Recovery Strategies and Activities
This section is specific to the strategies your business will undertake should a disruption occur, explored through different disaster scenarios, following a thorough risk assessment. Include the steps that must be taken and the resources available to implement the recovery strategy. A visualized timeline is a helpful tool in this section as it will aid everyone in understanding the process’s workflow, from initial detection through to recovery.
Individuals responsible for implementing each recovery strategy should be detailed in this section, ensuring that all contact information is up to date and reviewed regularly. Use your Business Impact Analysis (BIA) to prioritize the order of service recovery.
The appendices section is reserved for the finer details of each recovery strategy stage and is dependent on the content of the previous section. Provide all the important paperwork needed by users and any further information required to implement procedures correctly. Think of including maps of meeting points, incident report forms, declaration procedures and instructions on contacting vendors and customers.
Finish the document with an easy to use checklist outlining key action steps to guarantee that no vital stages are overlooked.
The Building Blocks for A Successful Recovery Program
If you’re already familiar with the broad principles of a BCP and have been tasked with creating a BC/DR plan for your organization then you will require a more detailed template than the one above. While it’s always best to employ expert knowledge and extensive testing when creating and implementing a BC/DR plan, it’s still possible to get the plan close to 80% viability. Sungard AS are going to share insights, gained over the last 30 years, and a detailed template that can be customized for almost any business. It will follow the same basic structure as above whilst diving deeper into the individual elements that need to be included in each section.
The introductory section should provide a general overview of all the things that can be found in the plan and any details about the entity creating the plan (i.e., the particular company, business unit, or functional area), maintenance history of the plan (i.e., when the plan was last revised and tested), the purpose of the plan, the scenarios being targeted, and any assumptions underlying the plan.
Look to cover the following points for a comprehensive introduction to the plan:
- Plan purpose
- Plan objective
- Plan scope
- Plan scenarios addressed
- Plan assumptions
Recovery Strategies and Activities
Following a comprehensive introduction are, typically, a number of segments covering the strategies outlined in the plan, any personnel involved in recovery and the recovery activities themselves. Following sections are some of the points you may wish to cover in your own BC/DR plan, though these must be tailored to specific industries and risks.
- Recovery Strategy Summary: outline the broad strategies to follow in each disruption/disaster scenario identified in the introduction section.
- Recovery Tasks: provide a list of specific recovery activities required to support the strategies outlined above; these may be things like supporting equipment or emergency transportation.
- Recovery Personnel: a good BC/DR will identify specific people involved in continuity and recovery efforts, detailing contact information that’s updated regularly.
- Plan Timeline: successful BC/DR plans usually need to be activated promptly. A flow chart/timeline hybrid might start at the incident, go into personnel response, highlight any decision points, before ending with recovery time objectives.
- Critical Vendors and Their RTOs: list all vendors, daily operations, recovery strategies, and any required time objectives that vendors must meet for the BC/DR plan to be successful.
- Critical Equipment / Resource Requirement: consider detailing resource quantity requirements that must be in place following plan activation and their timeframes. This may cover workstations, laptops, phones, and more.
This section is one that is most specific to an organization the BC/DR plan is created for, making generalities and standardizations difficult. Nevertheless, consider this section all about the details; it’s your chance to include anything specific to a successful and swift recovery. Some possible sections to cover follow.
- Business Continuity Site Information: if you plan on relocating to a temporary work location following a disruption, then it’s a good idea to include all the information about the alternate site here. Look to cover details like commencement date, office specifics, and contact details.
- Maps of Meeting Points: plans that specify a meeting location for employees should be inclusive of easy to read maps and routes.
- Vendor Contact Information: list all critical vendors and their contact information.
- Forms: all relevant forms (incident reports, manual purchase orders, etc.) can be located here for ease of access.
- Communication Plans: it’s always a good idea to assign communications to a few dedicated employees alongside details of the groups or constituents they will be communicating with, covering internal and external communicators. List their details and contact information, ensuring to update it regularly.
- Disaster Declaration Procedures: if BC/DR vendors are contracted, then it’s vital to list their details and recovery procedures in an easily accessible place.
- Employee Contact Information: should detailing employee contact information in the Recovery Strategies and Activities section to grow too long (as it can in large organizations), use the Appendices as an alternate location alongside any phone tree procedures or call lists.
- Process Flows: plan activation usually means employees have to follow alternative processes and procedures – the plan Appendices should be used to list all out-of-process flows and procedures to ensure compliance.
- Checklists: easy to follow reminders and checklists will be welcomed by anyone involved in disaster recovery efforts. With stress levels high, it makes sense to offer prompting lists that can be checked against the longer plan.
Beyond the BC/DR Template
BC/DR templates are a great starting point for many businesses looking to futureproof their work and companies. Nevertheless, it’s just the first step in what is usually a multi-channel effort that encompasses multiple plans and requires engagement from business and technical stakeholders to ensure that those plans help you get the best outcomes.
Successful BC/DR plans aren’t simply about compliance and the present. They must look to the future with the confidence and knowledge that evolving threats will be accounted for with conscious and ongoing efforts. Think of success as engaging stakeholders, guiding the next best action, adapting dynamically to change, and feeding insights back into the planning cycle. Only the right combination of knowledge and confidence can deliver the desired results.