The Disaster Recovery Plan - Part 2

Disaster Recovery Process

A disaster is defined as a sudden, unplanned catastrophic event that renders the organizations ability to perform mission-critical and critical processes, including the ability to do normal production processing of systems that support critical business processes. A disaster could be the result of significant damage to a portion of the operations, a total loss of a facility, or the inability of the employees to access that facility.

The disaster recovery process consists of defining rules, processes, and disciplines to ensure that the critical business processes will continue to function if there is a failure of one or more of the information processing or

telecommunications resources upon which their operations depends. The following are key elements to a disaster recovery plan:

• Establish a planning group
• Perform risk assessment and audits
• Establish priorities for applications and networks
• Develop recovery strategies
• Prepare inventory and documentation of the plan
• Develop verification criteria and procedures
• Implement the plan

Key people from each business unit should be members of the team and included in all disaster recovery planning activities. The disaster recovery planning group needs to understand the business processes, technology, networks, and systems in order to create a DRP. A risk and business impact analysis should be prepared by the disaster recovery planning group that includes at least the top ten potential disasters. After analysing the potential risks, priority levels should be assigned to each business process and application/ system. It is important to keep inventory up-to-date and have a complete list of equipment, locations, vendors, and points of contact.

The goal is to provide viable, effective, and economical recovery across all technology domains. The following can be used to classify organization applications and/or systems:

(Mission Critical) :

• Mission Critical to accomplishing the mission of the organization
• Can be performed only by computers
• No alternative manual processing capability exists
• Must be restored within 36 hours

(Critical) :

• Critical in accomplishing the work of the organization
• Primarily performed by computers
• Can be performed manually for a limited time period
• Must be restored starting at 36 hours and within 5 days(Essential) :

(Essential) :

• Essential in completing the work of the organization
• Performed by computers
• Can be performed manually for an extended time period
• Can be restored as early as 5 days, however it can take longer(Non-Critical) :

(Non-Critical) :

• Non-Critical to accomplishing the mission of the organization
• Can be delayed until damaged site is restored and/or a new computer
• system is purchased
• Can be performed manually

The disaster recovery process will identify the risks and exposures to mitigate their consequences to a level acceptable to senior management. These risks and exposures will assist in identifying the level of recovery required. Requirements will determine which recovery strategy option is needed to support those

requirements.

source:// SANS Institute InfoSec Reading Room