BUSINESS RECOVERY PLANNING: DECIDE HOW THE ORGANIZATION WILL RECOVER
Recovery planning defines how an organization will restore important operations after a disruptive event.
It does not need to be a large technical document. A small organization can begin with a clear, practical plan.
1. IDENTIFY CRITICAL OPERATIONS
List the activities that must resume for the organization to operate.
2. IDENTIFY DEPENDENCIES
For each critical operation, identify important systems, information, people, suppliers and services it depends on.
3. SET RECOVERY PRIORITIES
Decide what should be restored first and what can wait.
4. ASSIGN RESPONSIBILITY
Name the people or roles responsible for important recovery decisions.
Avoid making the plan depend entirely on one person if practical alternatives exist.
5. DOCUMENT PRACTICAL PROCEDURES
Record where important recovery information is kept, how authorized people access it and what steps should be taken first.
Keep sensitive credentials out of ordinary documents.
6. CONSIDER ALTERNATIVE OPERATIONS
If an important system is unavailable, identify whether there is an approved temporary process for continuing essential work.
7. REVIEW THE PLAN
Business systems and responsibilities change. Review the plan periodically and after significant changes or incidents.
8. BUSINESS EXAMPLE
A business relies heavily on its cloud accounting system. Its recovery plan identifies the system owner, backup location, recovery priority, authorized recovery personnel and the temporary process to use if the service is unavailable.
9. PRACTICAL CHECK
- Critical operations identified
- Dependencies identified
- Recovery priorities defined
- Responsibilities assigned
- Recovery information documented
- Temporary alternatives considered
- Plan reviewed after major changes
WHY THIS MATTERS
During disruption, people should not have to invent the recovery process from scratch.
VERIFY BEFORE YOU TRUST.
Verify that the recovery plan reflects the organization's current systems, people and responsibilities.