Before Trouble Strikes - Page 2
Conduct Business Impact Analysis
The disaster recovery planning team should perform this step to identify which business departments, functions, or systems are most vulnerable to potential threats, what are the potential types of threat, and what effect would each identified potential threat have on each of the vulnerable areas within the organization.
- Identify functions, processes, and systems.
- Interview information systems support personnel.
- Interview business unit personnel.
- Analyze results to determine critical systems, applications, and business processes.
- Prepare impact analysis on interruption on critical systems.
Conduct Risk Assessment
The disaster recovery planning team should work with the organization's technical and security person to determine the probability of each functional business units' critical systems becoming severely disrupted and to document the amount of acceptable risk the business unit can tolerate. For each critical system, provide the following information:
- Review physical security, i.e. secure office, building access off hours, etc.
- Review backup systems and data security.
- Review policies on personnel termination and transfer.
- Identify systems supporting mission critical functions.
- Identify vulnerabilities, such as physical attacks, or acts of God, such as floods.
- Assess probability of system failure or disruption.
- Prepare risk and security analysis.
Develop Strategic Outline for Recovery
The steps outlined here provide all of the components necessary to perform a recovery. These steps will help pull together information about the operations of all systems, especially those owned or managed by non-technical managers with help from technical support personnel. Steps one through four mainly apply to functional business units that manage technology systems to process critical functions. The disaster planning recovery team and the functional business unit may wish to appoint other appropriate individuals to perform subsequent tasks.
- Assemble groups as appropriate for the following:
- Hardware and operating systems
- Other critical functions and business processes as identified in
- the Business Impact Analysis step.
- Light, normal, and heavy processing days
- Transaction volumes
- Dollar volume, if any
- Estimated process time
- Allowable delays (days, hours, minutes, etc.)
- Component name and technical identification if any
- Type (online, batch process, script)
- Run time
- Allowable delay (days, hours, minutes, etc.)
- Name and description
- Type (backup, original, master, history)
- Where are they stored?
- Source of item or record
- Can the record be easily replaced by another source?
- Backup and backup generation frequency
- Number of backup generations available onsite and off-site
- Location of backups
- Media key, retention period, rotation cycle
- Who is authorized to retrieve the backups?
- Type (server hardware, software, research materials, etc.
- Item name and description
- Quantity required
- Location of inventory, alternative, or off-site storage