Title: Disaster Recovery Plans
Course: 2016FA-MCO-110-401 > Section: Module 12: Disaster Recovery

Click here for a downloadable version of this document:(EXTERNAL) Disaster Recovery Plans

Disaster Recovery Plans (DRP) / Process

To begin creating your DRP, first identify all critical functions, and then answer the following questions for each of these critical functions:
Who is responsible for the operation of this function?

- What do these individuals need to perform the function?
- When should this function be accomplished relative to other functions?
- Where will this function be performed?
- How is the function performed?
- What is the process?
- Why is this function so important or critical to the organization?

By answering these questions, you can create an initial draft of your organization's DRP. The name often used to describe the document created by addressing these questions is a business impact assessment (BIA). This DRP will need to be approved by management, and it is essential that they buy into the plan—otherwise your efforts will more than likely fail. A good DRP must include the processes and procedures needed to restore your organization to proper functioning and to ensure continued operation. What specific steps will be required to restore operations? These processes should be documented and, where possible and feasible, reviewed and exercised on a periodic basis. Having a plan with step-by-step procedures that nobody knows how to follow does nothing to ensure the continued operation of the organization. Exercising your disaster recovery plans and processes before a disaster occurs provides you with the opportunity to discover flaws or weaknesses in the plan when there is still time to modify and correct them. It also provides an opportunity for key figures in the plan to practice what they will be expected to accomplish.

DRP Considerations

In developing your BIA and DRP, you may find it useful to categorize the various functions your organization performs, such as shown in the table provided. This categorization is based on how critical or important the function is to your business operation and how long your organization can last without the function.
Those functions that are the most critical will be restored first, and your DRP should reflect this. If the function does not fall into any of the first four categories, then it is not really needed and the organization should seriously consider whether it can be eliminated altogether.

Adapted from LAN153 (IT Security Essentials: Security+) created by Susan Sands, NISGTC which is licensed CC-BY 4.0

Objectives met:
- C12
- 12.3