Do You Test Your Disaster Recovery Plan?

You Must Ensure the Recoverability of Your Critical IT Infrastructure!

If it were possible I would ask for a show of hands, but it’s not, so let’s pretend.  How many of you have a disaster recovery plan?  By a disaster recovery plan I mean a formal documented plan that would allow you to recover your critical technology assets. I mean a specific plan to recover the systems, the applications and the data?  Oh yeah, don’t forget ALL the platforms, the desktops and the telecommunications environment – voice and data.  How many of you test the DR plan?  Do you bring the entire critical Information Technology environment up to ensure it would work if need be – from the ground up?  How many of you test more than once a year or when technology changes?

If you raised your hand to all of the above, congratulations – you are definitely in the minority.  Depending on what survey you read, very few organizations that have a plan test their plan – especially the small / medium businesses.  Fewer yet, regardless of size, actually identify measurable test goals and objectives and/or track the results.

When you factor in Symantec’s 2009 disaster recovery statistics – 25% of all disaster recovery tests fail, and only 15% of those surveyed indicated they have never had a test fail.  If you have never tested – your odds of full recovery are not good, especially in a timely fashion.

When you consider an event that requires the actual restoration of businesses information technology that supports the critical business functions; not having tested the restoration process is a scary thought.  Are you the one who would have to explain to senior management that you were unable to restore the technology environment to the level the business units and clients were expecting?

Testing is the ONLY way to ensure the recoverability of your critical infrastructure!  IT-Lifeline clients that test prove that every day.  They are ensuring the recoverability of the technology it would require to support their organization and thus their customers, should they experience a business disruption that affects their technology assets.  Can you say the same?

My Part in the Emergency Operations Center – Valley View Wildfire

The Real Thing – This is Why We Practice!

Last Thursday, July 10th, I had the opportunity to sit in the Spokane City/County Emergency Operations Center and observe the professionals working the Valley View Wildfire (link to video footage). There were a lot of positives that came together during the event but some lessons learned as well. When you consider that most of those folks deal with emergency responses for a living, you would think that most of the issues that surfaced should have been addressed in the past, either as the result of past emergencies or through the regular training exercises these folks conduct. From my observation, though, what it came down to was the proverbial left and right hand not knowing what the other hand was doing – not a lot of it mind you, but enough to raise one’s eyebrows.

The big question for me as I look to the private sector is, if the real professionals have challenges during an emergency, what would it look like from an individual’s company’s perspective following a major business disruption? Are you prepared? Would communications flow freely? Could you respond to a business disruption? Could you resume your business? Recover your business over time? Unless you test your plan (assuming that you have one), you will never know! My theory is, better to find out during an exercise vs. during an emergency. If you are not going to make the effort to exercise your plan – good luck following the disruption we all hope never occurs.