Experts Agree You Should Update Your Plan Annually

It goes without saying that every company, regardless of size, needs a concise business continuity plan in case of an emergency. If you don't have a disaster recovery plan or haven't updated yours recently, now is the time to take this critical step to protect your business.

At the same time there are more security requirements that need to be met.  Executive management is depending on you to have the right security policies and procedures in place.

Chief Information Officers and Chief Security Officers need to have DRP and Security policies and procedures in place that address all of the issues of management and these templates meet this need.

Disaster Recovery Business Continuity Plan Creation

Budget – Step 2

Once the risk assessment (see Threat Vulnerability Assessment) is complete determine what can be done to minimize the risk and what the cost to do that will be. How does a company minimize its exposure to the threat? How does the company minimize the impact disaster event to the business? For example, our small distribution company could employ an emergency power supply to mitigate its power outage threat and have all its data backed (see Backup and Backup Retention Policy), which are stored at a remote site when the hurricane occurs. The more preventative measures you establish upfront the better. Janco Associates say, "Money spent in preparation and testing are worth more than dollars spent in recovery."

The results of risk assessment should be a comprehensive list of possible threats, each with its corresponding solution and cost. The disaster and business continuity planner must present all of these threats to the business operations management, so they can make informed decisions regarding the disaster recovery budget.  The disaster and business continuity planner needs to communicate the risks the business faces from disasters. Business operations can fail to budget funds but they must do so knowing what risk they face and accept in doing so.

A good place to begin is by presenting the cost of downtime to the business. How long can your business afford to be without its computer systems should one of your threats occur?

Ultimately, the business operations unit decides which threats the business can tolerate. When developing a DRP (see Disaster Planning Template), disaster and business continuity planners are shooting in the dark without those business indications. Both the disaster - business continuity planner and the business units must agree on which data and applications are most critical to the business and need to be recovered most quickly in a disaster. The management of our small distribution company, for example, may decide they can budget only for the emergency generators and the company will have to assume the risk of an minor hurricane.

Disaster recovery budgets vary from company to company but they typically run between 3% to 15% percent of the overall IT budget. Companies for which system availability is crucial usually are on the higher end of the scale, while companies that can function without it are on the lower end. However, these percentages may be too small.

Disaster Recovery Business Continuity Planning - Step 3