Documentation, of any sort, can be a pain to do, but essential. This is especially true in IT where change is constant. That is the nature of technology, isn’t it? Because your business is highly dependent on IT services, fast recovery of those services are vital and rely on clear concise instructions to do so. When disaster strikes, who will be available to save the business, and what stress will they be weathering? Can they read between the lines, if the odd step is missing? Will they be able to make tough, on-the-spot decisions? What if cell numbers or passwords have changed?
Why Documentation?
A clear set of instructions is usually backed-up by complete, accurate and up-to-date IT documentation. An effective DR or Business Continuity program is dependent on documentation for several reasons:
- Clear, concise guidance at-time-of-disaster – especially when IT staff are absent
- Training and awareness
- A way to regularly check preparedness level, and
- If needed, regulatory proof of preparedness.
Four Key Needs
At-time-of-disaster, one cannot assume the “A” team is available. Those not normally run IT may be required to recover systems. If that is the case, contractors or backup staff members may assist with recovery, even though not intimately familiar with the procedures. Minimizing the number of decisions to be made, especially unanticipated ones, will be safer – less moving parts to break. Recovery teams should work through “set” plans. That means checklist-style, sequential, step-by-step directions, with visual indicators of steps done and prescribed ways to deal with exceptions – as they invariably happen. Instantaneous access to relevant “as-built” information may be welcome also, if not a life-saving bonus. If your recovery process works only partially, can your business services work partially too?
Training materials and awareness programs are dependent on detailed plans. If there are no plans, there’s no easy way to bring new members up-to-speed or to build support for sustaining the program during the quiet times. As the recovery team is assembled, primary and back-ups are identified. Following creation of initial recovery plans, the main contributors intimately familiar with the key procedures and critical decisions. That may not be true, six or twelve month later, or when things change, especially team member roles. Also, having a well-documented disaster recovery strategy and action plan helps demonstrate the importance and business-like commitment to continuity for all stakeholders within earshot. Having a means to reconcile DR roles to existing job descriptions, or DR procedures to existing operations processes makes it much easier to embed a more-resilient mindset into an organization. People become supporters of the program when they understand the value of their contribution and are comfortable with their expected role. Then, it becomes easier to prime recovery teams, bring new members on-board and integrate DR touchpoints naturally into the daily routine to keep plans “fresh”.
Self-checking preparations also requires good documentation. At times, you will need to expose plans to review and scrutiny just to build-up confidence. This could include leveraging DR procedures and processes to do internal exercises (“tests”) for increasing familiarity, and confirming currency and completeness. Checking plans on a scheduled basis also helps keeps the organization vigilant and disaster-ready. The involvement of not only recovery team members, but management, colleagues and customers can keep everyone in a ready-to-go state. Periodic testing of processes verifies appropriate investments were made and kept-up.
Proof or substantiation of your plans may be required too. By law, regulation or even customer agreement, government, regulators or industry associations may ask to see it. To satisfy those requirements, as they come up, it’s always advantageous to have something tangible handy. Sufficient evidence of intent will be necessary to respond to 3rd party audit requests. Documentation of DR processes and procedures will need to be shown.
It’s a Challenge
Due to the rapid pace of change of IT, business and suppliers, DR plans are always difficult to maintain. They require details and lots of effort to keep up-to date. Scarce resources and budget, coupled with a lack of immediate, quantifiable benefit are hurdles for sustaining DR. For savvy IT management, the first step is keeping track of the most important moving pieces (such as, current exposures, priorities, assets, configuration changes, etc.). Then it involves capturing the information to update the core DR planning elements. Essential updates need to be made to maintain the currency and effectiveness of any DR plan.
