Record Disaster Recovery Plan
Record Disaster Recovery Plan
Overview and Introduction
In keeping with a companies objective to develop a plan to protect corporate resources, employees, and safeguard vital and business critical records, the Disaster Recovery Plan must be senior management approved, implemented and periodically tested. The implementation of a well-organized disaster prevention/recovery plan will significantly reduce the necessity for recovery, avert the loss of vital records and information at the least possible cost, and positions the organization for immediate preparedness, response and recovery when needed.
The development of a program requires a cross-functional planning team including Records and Information Management, Information Systems, Risk Management, Financial Administration, Facilities, Procurement, Safety, Operations Managers, and various information users.
Developing a enterprise-wide Disaster Recovery Plan will also include specific provisions for each operating site. Key elements of this plan will include:
- Development of a policy statement;
- Development of a comprehensive Disaster Recovery Plan;
- Continual review of the relevancy of ongoing prevention, response, and recovery contracts;
- Periodic monitoring of potential hazards and destructive forces;
- Provisions for training employees; and,
- Continuous evaluation and testing.
Step 1: Develop a Policy Statement
In order to prepare for, respond to, and recover from a disaster, management must recognize the need, potential risk and the investment of resources required to develop a comprehensive plan. During the pre-planning stage, a cost-benefit analysis can help determine the costs of start-up and ongoing costs and the expected benefits of a program. Since it is important to gain the support of a number of key employees, they should also be involved in the initial data gathering and analysis phase. This step is followed by creating a written policy statement which defines the Disaster Recovery Plan, goals and objectives of the plan, scope, key elements and responsibilities. Senior management support and the cooperation of employees at all levels who represent all functions of the organization will often determine the success of the plan.
Step 2: Develop a Comprehensive Disaster Recovery Plan
The first step involves developing a “prevention plan” which minimizes (1) the loss of vital records and information, (2) the costly salvage of vital records information, and, (3) the delay of restoring critical
business functions following a disaster. Companies began this development through the initial step of identifying vital records during the creation of records retention schedules. The next step is to ensure that this is followed by developing the various methods of protection, as outlined in the vital records plan. Careful attention to the identification and protection of vital records will substantially reduce the risk and recovery issues to be addressed following a disaster.
Components of a Disaster Recovery Plan include:
Policy Statement – goals and objectives, benefits of plan accomplishments, to whom it applies, statement of policy, and legal authority.
Responsibilities and Authority – state position(s), responsibilities of essential positions, plan maintenance and distribution, and employees.
Task Organization – duties and responsibilities of team coordinator, response team, recovery team, damage assessment and other key positions.
Information Distribution Procedures – establish primary and secondary verbal communication linkages, written communication linkages, list communication alternatives and courier policy, procedure and contingency.
Preparedness Checklists, Response Checklists, & Recovery Checklists – preparedness steps for emergency scenarios, checklists based on types of emergencies, and task relationships, etc.
Training Programs – goals and objectives for employee training, specific training for emergency responders and specialized teams, and a plan for personnel outside the organization who have a role in the disaster recovery process.
Test Procedures – goals and objectives of conducting exercises based on emergency scenarios, schedules and plan for conducting tabletop exercises, functional exercises and full-scale exercises.
Review and Update Responsibilities – ensures that the plan remains current, establishes a team to review and update activities, schedules for routine maintenance of the plan and procedures to collect data from real or simulated events for plan modification
Communications Directory – telephone contacts, addresses, teams, inventories of vital records and supplies, key contacts, maps, vendors, equipment of various types, local contacts, media, etc.
Continuity or Succession of Authority – succession hierarchy based on team member’s availability, policy for duration and extent of authority and multiple strategies and contingencies.
Damage Assessment – assessment policies and procedures, initial and post-disaster activities, local government emergency coordinators and forms to record damage assessment information.
Financial or Funding Information – guidelines for emergency funds, tracking expenditures, petty cash funds and procedures to ensure accountability.
Step 3: Ongoing Prevention, Response, & Recovery Contracts
Positioning the company for immediate preparedness, response and recovery requires pre-planning and the establishment of contracts and vendor relationships. Contracts for recovery services, backup generators, alternative operating sites and emergency supplies help speed response and recovery efforts. These types of services require some type of contingency agreement or a retainer fee. A contact list of these contracted recovery and response vendors and any necessary equipment and supplies will be listed in the Disaster Recovery Plan.
Step 4: Periodic Monitoring of Potential Hazards
Part of the plan should provide for the continual review of potential hazards. This includes procedures for eliminating, preventing and monitoring potential hazards to the records and information, on a site by site basis. Management should assign this task to a team of employees to accomplish at least annually.
Step 5: Provisions for Training Employees
Employee and vendor training programs are necessary to prevent human error, unsafe work procedures, or carelessness during a disaster recovery. Electronic media and microforms can be easily damaged if improperly handled or stored and have specific requirements to prevent damage or loss. Effective training programs can mean the difference between an effective disaster recovery process and the total loss of records and information. With effective training programs, employees can quickly stabilize the disaster situation, begin salvage operations, implement restoration procedures and position the company to resume operations.
Step 6: Continuous Evaluation and Testing
A disaster prevention and recovery plan is only effective if it reflects the current operating environment. This includes the consistent review and updates of the plan to include such things as vital records retention schedules revisions, new information processing equipment and communication equipment, new operating locations, etc. This might include major changes to existing facility structure or layouts, or, the discovery and identification of new hazards. The plan is a dynamic, changing document which requires ongoing review and improvement to assure adequate protection.
A well-developed and implemented disaster prevention plan is a simple process of retrieving vital records and information and restoring them to the organization’s files. Disaster recovery becomes the process of retrieving the necessary information to quickly resume business operations with minimal interruption in business activities. Salvage efforts, if necessary, can then be directed toward the recovery of other important records and information.