The number one priority of business continuity planning (BCP) is protecting the company's most valuable assets: the health and safety of its employees. The second priority is the rapid recovery and restoration of business-critical systems. In this article, I will outline nine steps that should be taken in order to implement a successful disaster recovery plan.
Step No. 1: Getting started
Typically, the first step of BCP is organizing the BCP stakeholders and getting executive buy-in to the concept. There are several exercises moving through this process and it all depends on the level of executive support you have for this type of program and how much you have to sell them on the concept. It is important to be prepared, as you will need to justify costs. You will need to do so by presenting some number that identifies the cost of downtime and how much company revenue is at risk if business systems become unavailable for an extended period of time.
Step No. 2: Define the right plan
Defining a disaster recovery plan begins with understanding what keeps your business running and prioritizing the recovery of different systems that are most critical. This is usually conducted in the risk analysis and business impact study and you don't need to be a rocket scientist to pull this together. It is highly likely you already know and could create this list in your sleep.
Step No. 3: Learn the common mistakes and how to avoid them
There are many mistakes that are made when preparing for BCP. The most common is not allowing enough time to identify, plan or prepare for the design, implementation and exercise of the system. Regularly exercising or testing the business continuity plan can often be the most costly mistake. Just because you have successfully implemented recovery and restoration procedures doesn't mean you are done.
Every time a system update or change control process is initiated, the BCP should be retested to see if it has been impacted and still functions as designed. Do not skimp on exercising your BCP just because you can't seem to find the downtime. This is where using a virtualization platform (such as Microsoft Hyper-V) is extremely helpful, as you can spin up a virtual disaster recovery target and test without impacting the actual production system. This is accomplished through the virtualization technology that allows the machines to be segmented from the production network and create a virtual disaster recovery testbed.