Can you answer these 12 questions?
Disaster-recovery planning is on the boardroom agenda. But in order for CEOs to give directors conclusive answers, they first must talk at length with their CIOs. Here are 12 key questions you should be prepared to answer:
1. Tell me about our response simulation and rehearsal plans and activities. When was the last time we had a full-scale rehearsal of an IT disaster recovery?
2. What did we learn from it, and how do we learn from others' business-continuity mistakes?
3. How will our recovery plan help the company financially?
4. Have our recovery planning activities made our company more resilient?
5. How can management know how quickly we're responding in a real emergency?
6. What kind of event-monitoring system do we have to provide early warning so we don't have to invoke our emergency plans?
7. Who's accountable for IT disaster recovery?
8. How can we be sure our people are trained to respond effectively?
9. What other resources do we have for recovery other than our own staff?
10. We're prepared for hardware failure, but what about a large-scale virus or malware attack?
11. What kinds of automated response capabilities do we have to rapidly communicate status and begin response implementation?
12. Do our recovery plans extend to business-support capabilities as well as technology capabilities?
Risk Tolerance and Recovery Speed
Recovery-plan development calls for an accurate accounting of risk types, as well as an understanding of their level of acceptance and potential impact on the business. Four practical factors deserve a mention.
The speed with which business operations can be recovered, either in-house or with a third party, is directly related to the willingness to allocate resources to a specific recovery strategy.
One should select the recovery strategy based on business needs, not solely on technical or equipment manufacturers' capabilities or third-party hot-site vendors' recommendations.
When mapping business losses against recovery costs, the point at which the lines intersect may not necessarily represent the most prudent overall recovery strategy. (In other words, the mathematical result is not always the best answer.)
Supporting the chosen recovery strategy must come with an understanding of which resource will be traded off: time or money.