5 Steps to Prepare a Disaster Recovery Plan

You don't have a team to do a risk analysis, or business impact analysis, or recovery option analysis, but you do need a business continuity and disaster recovery plan for a company with a limited budget.

To develop a good BC / DR plan, you have to address all the issues that will affect your business in the event of a business interruption. Here are 5 steps that will help you develop your plan.

1. Define the scope and objectives of your plan.
Lay out the groundwork for what your plan must accomplish. Put together a decision-making team that has the authority to define goals, investigate assumptions, set completion times, and allocate resources.

2. Gather information.
The purpose of the information gathering phase is to identify "risks" and "impacts", and the best method of gathering information is to interview the company's employees. There are several methods of conducting interviews: one-on-one, or by business units or departments. Groups will never be as good as one-on-one discussions, but may reduce the information-gathering time. The decision-making team may also be a good source of information about how the company operates and what vulnerabilities exist. After the information has been gathered, you will need to identify and analyze options for the business continuity process. The options should be identified by personnel that will be the most affected and who know the area of the business the best. The planners will assist them in identifying and analyzing their options; provide them with guidance; but the employees should draft the continuity requirements of their area of responsibility. Restrict the options to those that come reasonably close to satisfying the recovery time objectives. The decision-making team will use the recovery objectives as criteria to assess options.

3. Develop a Business Continuity Plan Budget.
As costs begin to be identified put together a preliminary "option" budget. If the recovery objectives have been set to be within less than 2 hours following a disaster, then only options that meet those demands should be examined. the cost those options should be weighted against the possible loss that might be incurred if the plan was not implemented. Part of the research includes assigning a dollar value to each hour of down time. How much is the survivability of your business worth to you?

4. Finalize the Business Continuity Plan.
The final business continuity procedures and the budget will have been reviewed by the decision-making team. Everyone must be in agreement that the final plan comes as close as possible to meeting the plan objectives as possible. The business continuity procedures will specify how the business will continue to perform its mission critical processes during the interim period of interruption and until recovery is complete. In other words, the plan will detail the when, where, and how the business will operate from the time the interruption starts until recovery is finished.

5. Regularly Test The Plan.
Devise a testing procedure. Test different parts of the plan at the same time using the same simulation. Pick the least intrusive time to test. Some people will not want to participate, and there may be a tendency to minimize the scope and frequency of participation, but it is important that everyone understand the importance of disaster preparedness. The company must be ready to execute the plan when a disruption occurs, otherwise the recovery objectives will not be met. Keep the plan current and usable. Keep the plan up to date at all times. Reviews should be performed when major changes take place. It is important to keep the plan maintained, but not over-maintained.