DRP/ECP - Plan for Quick Recovery from Disasters

Disaster recovery planning is vital as it enables businesses to recover quickly from disasters. This can be attributed to the quick response time due to the preparedness of an institution. DRP also provides an opportunity for employees to be trained on protective actions that can be vital for the protection of lives or property.

The DRP team is responsible for manages the emergencies that arise due to a disaster by facilitating the provision of emergency services to the institution (VanVactor, 2011). The team also assesses the damages caused by the disaster and initiates the recovery works that aim to ensure that the company resumes its normal operations. The team is also responsible for crisis communication where it shares the relevant information on the disaster with the public as well as the institutions clients. The team is also responsible for assisting the management in making key decisions on the resumption of business operations.

Emergency management involves the organization of an institutions resources and responsibilities in order to cover all aspects of a disaster.

Damage assessment analyzes the damage to a companys resources that has been caused by a disaster.

Restoration involves the returning the companys process into their original position before the disaster.

Salvage involves assessing the assets affected by the disaster to determine the most suitable action that can be taken on them

Customer support involves communication with the clients to give them information on how the organization will recover from the disaster

Administrative support involves liaising with the institutions administration to establish and internal support system for disaster recovery.

The disaster recovery planning teams receive adequate training to ensure that they can analyze the impact of a disaster on a business, coordinate the emergency response and evaluate the risk in order to control it. This will be beneficial in the reduction of the loss attributed to the disaster.

An institution should also develop a process of developing and delivering BCP awareness and gauging the effectiveness of the delivery. However the following aspects are very vital and universal to almost all organizations

Business impact analysis

Emergency response and operations

Incident management

Risk evaluation and control

Developing and implementing Disaster Response Plans.

Maintaining and exercising BCPs

Public relations, media and crisis communication

This is a continuation of the vital aspects that most organizations must consider before developing the training for the DPR team

The team also needs training on how to develop and implement disaster recovery plans as well as establishing business continuity plans (Gregg, 2009). This correct implementation of these plans will enable an institution to recover quickly from a disaster

Appropriate crisis communication is very vital for recovery. The DPR team has to demonstrate the strength of the institution during the crisis.

The six resilient layers aim at organizing an institution into six unique but interdependent layers which are strategy, organization, processes, applications and data, technology, and facilities and security. If an organization is examined through these layers, there is a high probability of improved visibility to potential risks (IBM, 2011).

Strategy represents the vision, policies and procedures

Organization the leadership structure of an organization and its communication protocol

Business and IT Processes defines key process that need to be maintained and the contingency plans

Data and Applications Defines data and application diversification and architectures standardization

Technology defines hardware architecture, system software, middleware, networks and security solutions

Facilities and Security describes physical security and geographic location

Strategy: there is a need for evaluation of the risks and competitiveness and vulnerabilities of the university by considering its position relative to the position of other universities.

Organization: The university needs a executive support for the plan, and for all organizational changes that the university will need for a successful DRP.

Business and IT Processes: The university will have to change some IT process in order to enable employees and students to leverage the universitys infrastructure beyond of the three-floor facilities that it has currently.

Data and Applications: Currently the university uses the Microsoft SharePoint for all data. However, for a good resilient plan, some diversification of data and application should be implemented, and high availability by implementing redundant servers across different sites also recommended to ensure that the failure in Microsoft SharePoint cannot cripple the operations of the university.

Technology: The university has only one server for each application: One Exchange Server and one SharePoint Server. The university do not possess backup servers that can be used to recover data in case of failure of the two main servers.. Thus, there is a single point of failure and its something that will be addressed in the technology layer of the Framework for Resiliency.

Facilities: There are physical risks to the operations. Earthquakes could destroy the building or knock out the power cables

External disaster recovery experts are usually more qualified and possess more experience in disaster management (Alexander, 2014).

When a company needs their skills, this qualification and experience are very vital. These experts usually have the recovery systems ready due to the nature of their business.

For businesses, it becomes very uneconomical to put recovery systems on standby in anticipation of a disaster. Due to limited resources, it becomes impossible for businesses to test their recovery plans. With outsourcing, this role is transferred to the external contractor.

Thus a business can focus on its critical business operations rather than disaster preparedness which will be managed by the external contractor.

There are some characteristics that an external contractor in disaster management should have to ensure that they can work harmoniously with an institution. These traits enable them to provide the appropriate service to an institution without affecting the day to day operations. Institutions will look at these traits before hiring the contractors

If the contractor cannot work harmoniously with the institution, then he will not be able to perform his role adequately.

These are some of the key traits

Ability to work as a facilitator whenever it is required

Ability to produce long-lasting solutions

Ability to comprehend and to further the clients mission

Making promises which can be kept

Minimizing the dependency of the client on the consultant

This is a continuation of the traits that are desirable in an external contractor in disaster management.

It is vital for the contractor to encourage the client to be committed to disaster management

The ability of the client so solve problems is a key trait that an external client must possess

The consultant must be focused at the bridging the relationship between the client and technical issues

The client must also respect the boundary between their role and the universitys inorder to work harmoniously with the institution

The university needs to consider its budget before choosing an external disaster management consultant.

Then, it will come up with a list of conditions that an expert must meet before working with the institution. The next process involves advertising to invite the interested parties to bid for a tender to provide disaster recovery services to the institution. The advert specifies the financial and technical capability of the qualified contractors to ensure that the university does not hire a substandard contractor.

After the closing of the bids, the most qualified expert is chosen to work with the institution.

Institutions are supposed to utilize their resources effectively and tendering allows the university to receive the most cost-effective consultant for the project.

It is very expensive for the university to develop its own disaster management plans. These plans need highly trained personnel whom the university cannot afford to hire.

Thus it become vital for the institution to contract the highly qualified personnel who will work on contract to provide consultation service on the design and implementation of a disaster management plan.

The contractors need to comprehend the technical issues such as the diversification of servers to ensure that a breakdown of one server does not result to the lost of clients data

A client can use the contractors servers and software for data backup and recovery especially if a business cannot afford to keep servers and software on standby in anticipation of failures.

The contractor is usually more experienced in disaster management and can perform a good role in training the DRP teams as well as all other important employees and assessing the effectiveness of the training.

After a contractor has been chosen, an agreement with the university needs to be signed.

The contract is referred to as service agreement and it is the legally-biding document between the contactor and the university.

As a contract, it has to be clear with all terms of the contract vividly explained to avoid any misunderstanding in its implementation.

The agreement has to be scrutinized clearly by the universities legal team to ensure that all terms of the document are agreeable to both the contractor and the university.

These are the most important aspects that have to be defined by the contract:

Services to be offered

Length of the contract

Rewards and penalties

The service fees for unscheduled system maintenance

Definition of mean-time-to-recover

The university has to establish the objectives it hopes to meet through the DPR awareness program. The method of implementing the program and the target audience need to be identified so that the appropriate content can be developed. After the development of the content, the program can then be implemented. In order to properly develop the awareness program the above process needs to be followed carefully

Establish goals and Components

Training the team leaders and other team members

Cover the skills gaps in the Enterprise Continuity team

Train the EC team through exercising the plan

Disseminate all information related to the Disaster Recovery Plan and Enterprise Continuity Plan and Policy, including priorities and objectives, deliverables, level of acceptance of disruption and recovery time.

Define the training/awareness method

Induction training for new hires

Articles, news and letters in corporate newsletters

Use of internal web pages, blogs and Intranet.

Conducting tests and exercises, with observers

Identify the target / audience

All stakeholders: DPR team, all employees, contractors and consultants

Implementing the awareness program

Training is one of the most effective ways of creating disaster recovery planning awareness in an institution. Training can be offered to all employees and covers all aspects of disaster recovery including protective actions and familiarizes employees with safety, the security of buildings and information as well as other loss prevention programs.