Process, Technology, Personnel - The DR Trinity

Article by Sunil Gupta

I have heard far too many people talk about DR and BCP but their opinion on what can be considered a disaster and how DR varies from BCP is often skewed. According to me, a disaster is a sudden, unplanned catastrophic event that renders the organizations ability to perform mission-critical and critical processes, including the ability to do normal production processing of systems that support critical business processes. A Business Continuity Plan (BCP), on the other hand, describes the steps yourorganization needs to take when it cannot operate normally because of a natural or manmade disaster.I think of the BCP as an umbrella plan whose major sub-categories include the Disaster recovery Plan. A good DR plan incorporates three major factors – People, Process and Technology.

The disaster recovery process consists of defining rules, processes, and disciplines to ensure that the critical business processes of your organization will continue to function if there is a failure of one or more of the information processing or telecommunications resources upon which operations depends.I would advise you include key people from each of your company’s business unit as members of the team and include them in all disaster recovery planning activities. You then need to ensure the DR planning group should understand the business’ technology, processes, networks and functions in order to create an effective DR plan. A risk and business impact analysis should be prepared by the disaster recovery planning group that includes at least the top ten potential disasters.

After you have analyzed the potential risks, assign priority levels to each business process and application/system. It is important to keep inventory up-to-date and have a complete list of equipment, locations, vendors, and points of contact. While creating a DR plan, you should keep in mind the fact that technology and processes are useless if you do not have the personnel who operate them.In its full context, the focus of a business continuity disaster recovery Plan (DRP) is to restore the operability of systems that support mission-critical and critical business processes. The objective is for the organization to return to normal operations as soon as possible. Since many mission-critical and critical business processes depend on a technology infrastructure consisting of applications, data, and IT hardware, the DRP should be an IT focused plan.

Every organization should develop a Disaster Recovery Plan for all applications. Restoration of systems does not necessarily imply technology redundancy. The DRP may call for some procedures to be completed manually. The decision to revert to manual procedures, rather than to build and maintain an IT infrastructure is a cost-driven decision made by the organization. Having a DR plan in place reduces the risk that the length of time that a disruption in a business process does not go beyond what has been determined to be acceptable by management in the organization. During the recovery phase, the focus is on establishing controls over occurring events limits the risks of additional losses.