Depending on how extensive an operation’s Disaster Recovery Plan is, it may be beneficial to verify testing success through a third party. Many organizations will already have someone fulfilling the role of a semi-independent, internal Disaster Recovery Coordinator (DRC), but in certain instances a third-party assessment can add value.
A Disaster Recovery Coordinator is going to be key to preparing test strategies, maintaining test plans and overseeing the execution of a DR test. The person fulfilling this position will maintain an ongoing role with the DR program and will be qualified in establishing the standard for administering and assessing a DR test. A company may choose to rely solely on the assessment provided by their own DRC given the nature of their plan.
In other instances, an independent person, with an outside perspective may be preferred. There are valuable lessons to be learned from an independent view of test strategy and planning. An external evaluation makes sure that critical steps in the Disaster Recovery plan are not taken for granted. For instance, plan documentation may be missing crucial ever-changing technical information, and this is something an in-house Coordinator may not catch because of her familiarity only with the non-technical aspects of plan she created. External verification is meant to highlight issues like this. It is like a second insurance policy: a second set of eyes looking for potential gaps in an already well-prepared plan.
Whether verified in-house or externally, an assessment of failover success will involve a scorecard. A scorecard is an artifact that can be used by a company to measure the success of the testing process. A scorecard ranks the viability of each stage of the disaster recovery process and confirms how DR expectations can be met.
A scorecard, whether completed in-house, or with the help of an independent party should answer the following questions:
- How well the test was done? – in expected order and completely?
- Was it done on time? – were expected start times, RTOs & RPOs met?
- What were the issues? – any unexpected glitches and how critical?
- Were the issues resolvable? – any follow-up action plans and priorities?
The resulting score provides an organization with an indication of how difficult it will be to failover during a disaster. Low scores will indicate areas that are in need of improvement and high scores will indicate areas that went smoothly and are better prepared for a disaster should it occur.
Whether a company chooses to utilize an internal or external role is a decision to be made based on the depth and breadth their Disaster Recovery Plan. In either case it is most important that a company does test its DR capabilities. Only through testing and “exercising” the plan will gaps or potential problem areas be made clear, allowing for them to be remedied before a crisis happens.
