DR Test Scorecard
A method of measuring success of a DR test.
DR tests are an important way for verifying that plans will work in a real disaster. They also help to train and familiarize teams with recovery processes. A scorecard can:
- track progress against target RPOs and RTOs
- drive continuous improvement by assessing the level of “quality” of advance preparations (e.g. driving a change log and action plan of “efficiency”)
- support progressive levels of testing
- and provide verification for independent audit requests.
Recovery Priorities (Tiers)
Assign criticality and achievable recovery targets for major IT services and systems, according to business continuity tolerance.
All systems are assigned a tier (include applications & technology components). Interdependencies are clearly identified between applications, between components and between applications and components. For simplicity, a Recovery Point Objective and Recovery Time Objective are assigned to each tier. Tier definitions are consistent with existing business risk – impact definitions. Tiers reflect actual ability to recover (i.e. dependent on the underlying recovery technologies).
Business Impact Definitions
Business definitions of risk-impact for determining system priorities.
Disruptions to critical business functions are defined by major category. The impact of losing a system can be mapped to the relevant category in order to assign an appropriate RPO, RTO and tier.
Incidents & Threats
Starting list of historic incidents, as well as, conceivable threats affecting IT primary and secondary sites.
List of historical incidents (when, what, impact, outage duration, actions taken, cost of recovery). Examples of conceivable threats (use historical events as a guideline for frequency).
Impacts on assets, expected outage and costs to recover (may reference business impact definitions). Linked back to technology components (as applicable).