1. Implementing Disaster Recovery Plans
Chapter 9

2. You Will Learn How To… Develop an implementation plan
Assign responsibilities for implementation
Establish an implementation schedule
Distribute the disaster recovery documentation
Assess the value and effectiveness of mitigation steps
Manage internal and external awareness campaigns
Launch a training program for disaster recovery

3. Developing an Implementation Plan
Implementation plan affects all the departments in an organization
The plan must be managed step by step, and progress must be evaluated on a scheduled basis
Implementation plan requires training for all employees, and might require new equipment and procedures
Events occurring during implementation
Responsibilities for implementation are assigned to members of the disaster recovery planning team and departmental groups
An implementation schedule is developed, with timelines and planned progress evaluations
Disaster recovery documentation is distributed to everyone who needs copies, or online access is provided
The value and effectiveness of mitigation steps are assessed. New mitigation steps could be put into place, and existing steps may be modified
The organization plans and launches internal and external awareness campaigns
The organization develops and launches employee training programs for disaster recovery procedure

4. Developing and Implementation Plan
Organization wide activities may include raising awareness and training
Deployment of equipment and other like actions may need to occur at the facility level
The departments and work groups affected by new or changed procedures must make these changes or additions

5. Organizational levels for implementing parts of the plan

6. Assigning Responsibilities for Implementation
The disaster recovery planning coordinator and planning team assign responsibilities for implementing the plan
The coordinator takes the lead in monitoring and evaluating the progress of implementation
The activities involved in implementation include directing management to establish liaisons with law enforcement and emergency services
Managers need to assign activities to employees
Department work groups implement the aspects of the plan that impact their department
Activities include changing existing procedures and evaluating mitigation steps, as well as developing new mitigation procedures to support recovery priorities in the plan

7. Assigning Responsibilities for Implementation
The Purchasing Department takes the lead in processing all paperwork necessary to acquire equipment necessary to implement the plan
If the new equipment is used only in one department, that department may install the equipment
New contracts needed for the recovery must be developed by the department with the Purchasing Department, and ensures fees and retainers are paid
Solid liaisons must be established with law enforcement, emergency services organizations, and contractors
Disaster recovery coordinator, facility managers, and disaster response team work to establish these liaisons, as well as maintain the relationships over the long term

8. Implementation activities

9. Implementation tasks
Many activities may be broken down into specific tasks assigned to employees or departments that are not part of the planning team

10. Establishing an Implementation Schedule
Disaster recovery planning team establishes an implementation schedule for completing each activity in the plan
Available resources, geography, and other factors will influence the speed of this schedule
The disaster recovery planning coordinator and planning team must monitor the progress of the implementation
A monthly report of accomplishments and activities that are behind schedule should be compiled by the coordinator
The team may modify the schedule as conditions warrant, or suggest acceleration to various departments
The planning team should bring obstacles to the attention of executives so that the obstacles can be cleared by the influence of the executive

11. Sample implementation schedule

12. Distributing the Disaster Recovery Documentation
The plan must be distributed during the implementation, rehearsal and testing phases
Disaster recovery plan documents include all the written analyses, policies, and procedures that employees and contractors should follow when responding to a disaster
Organizations should not rely on just one method to make documents available to response teams
As long as the intranet web servers function, they are acceptable for distributing disaster recovery plan documents
Each distribution method has unique advantages and disadvantages

13. Distribution alternatives

14. Assessing the Value and Effectiveness of Mitigation Steps
Mitigation steps are used to reduce the impact of system failure or disruption of operations
Many of these steps are common practices for managing assets or business processes
Such steps include backing up computer files to mitigate the consequences of disk or system failure
The exposure inventory and risk assessments collected information on mitigating and avoiding business disruptions
All mitigation steps must have a sound economic value
Table 9-6 illustrates that if power is lost nine times per year, the return on investment (ROI) for using a UPS to protect the server is about 15 months

15. Analysis of the value of UPS

16. Assessing the Value and Effectiveness of Mitigation Steps
Determining what kind of data back-up systems an organization should use is more difficult than analyzing the benefits of a UPS
System backups are certainly necessary to preserve computer files and databases
The selection of particular back-up systems depends on a number of factors

17. Analysis of the value of data backup systems

18. Assessing the Value and Effectiveness of Mitigation Steps
After determining how much money could be saved
The planning team can examine what types of data back-up systems to put in place
How much the organization should spend for them
The planning team should address several questions before selecting a back-up system
How resilient to failure is the back-up system?
Can it be used for more than one system or application, thus improving ROI?
What level of disaster does the back-up system help mitigate (e.g., catastrophic, major, or minor)?
How much does it cost to deploy the back-up system?
How much IT staff time is needed to maintain the back-up system?
The planning team should use ROI analyses to evaluate mitigation steps that make economic sense

19. Managing Internal and External Awareness Campaigns
As an organization develops and implements a disaster recovery plan, it needs to make employees highly aware of the plan
During training, employees should learn the details of the plan and learn their roles and responsibilities during disaster response
The goal of the awareness program is to indoctrinate employees about the importance of disaster response and recovery
Depending on an organization’s resources, there are several ways to increase awareness during plan implementation

20. Using Existing Channels of Communication
Organizations often have employee relations programs, customer relations management systems, and business partner communications that can help build awareness
Some forms of communication include
Employee newsletters
Bulletin boards
Motivational posters
Intranets with employee information sections
announcement lists
Customer relations newsletters and bulletins
Business partner Web sites
Corporate Web portals with sections for employees, customers, and business partners

21. Building Awareness Among Employees
Organizations can use regularly scheduled department or work group meetings to call attention to disaster recovery planning efforts
A series of announcements that department managers and supervisors can use in their meetings may include
A basic description of disaster recovery planning
The mission statement of the planning team
The status of disaster recovery planning
The status of implementing the recovery plan
The schedule for disaster recovery training
The schedule for testing recovery procedures

22. Building Awareness Among Customers and Business Partners
Managers of the Customer Relations Department can build awareness among customers through newsletter articles, bulletins, or announcements at meetings
Channel managers or product managers can build similar awareness among business partners
Bulletins and announcements to both customers and business partners should include the following materials
Basic description of disaster recovery planning
How the organization works with customers or business partners to develop recovery procedures
How the disaster recovery plan can benefit customers or business partners
What customers or business partners can expect when a disaster strikes
Basic steps for customers or business partners to follow in a disaster

23. Launching a Training Program for Disaster Recovery
The scope and depth of the training program depend on the size and type of the organization
Training must be developed for several levels of employee involvement
Training with local emergency organizations is also advisable
General broad training should be developed from the overall plan, for managers, supervisors, or all employees
More specific training modules directed toward middle managers, supervisors, and disaster response teams
These modules include training on how teams should be organized, along with activities that require managers and employees to be involved
Some specialized training may also be necessary for certain special procedures

24. General disaster recovery training modules

25. Specialized training modules

26. Training modules for special disaster recovery procedures

27. Elements of Disaster Recovery Training Modules
Most of the material required to develop a training program should already be included in the disaster recovery plan
The plan documentation may not always be easy to convert to training material
The training modules should contain several elements that are presented in different formats

28. Elements of disaster recovery training modules

29. Launching a Training Program for Disaster Recovery
The disaster recovery planning team should watch and approve training presentations before they are given to the entire organization
Overheads and slides used during disaster recovery training should look professional and be easy to read from all parts of the training rooms
When trainers use sections of the disaster recovery plan in their training, they should organize the sections separately for each training module
An evaluation form should inquire about the overall quality of the training, as well as the quality of materials used during training
The overview of the recovery plan is designed for all employees, and should be included in all training modules
The overview should last about one hour; it should focus on what is expected from employees during a disaster, and how they should report to supervisors or middle managers

30. Training for Executives
Training modules designed for executives should be tightly structured
It should include only as much detail as necessary to explain what is expected of them during a disaster
Table 9-12 shows a recommended training session for executives
The training is designed so that sessions can be held independently, grouped for the convenience of executives, or delivered in a single day

31. Disaster recovery training for executives

32. Training for Middle Managers
Middle managers generally have far more extensive roles in disaster response and recovery than executives
Their recovery training needs to cover topics in greater depth
Table 9-13 shows a recommended training session for middle managers
Sessions can be held independently, grouped for the managers’ convenience, or delivered in a three-day training session

33. Disaster recovery training for middle managers

34. Training for Supervisors
Supervisors generally have more extensive roles in disaster response and recovery than executives
They work under the direction of middle managers to implement procedures or support a specific response team
Disaster recovery training for supervisors needs to cover the same topics as that for executives, but not in as much depth as the training for middle managers
Table 9-14 shows a recommended training session for supervisors
Sessions can be held independently, grouped for the supervisors’ convenience, or delivered in a one-day training session

35. Disaster recovery training for supervisors

36. Training for Disaster Response Teams
Training specific response teams is the most complicated aspect of disaster response and recovery training
Response teams must be trained on much of the same material as executives and middle managers
They must be extremely well trained in their own roles to ensure that disaster response proceeds smoothly
Training modules for specific response teams should provide in-depth coverage of procedures, so that team members fully understand their responsibilities in a disaster
All response team members should attend disaster recovery training for middle managers, as well as specialized training designed for their team
Table 9-15 shows recommended training sessions for specific disaster response teams

37. Training sessions for specific response teams

38. Training for Employees
All employees should be required to attend training that is appropriate for their management level and participation on response teams
Disaster recovery coordinators should work with the Human Resources and Training departments to ensure that trainers receive a list of all employees who are scheduled to attend specific modules
Trainers should record attendance on a class roster and return it to the office that schedules training

39. Chapter Summary
The implementation plan affects all the departments in an organization
The plan must be managed step by step, and progress must be evaluated on a scheduled basis
The activities required to implement a disaster recovery plan range from directing management to establishing liaisons with local law enforcement and emergency services
The disaster recovery planning coordinator and the planning team assign responsibilities for implementing the plan
The coordinator takes the lead role in monitoring and evaluating the progress of implementation

40. Chapter Summary
Once responsibilities have been assigned for specific activities and tasks, the disaster recovery planning team needs to establish an implementation schedule for completing each activity in the recovery plan
The disaster recovery plan must be distributed and made available during implementation, test and rehearsal steps, and thereafter
Organizations should not rely on just one method to make documents available to response teams

41. Chapter Summary All mitigation steps must have sound economic value
As an organization develops and implements a disaster recovery plan, it needs to make employees highly aware of the plan
The disaster recovery training plan is an essential element of being prepared for a disaster
The scope and depth of the training program depend on the size and type of the organization
Training must be developed for several levels of employee involvement
Training with local emergency organizations is also advisable