With one week to go before the June 1 start of hurricane season, it is time to put the finishing touches on your preparations, and ensure that your business has a detailed plan ready in case of emergencies.
This is the final installment of a five-part series offering answers from Tom Serio, director of business continuity management for Office Depot and Jon Toigo, CEO and managing partner of Toigo Partners International, on the following topics: Disaster Recovery Planning, Protecting Your People, Protecting Your Data, Investing in Disaster Planning and How to Create a Disaster Recovery Plan for Your Business.
Part 5: How to Create a Disaster Recovery Plan for Your Business
Q. What are the top things businesses should be doing to prepare?
SERIO: If you haven't already done so, create a disaster recovery plan. Once the plan is developed, practice, practice, practice.
Start by downloading a free copy of "Disaster Preparedness: Advice You Can Depend on to Weather Any Storm." And when developing the plan, keep these three guidelines in mind:
— Update your business contact lists, establish a clear process for communications and plan how you will contact one another in different scenarios. When building your contact list, get as much information as possible — relatives' contact information, alternative communication devices, etc.
— Back-up all of your critical data and move the media to an off-site storage facility or other secured location.
— Rehearse and test your plan. Build teams of two or more people to handle key functions in an emergency.
Q. Should companies hire outside experts to develop their disaster recovery plans?
TOIGO: True experts on disaster planning and recovery are companies that have faced disasters and successfully recovered. That's why Office Depot has compiled its learnings in a new online resource, "Disaster Preparedness: Advice You Can Depend on to Weather Any Storm."
The nature of disaster recovery planning itself, the uniqueness of individual business organizations, and the rapid pace of technological change all conspire to render each and every plan an original work of its designer. In short: There is no wrong way to develop a disaster recovery plan – one does not need a professional certification to do the work, but can be reasonably certain of developing a testable plan through the application of readily accessible project management skills, a bit of industry knowledge, business and technical savvy and a healthy dose of common sense.
A company may hire an outside expert to help develop a plan, but the company must fully support the development and own the plan once created. It is a company's responsibility to own, maintain and enhance the plan to reflect any business changes.
Q. How often do you need to update your plan?
TOIGO: Updates to your disaster recovery plan should be made on an ongoing basis. Contact lists should be revised when new employees are hired, move to a new address or even change their phone number.
A full, in-depth review of your disaster recovery plan should take place at least once a year. As your business develops, critical functions change or your applications and networks change, so should your disaster recovery plan.
Q. Who should be involved in creating the plan?
SERIO: Build disaster recovery teams with two or more people – a primary person and a backup. Multiple teams can be created for specific responsibilities such as system and network restoration, employee communication, vendor and supplier transactions, salvage and insurance assessment, and media communications.
When creating the teams, consider including a cross-section of people from within your organization. Include staff with technical skills as well as managers who are all familiar with the ways your business functions on a day-to-day basis.
Q. What are the key components to a plan?
TOIGO: The essential components of every disaster recovery plan are establishing clear plans for protecting your most valuable assets: your people and your data. Do this by creating contact lists and developing a process for communicating to employees and key vendors and suppliers. For data, complete regular backups and store them in secure, off-site locations.
Give structure to your recovery plans and help prioritize goals by determining the information that's critical to your business's survival, the technology that supports these procedures, the data which these processes produce and use and how the information is currently being stored.
Most companies, small and large, need specific plans for the recovery of:
- The applications and their data that support key business processes
- Voice and data networks
- User work areas
The plan should also include a listing of your critical business functions and the procedures on how to recover and restart those procedures in disaster mode.
Q. Is there a disaster recovery planning formula?
SERIO: Disaster planning is not a one-size-fits-all concept.
That said, there are a number of resources available for businesses to use while developing disaster recovery plans. Web sites like The U.S. Department of Homeland Security's, Disaster Recovery Planning.org and the Data Management Institute provide templates and detailed information about how to create your own disaster recovery plan.
Q. What unique needs should small businesses consider when creating their plans?
TOIGO: Disaster planning and recovery is not an issue where the size of your business matters. Whether you have a small business or large corporation, the tactical considerations are the same. Determine your mission-critical business processes; the technology that supports these processes; the data these processes produce and use; and how and where that data is presently being stored. Data is the core of the recovery process and it is essential to understand its importance within the context of the business if you are going to protect it.
That said, the complexity of the disaster recovery strategy required in a large corporation is adequately greater than what is required in a smaller firm. Greater complexity usually entails larger budgetary requirements. A small firm may be able to build an effective recovery strategy quite affordably; a larger firm may be looking at a significant investment.
But keep in mind, many small businesses utilize PCs, laptops or even basic servers along with off-the-shelf software, such as Word, Excel and others. Using these common items should greatly help your ability to rebuild your computer infrastructure and recover your data and business.
Q. Are there particular resources that help businesses create disaster recovery plans?
SERIO: Businesses can log on to www.officedepot.com/getprepared and download a free copy of Office Depot's "Disaster Preparedness: Advice You Can Depend on to Weather Any Storm." The guide is filled with information about how to ready your business for a potentially disruptive or disastrous event.
I also recommend that readers visit The U.S. Department of Homeland Security's site, which was designed to launch a process of learning about citizen preparedness, and the American Red Cross, which in addition to providing planning information offers, emergency training.
Q. Is it important to discuss the disaster recovery plan with your employees?
SERIO: Absolutely. Communicate regularly with employees before, during and after an incident. As an essential asset to your company, your employees will need to be aware of your disaster plans and procedures to assure recovery in the event of an incident. And when you test and practice your recovery plans, absolutely include your employees. This way, they become familiar with the process, can help identify shortcomings in your plan and will be already experienced come time to recover from a real disaster.
Q. How do you know if your finished plan is adequate?
TOIGO: Testing and re-testing your plan is the only way to spot gaps and make necessary changes. Without testing, planning has no value. I suggest businesses establish an ongoing schedule of routine tests, including spontaneous ones.
Testing also trains a cadre of persons in your organization to act rationally in the face of a great irrationality, which is what a disaster is. Shakespeare said once, "All things are ready if our minds be so." That, and your data, could save your company.
Tip From the Expert:
TOIGO: "Disaster recovery planning looks complex but in reality, it's a straightforward application of common sense. Build a flexible plan that protects your two must valuable assets – your people and your data. And, build it on the basis of a catastrophic event that requires you to evacuate, but able to be scaled back easily to respond to lesser events."