With the increasing amount of industry standards and technical certifications associated with business continuity
(BC) and disaster recovery (DR), best practices are starting to accumulate around the roles the disaster recovery team plays when it comes to disaster recovery planning. From the CIO, to the IT department to stakeholders from various operational units, lots of people have important roles to play in planning, maintaining, auditing, testing and implementing disaster recovery and business continuity procedures.
The role of the disaster recovery team
The disaster recovery team is the core of any disaster recovery or business continuity effort. DR teams fall under the supervision of a CIO or senior IT manager, known in this process as the "recovery team head." The responsibility of the recovery team head is to coordinate the efforts of its team's members and ensure an efficient BC/DR plan is in place.
Let's take a look at some other roles that are essential to success:
- Business continuity/disaster recovery planning expert: If the CIO or designated project manager is not a BC/DR planning expert, it's smart to retain a firm or consultant to provide expert insight, guidance, suggestions and technical oversight. This helps ensure that industry best practices and compliance requirements are covered, risks are adequately managed and outlays are kept in line with potential losses and exposures. This is an expert advisory role, and necessary only when the team head lacks such expertise.
- Business unit/operations stakeholders: Representatives throughout all areas of the company must be included in the recovery team, to identify key systems, services and infrastructure elements they need for recovery. They must also assess recovery testing results to see if such needs are met (and to identify and help correct oversights, omissions, errors and so forth) and to help establish recovery time objectives (RTOs).
- Network and infrastructure delivery: Key members of IT, voice, networking and infrastructure organization who will be involved in specifying communications and networking capabilities necessary for recovery must be involved in planning, maintaining and testing the business continuity/disaster recovery plan and implementation. Key players (and equally capable backups) must be identified, involved and trained on recovery tasks, processes and requirements.
- IT systems and services: Designated system experts who will be responsible for bringing systems and services back into operation during recovery must also participate in planning, maintaining and testing the business continuity/disaster recovery plan and implementation. Key players (and capable backups) must also be identified, involved and trained.
- Other support staff as needed: Trainers, writers and support staff can provide expert help in preparing business continuity/disaster recovery plan documents and training team members in their specific roles. They must also provide the documents, how-to's and checklists team members will use to guide their work, to check their results and document those results for later analysis.
It's important to recognize that even when companies decide to outsource a significant portion of disaster recovery efforts, in-house staff must still be trained and be able to step in and fulfill these roles for audit, test and implementation purposes.
Training and documentation in disaster recovery/business continuity planning
A number of software packages are available designed to assist with business continuity and disaster recovery planning, along with related design, documentation, auditing, testing and implementation tasks. Others are available from companies such as Erlogix Corp., Evergreen Data Inc., Strohl Systems Inc. and TAMP Systems. Large vendors, including Microsoft Corp., Hewlett-Packard (HP) Co. and Marathon Technologies Corp. also offer BC/DR project and process management systems.
Documentation support invariably plays a key role in these systems, and disaster recovery/business continuity templates that are available, all of which include documentation skeletons, examples, and suggested contents and details.
The key is to conduct a systematic documentation effort and for the disaster recovery team head to make sure that all personnel have ready access to simple and straightforward instructions to use during testing or an actual disaster. This means that the documentation must be complete and maintained, so that what's in writing matches what's on the ground, in the field and in people's heads. Projects with designated documentation personnel tend to achieve the best results, which is why the "other support staff" really is more mandatory than optional.
Finally, the designated individuals who must fill the various business continuity/disaster recovery-related roles can't do their jobs unless they receive detailed and useful training. Ideally, this would involve an in-depth series of introductory courses for newcomers to the recovery teams, with regular refreshers scheduled to precede periodic tests or field exercises. Such courses will often be developed in-house, though they may also be supplemented by courses from providers such as DRI International, Disaster Recovery Training Online and Mile2.com.
Given the right plans, supported by good documentation, personnel how-to's and instruction sheets, and a comprehensive body of training materials, BC/DR efforts have a much higher rate of success. The real key lies in making the commitment to doing things right, and then honoring that commitment with the initial implementation, documentation and training, as well as ongoing maintenance, testing and auditing.
Ed Tittel is a long-time freelance writer and trainer who specializes in topics related to networking, information security, and markup languages. He writes for numerous TechTarget.com Web sites, and recently finished the 4th edition of "The CISSP Study Guide for Sybex/Wiley" (ISBN-13: 978-0470276886).