as pagers, cell phones, home addresses, etc. Do you have an agreement with a hotel in case you declare a disaster? If not, where will your DR team stay during the restoration process at the HotSite?

What happens to their families and/or pets during this time? There are a lot of things that have to be covered in your plan. For those of us in Florida, the Hurricanes offer another twist: the PLANNED disaster. This of course, means the Hurricane is predicted to take a direct hit on your area. What do you do first? Your plan should state what you do from 72 hours out, through the direct hit. A good template on this is to document what you do at 72 hours and every 12 to 24 hours after that. Have you thought about when and how to get your DR team out of the city? The airports usually shut down when winds are sustained at 35mph and above. Does this alter your thinking? Will your DR team have to brave high winds and rain to drive across the state to another airport just to fly to the HotSite?

As you can see there are many things to think about. What about your plan? Where does it reside? Do you have a hardcopy with you all the time? If your plan is left on your PC at work and the building is no longer there, what do you do? A good idea is to have a copy on your home PC (if you have one), at work and a hardcopy printed out and carried with you at all times. At all times you ask? You are the DR Planner, and it is YOUR job. You can always send one out to an Internet email address that you can access from anywhere. You should also make sure your management team has a copy as well as some selected individuals on the DR team.

A HotSite vendor once told me that a company had declared a disaster, then showed up onsite to do their restoration. Not one person had a copy of the DR plan. Needless to say, it took them a lot longer to restore their systems than they had planned. You wouldn't want to answer to management for that one! If you're a company that has a critical business need to be up and running within an allotted time and that doesn't happen, the money lost could be tremendous. Does your plan list what to do in a long-term disaster? Is it covered in the contract with your HotSite vendor? Another good idea is to have a listing of what you would do during the actual disaster at the HotSite. This could include what you will restore during the first 24 hours, 48 hours, 72 hours and so on. This list should be determined by your Business Impact Analysis. This will show you the most critical needs to your business, such as which applications to restore first.

Does your plan have a call tree that lists out the important people during the disaster? What about contact numbers for your vendors? You need to have all of this documented, you don't want to be scouring through a Rolodex when you don't have a lot of time. Who declares a disaster? A good thought on this is the Chief Information Officer or President of the company. Do you know where he or she is all the time? That's why it's important to have ALL necessary numbers documented and in a place you can get to quick.

According to the Federal Emergency Management Agency (FEMA), at http://www.fema.gov/library/lib01.htm, the number one disaster since 1964 has been floods. Is your company prepared for one? If you didn't update your plan recently, a good bet is that you're not prepared to handle any situation. One major key to having a well-prepared plan is updates. Any major system changes to hardware/software need to be covered in the plan. The contract vendor needs to be updated; contracts need to be reviewed, approved and signed. If this isn't done, your vendor might not have all the new technology that you just installed! What do you do then? I realize that the vendor will probably go out of their way to accommodate you, but you can't count on them reading your mind and knowing what has changed and what hasn't.

If you're new to the DR world, there is a wealth of information available to you.

As you can tell, there are many reasons for making sure the DR plan is updated on a consistent basis. Some of the reasons are more important than others, but they all are good reasons.
So, the answer to the question of when to update the plan is: AS OFTEN AS POSSIBLE! This will ensure a good comprehensive plan in the event of an actual disaster. Maybe once management reads this, they too will know that there are more disasters than just hurricanes! Good Luck!

Ralph L. Herbert is a Certified Business Continuity Planner and a Disaster Recovery Coordinator for ANC (Alamo, National, Car-Temps) Rental Corporation. He is a member of the Disaster Recovery Institute International and the Disaster Recovery Information Exchange (Virtual Chapter). Ralph has over 20 years experience in Information Technology and over six years experience in Disaster Recovery Planning.