For most organizations, voice communications technology represents one of their top five expenses. And yet it's not uncommon for many companies to have little or no provisioning for their voice systems in case of a system disruption or major disaster. This guide and associated voice communications technology disaster recovery plan template provide insights and guidance on developing a voice communications disaster recovery strategy.
In this guide, you'll learn how to keep your voice communications up and running in the event of a disaster, how to write a voice over IP (VoIP) disaster recovery plan, and then you can download our free template and get started.
VOICE COMMUNICATIONS TECHNOLOGY DISASTER RECOVERY PLANNING TEMPLATE TABLE OF CONTENTS
>> Getting started with VoIP disaster recovery
>> Voice communications and the disaster recovery planning process
>> Unique attributes of voice communications technology
>> How to use our voice communications technology disaster recovery planning template
When dealing with voice communications systems such as traditional PBX systems, VoIP systems or call centers, company management is typically content to have vendors provide disaster recovery services. That is, of course, if the subject ever comes up for discussion. Unfortunately, "disaster recovery" services are different from normal maintenance contract activities. These may entail additional costs that are not covered by warranties or maintenance contracts. Service-level agreements (SLAs) may not include disaster recovery provisions, although they should.
Business leaders need to take a careful look at how their voice communications investments are being protected from unplanned events. It may not be enough to have a battery backup system or spare circuit boards or telephone instruments. A detailed process for emergency recovery may be advisable, especially if the system is complex, provides revenue-generating functions for the firm (e.g., such as a call/contact center), or is connected to other company systems via corporate networks.
The disaster recovery planning process for voice communications has several steps. Like most disaster recovery plans the steps include project initiation, risk assessment, business impact analysis, strategy development, plan development, plan exercising and maintenance. In many cases the assessments and exercising are bypassed in favor of plan development, as a way to save money and time. This strategy can certainly produce a plan, but it may not provide an effective recovery when put to a real test.
To make the process easier, people often seek out disaster recovery software, checklists or consultants. While each of these options can help build a plan and its associated program elements, too often these tools are used to "get something done" quickly. Further, they may not be optimized specifically for voice communications. Typically the process involves some data gathering and interviewing, followed by a "fill-in-the-blanks" process that creates a finished product.
Like any specialized technology, voice systems have their own attributes, especially older systems that operate independently of data networks and the Internet.
The following are some of the attributes of voice communications systems that need to be factored into disaster recovery planning:
- Location of the equipment in a separate room as opposed to sharing space in a room with other systems
- Need for separate heating, ventilation, air conditioning (HVAC) facilities
- Need for separate power supplies, including commercial power outlets, battery backup systems, proper grounding and lightning protection
- Need for access to specialized local access lines for connecting to local and long distance service providers; maybe also require separate Internet access lines
- Specialized peripheral subsystems, such as call detail recording, source for music on hold, voice mail, and provisions for separate key systems working with the PBX
- Cross-connect equipment (e.g., Type 66 connecting blocks) mounted on the wall, located in the equipment area
- Racks for feeding cables
- Specialized phone devices for operators as well as individual users
- Wall-mounted connectors for phone instruments (e.g., RJ-11 or RJ-12, as opposed to RJ-45 typically used VoIP systems)
- Unique operating systems and frequently-changing system databases that must be backed up periodically, both on site and at the vendor's tech center
- Unique circuit boards that may need to be replaced quickly following a disaster; supplies of tested boards should be on site and readily available from vendors
The advent of the Internet and its Internet Protocol (IP) has stimulated the development of VoIP systems that provide all the features of traditional standalone PBXs, plus they can utilize internal data networks as well as the Internet. These advances also bring with them a new set of risks, in that VoiP systems often utilize existing data network infrastructures. If those internal networks fail, the VoIP system may also fail.
For voice communications we can use a more or less generic disaster recovery planning template. Instructions are included with the template. Specific voice attributes and nuances, such as those identified previously, must be included. Timeframes shown in the template are for examples only.
- Take the process seriously. If voice communications are essential to your business, you can protect your investment from unplanned events that could disrupt phone service operations by creating a plan. It doesn't have to be dozens of pages long. It just needs the right information, and that information should be current and accurate. It's a good idea to share your plans with your vendors -- both equipment and network access services -- so that they can add their input.
- Use standards as a starting point. Several IT-focused standards can be reviewed and possibly adapted to support voice:
- British Standards Institute (BSI) BS 25777 (IT service continuity)
- International Organization for Standardization (ISO) 24762 (IT service continuity)
- National Institute for Standards and Technology (NIST) SP 800-34 (IT contingency planning)
- NIST SP 800-58 (Voice over IP systems)
- Keep it simple. Less can definitely be more in this situation, but it is important to address the key voice components in the plan.
- Limit content to actual disaster response actions. Assuming you are creating a plan to respond to specific incidents, include only the information needed for the response and subsequent recovery; review the plan with your vendors.
- Make it happen. Once the plan is complete, exercise it to ensure that the documented procedures make sense in the sequence indicated; review it with your vendors.
- Be flexible. A single template may not be applicable to a voice communications environment; consider other templates, software or consultants.
Structure and content of the disaster recovery plan template
The following are basic instructions for using the free voice communications disaster recovery plan template, including key issues to address and activities to perform.
- Initial data -- If you have identified various people to contact in the event of an incident, locate their contact information at the front of the plan so you won't have to waste valuable seconds paging through a lengthy document; be sure to have all pertinent vendor contacts listed.
- Revision management -- Have a page that reflects your change management process.
- Purpose and scope (Sections 1.1 through 1.6) -- Provide details on these attributes, as well as assumptions, team descriptions, a list of terms, and other background information.
- How to use the plan (Sections 1.7.1 through 1.7.4) -- Provide information on circumstances under which the plan will be activated, including outage time frames, who declares a disaster, and who should be contacted on this situation.
- Provide policy information (Section 1.7.5); this is a good place to use standards documents as references.
- Emergency response and management (Section 1.7.6) -- Specify situations in which the plan is to be activated and response procedures; a risk assessment can help identify situations in which the plan may be used.
- Use step-by-step procedures (Sections 1.7.7 through 1.7.10), as these are easier to follow than broad general statements such as "restart PBX system" which may require several steps to execute properly.
- Describe how often the plan is to be reviewed and updated, and by whom (Section 1.8).
- Assuming a situation has occurred, Section 2 provides steps to take to address it; these can be in the form of checklists (useful to keep track of scheduled and completed tasks) and flow diagrams that provide a high-level view of response and recovery.
- Gather facts about the incident before declaring a disaster; this includes damage assessment data and first-hand reports from staff and vendors; convene meetings as needed with key emergency team members to evaluate the facts before proceeding to a declaration.
- Section 3 addresses actions to take when it becomes obvious that management needs to declare a disaster. Damage assessments are critical to this step; they should be initiated before the declaration.
- Section 4 provides detailed instructions on recovering systems, network services, specialized systems, relocating staff (such as call center agents) to an alternate site.
- Detailed appendixes are provided in Section 5; these include lists and contact details on all emergency teams, primary and alternate vendors, alternate work space locations, and other relevant information. It is very important to keep this information up to date.
- Additional forms can be found in Appendix 5.7; these should be developed in advance, validated by exercising (as is the entire plan) and kept in a ready-to-use format.
Creating a voice communication technology disaster recovery plan -- one that responds to and eventually recovers the systems and/or network services -- can be a straightforward process. The keys to success are to understand the risks to the voice infrastructure; collaborate with vendors and network service providers as much as possible; define step-by-step procedures for response and recovery; validate these actions through exercising; and keep the plan and its various components up to date.
About this author: Paul Kirvan, CISA, CSSP, FBCI, CBCP, has more than 20 years experience in business continuity management as a consultant, author and educator. He has been directly involved with dozens of IT/telecom consulting and audit engagements ranging from governance program development, program exercising, execution and maintenance, and RFP preparation and response. Kirvan currently works as an independent business continuity consultant/auditor and is the secretary of the Business Continuity Institute USA chapter and can be reached at firstname.lastname@example.org.