Maintaining your disaster recovery (DR) plan can be challenging. Each DR plan is different. Some disaster recovery plans require a review once a year, some once a month and some require a review each time a product or the environment it's in changes. Each organization must decide when it is right to review and/or change their DR plan, but how do you determine when it is right to update or review your DR plan? This article points to the most common reasons why an organization updates their DR plan and how to go about doing it.
Disaster recovery plans require updates or reviews when a change occurs with one or any of these four factors in an organization: your environment, how you exercise your plan, changes in your recovery time objective (RTO) and several external factors.
Environmental factors and your disaster recovery plan
Environmental factors relate to changes within the organization. Because IT environments constantly fluctuate, you should change your disaster recovery plan accordingly, so that your codes and staff are up-to-date with any changes. Some examples of the most common environmental IT changes are hardware and software updates, outdated or replaced applications, staffing changes, down-structuring and new facilities and buildings. Any of these changes can easily mean that DR team ranks and roles must also change. Failure to update a disaster recovery plan accordingly could lead to unnecessary hardships in an organization.
How you exercise your DR plan can illuminate changes that need to be made to it. If your disaster recovery test adequately challenges its participants, you should be able to tell whether or not your DR plan is realistic, complete and achievable. Unfortunately, many disaster recovery exercises may fall short of re...
To continue reading for free, register below or login
To read more you must become a member of SearchDisasterRecovery.com
plicating production environment complexity, or fall off the priority list altogether. Well-planned and well-executed DR exercises will provide the best source of input to DR plans, short of a major live event. A live event could include anything from an incident reported to the service desk, to a major production outage, to frame both ends of its spectrum. Many points on that continuum will highlight changes that need to be made to your disaster recovery plan.
Also, note that you can enhance your disaster recovery plan based on what you observe from production environment incidents. Many organizations will find room for improvement by incorporating production lessons learned into disaster recovery plan updates, particularly if they employ an annual DR plan revision cycle.
If factors regarding your recovery time objective changes, so should your DR plan. Several different things can cause RTOs to change in your environment. For example, business recovery requirements for functions and processes may become more or less urgent. Auditors come and go, never failing to leave their "to-do" list. Also, when interdependencies multiply, they provide a steady source of plan revision challenges. Lastly, cash flow pressures may force a firm to reconsider its recovery time strategy or requirements and thereby spend less money on disaster recovery. Any or all of these changes relating to RTOs should prompt your organization to take a second look at your DR plan and make any necessary revisions.
External factors and your disaster recovery plan
External factors can also lead to changes in your DR plan, and they relate to entities outside your organization including mandatory and optional aspects. The mandatory segment includes regulatory and other legal or regional requirements. There are several optional topics, including outsourcing to another DR site, which creates challenges from two perspectives: it may decrease awareness levels between the parent organization and the outsourced function; it also may increase recovery requirements on the parent organization. Also, external technological innovation may introduce new risks to disaster recovery, as well as new solutions. It is important to be aware of any external changes to your IT organization. Changes in your outsourced DR site, legal requirements or new technologies can drastically affect your original disaster recovery plan. Make sure you update it with the new and necessary details.
So how often should you update your DR plan? The answer to this varies, and depends on all of these factors. Many companies opt for an annual review frequency. Some organizations may not ever consider more frequent alternatives to that review schedule. Others adopt a semi-annual or quarterly update for selected plans, based or attributes such as risk rating or criticality. A final approach requires plan owners to update their plans whenever the situation requires it, irrespective of an annual review date. While this method has some merit, it is practically impossible to measure whether the plan owners are responding as often as circumstances require. Senior management needs assurance that plans are being maintained on an appropriate frequency.
But ultimately, you should update your disaster recovery plan whenever an important factor in your organization changes, whether that variable is internal or external. And the time frame on those changes is unpredictable. Frequent updates lead to more complete and reliable disaster recovery plans, which therefore lead to a work environment safe from disasters.
Frank Lady, CBCP, CISSP, PMP, has more than 15 years of experience in business continuity and contingency planning roles. He is a vice president of business continuity for a Fortune 50 company, and a member of the "Disaster Recovery Journal's" Editorial Advisory Board. Frank welcomes feedback at bcjfrank@gmail.com.
