Disaster Recovery Planning

Disaster Recovery plan must address the following,

  1. Contain measures which address the impact and magnitude of loss or harm that will result from an interruption;
  2. Identify recovery resources and a source for each;
  3. Contain step-by-step implementation instructions; and
  4. Include provisions for annual testing.

Disaster Recovery Plan Template

Testing Methodologies:

As per TAC 202.74 Business Continuity Planning, DRPs must to be reviewed and tested annually.

Below are some methodologies that can be used to test DRPs. Walk-through + Checklist or Table-top simulation are most recommended to test DPRs. Please select a methodology that fits best with your business functions.

Walk-through:

Disaster recovery team members meet to verbally walk through the specific steps in departmental Disaster Recovery Plan (DRP)

Checklist Testing:

  • Used to determine if everything is setup properly in the event the DRP is activated.
  • DRP is reviewed by recovery personnel to ensure information is correct
    • For example:
    • Call tree verification
    • Key procedure validation
    • Hardware and software configuration documentation complete and current
    • Equipment, supplies, manuals are available
    • Copies of plan are with appropriate individuals/locations.

Table-top Simulation:

  • Test is more in-depth than walk-through or checklist but without interruption to normal business.
  • Testing is scenario based (recovery team simulates a disaster), taking into consideration the purpose of the test, objectives, type of test, timing, scheduling, duration, participants, and test steps.
  • It may involve role-playing and actual physical testing of alternate sites and equipment, as well as coordination with extra-departmental personnel such as vendors and Information Technology Services.

Full Interruption:

  • Actual production data and equipment are used to test the Disaster Recovery Plan.
  • This may involve anything from testing the recovery of a single application to the entire operation.
  • Potential to disrupt business operations and carries its own measure of risk.
  • Can be time-consuming and costly
  • It is recommended that this type of testing be used only after careful consideration and with extreme caution.