Q: What’s the similarity among wildfires in California, snowstorms in Texas, hurricanes in Florida, and ransomware attacks?
A: In case of any such natural or manmade disasters, only a Disaster Recovery and Business Continuity Plan can keep your business working continuously with minimal downtime and service disruptions.
A Disaster Recovery and Business Continuity Plan defines the procedures that need to be followed in the case of a disaster so that your business survives such an event and gets back to the pre-disaster level as quickly as possible.
In this blog, we share the steps for creating a Disaster Recovery and Business Continuity Plan for businesses.
This blog post will cover the following topics:
1. What Is Disaster Recovery?
Disaster recovery is the process of regaining access to and functionality of your IT infrastructure after events such as natural disasters, cyberattacks, or business disruptions. Disaster recovery comprises policies, tools, and procedures designed for the recovery of critical technology infrastructure and systems in the immediate aftermath of a natural or human-induced disaster.
The goal of disaster recovery is the immediate mitigation of any damage inflicted by a disaster. It aims at resolving disruption by identifying the cause of the incident and applying a fix to it. Disaster recovery plans, therefore, have to meet specific deadlines to prevent protracted downtime and damage to business in the event of a disaster.
For example, in the event of a flood, your computer systems are likely to suffer water damage. A disaster recovery plan that includes off-site system backups mitigates the risk of extended downtime by restoring your systems from the backups to a new computer.
2. What Is Business Continuity?
Business Continuity is the capability of an organization to continue its business operations at pre-defined acceptable levels even in the event of a disruptive incident. Business Continuity Planning is the process of creating systems and procedures that prevent disruption of business operations and enable business operations to continue unhindered during the disaster recovery process.
A business continuity plan describes the procedures and processes necessary to secure critical assets and continue business operations. An effective business continuity plan will help you get your critical systems back up and running quickly and limit the financial and business impact of a disaster.
Going back to the flooding examples, say your office is inundated with floodwater. In this case, your business continuity plan has to ensure that your critical business processes continue unhindered. It would, therefore, be necessary to arrange a temporary office or facilitate working from home for your staff.
3. Disaster Recovery vs Business Continuity
Disaster Recovery and Business Continuity are often used interchangeably and that can be quite confusing. Although they are different, they have significant overlaps. While disaster recovery focuses on IT infrastructure and technology systems that support business operations, business continuity focuses on keeping the critical business functions operational in the event of a disaster or disruption.
Disaster recovery can therefore be viewed as part of a business continuity plan. Continued business operations at predefined levels is the intended outcome of both Disaster Recovery and Business Continuity. Therefore, they are usually combined into a single document called Disaster Recovery And Business Continuity Plan.
4. Steps For Creating A Disaster Recovery And Business Continuity Plan
1. Gather Requirements
The first step for creating a Disaster Recovery And Business Continuity (DR/BC) Plan is to gather your business requirements. Usually, these requirements are gathered using risk assessment and business impact analysis (BIA). This helps you determine the scope and legal as well as regulatory requirements of the plan.
Here are some of the key requirements of a DR/BC plan:
Determine what needs to be protected.
Identify the scope of the DR/BC plan.
Identify the critical business areas.
Identify the critical business functions.
Identify dependencies between the business areas and business functions.
Determine the acceptable downtime for each critical function.
2. Identify Risks
Ideally, you would want your DR/BC plan to be effective against all possible risks. However, such a plan is not feasible as it would require an immense amount of resources. Therefore, you need to identify the real risks that have the greatest potential and probability to cause loss or damage to your business. The risks to your business depend on internal factors such as vulnerabilities and external factors such as cyber threats.
To create an effective DR/BC plan, you need to know exactly what you are protecting against. Here are a few examples of possible disasters that you need to prepare for:
Loss of data or system due to a ransomware attack
Loss of applications due to a server failure
Loss of business operations due to power failure
Loss of business location due to a flood
Each type of disaster that your business faces may require different kinds of remedies. The solutions can vary from creating a system-wide image-based backup to creating immutable data backups to isolated recovery environments, such as air gapping. Knowing the risks will help you choose the most appropriate backup and recovery solutions for your business.
3. Evaluate DR/BC Solutions
Once you have an understanding of what needs to be protected and against what, it is time to choose the most suitable approach.
In-house
You can operate your own backup and recovery applications and storage on an on-premises server.
Off-Site Colocation
You can create data storage and backup on a server in a different location.
Managed service provider
You can also utilize the facilities such as virtual machines, servers, and storage provided by third-party services.
IaaS
Infrastructure as a Service (IaaS) is a cloud computing service that allows you to rent or lease servers in the cloud, where you can run any system or application. IaaS also allows you to run resources such as virtual-machine disk-image libraries, raw block storage, file or object storage, as well as networking components such as firewalls, load balancers, virtual local area networks (VLANs), etc. So you can have your DR/BC system running in the cloud.
There are three main advantages of using IaaS. First, you get a guaranteed service-level agreement (SLA) both in terms of uptime and performance without having to worry about the maintenance and operations of the servers. Second, you can choose the geographical location of the server so that your business isn’t impacted by any loss of location caused by natural disasters in your area. And last but not the least, you can easily scale up or down your cloud infrastructure depending on your requirements.
Hybrid Approach
A hybrid approach comprises either two separate clouds or a combination of cloud and on-premises servers. Such an approach ensures the most secure DR/BC strategy as it avoids a single point of failure. A hybrid DR/BC system helps you achieve the industry best practice of a 3-2-1 backup strategy. It gives you the cost-effectiveness of the public cloud along with the safety of an on-prem server.
Disaster Recovery as a Service (DRaaS)
Disaster recovery as a service(DRaaS) is a third-party backup and recovery solution offered through a SaaS model. DRaaS allows organizations to back up their data and infrastructure in the cloud and provides all disaster recovery orchestrations, allowing businesses to regain functionality and access to their data after a disaster.
This is a convenient solution for businesses. As it follows a SaaS model, all you need to do is to pay the subscription fee, and all the resources, maintenance, management, and underlying processes are handled by the service provider.
4. Create DR/BC Strategies
After gathering requirements, evaluating the risks and available solutions, you need to decide your DR/BC strategy. If you require help with coming up with a robust strategy, you can refer to the DR/BC guidelines published by standards bodies such as the National Institute of Standards and Technology (NIST), Financial Industry Regulatory Authority (FINRA), and the International Organization for Standardization (ISO).
Here is a list of some of the standards and guides:
ISO 22301:2019: Security and resilience — Business continuity management systems — Requirements
ISO 22313:2012: Societal security — Business continuity management systems — Guidance
ISO 22320:2018: Security and resilience — Emergency management — Guidelines for incident management
FINRA Rule 4370: Business Continuity Plans and Emergency Contact Information
NIST Special Publication 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems
American National Standards Institute/ASIS ORM.1.201 Security and Resilience in Organizations and Their Supply Chains.
Your DR/BC must also include policies for required infrastructure that can easily scale up to support the entire workforce in case of a loss of business location. Scalability is an important requirement because dealing with an entire company trying to connect to an undersized infrastructure can turn into another disaster. If you are working with a Managed Service Provider (MSP), they can also help you develop a DR/BC strategy.
5. Determine What Employees Should Do
For a moment, let’s assume that a disaster occurred and your servers failed over successfully. But that will be of little use if your employees aren’t able to access them. Depending on the disaster (eg. flood, ransomware attack, server failure), parts of or the entire business may be out of commission for a period of time. What are your employees to do in such a situation? A disaster is not the time to start figuring out emergency responsibilities.
Your DR/BC strategy must contain a communication plan that details the methods that will be used to disseminate information and the roles and responsibilities of each individual during an emergency. The communication plan should provide clearly defined and actionable steps that the employees ought to take during any kind of disaster. Conducting training for the business continuity team and the rest of the employees is also a good idea.
6. Test Your Business Continuity Plan
After creating your DR/BC plan, you need to test it from time to time to have the assurance that the recovery procedures will work as expected to preserve business operations. The tests should evaluate the effectiveness of the recovery process as well as find opportunities for improvement.
Here are the key questions that need to be answered:
Is everything that needs to be backed up being backed up?
Is the recovery process working as expected?
Is the time taken for recovery acceptable?
Testing exercises can also help your DR/BC team become familiar with the procedures, enabling them to be better prepared in case a disaster does happen. The tests allow administrators to evaluate not just the effectiveness of the DR/BC plan but also the preparedness of the employees to handle disasters.
The frequency of testing varies with the organization. Your DR/BC team can meet quarterly to walk through the entire plan step by step. Comprehensive tests can be time-consuming and expensive to conduct and usually involve running a full BCDR test or mock drill involving all employees. Such full-scale tests can be conducted annually. Whatever be the frequency of testing, a key part of it should be to look for improvement opportunities and to update your disaster recovery process.
7. Review, Update, And Improve Your Plan
Like any other IT plan, a Disaster Recovery and Business Continuity Plan is never a static document. It will change based on changes in the technology and threat landscapes, business model, and internal processes. Therefore, your DR/BC plan should be reviewed annually to determine if the governing policies are still relevant, what should remain, and what is outdated. After every review, remember to update the DR/BC document, communicate it with all the employees and update the communication plan and training materials.
Conclusion
When business is disrupted, it results in lost revenue, reduced profits, and unhappy customers. Your best bet to avoid business disruptions and associated loss is a robust and proven disaster recovery and business continuity plan. IT infrastructure components and data are both critical for the continued operation and productivity of your business. Your recovery strategies should include not just servers and applications but also networks, wireless devices, desktops, and laptop computers.
An effective DR/BC plan provides detailed instructions that enable your business to maintain operations and services during and after a disaster strikes. It can make or break your ability to continue business operations in the case of disasters such as a flood, hurricane, or ransomware attack.
Is your business equipped to tide over a disaster? Can your business quickly recover data and functionality and resume business operations after a disaster? If you are not sure and need help developing a disaster recovery and business continuity plan of your own, reach out to us by clicking the button below and we’d be happy to help.
If you liked the blog, please share it with your friends
About The Author
Hari SubediMarketing Manager at Jones IT
Hari is an online marketing professional with a focus on content marketing. He writes on topics related to IT, Security, Small Business, and Mindfulness. He is also the founder and managing director of Girivar Kft., a business services company located in Budapest, Hungary.