A disaster recovery plan (DRP) - sometimes referred to as a business continuity plan (BCP) or business process contingency plan (BPCP) - describes how an organization is to deal with potential disasters. Just as a disaster is an event that makes the continuation of normal functions impossible, a disaster recovery plan consists of the precautions taken so that the effects of a disaster will be minimized and the organization will be able to either maintain or quickly resume mission-critical functions. Typically, disaster recovery planning involves an analysis of business processes and continuity needs; it may also include a significant focus on disaster prevention.
|
|
| Business Continuity Outline of Concepts |
|
|
| + |
This example is meant to convey the typical content of a detailed contingency plan. The format will vary for each organization. (There is no one size fits all plan.) Components may be combined in lists, matrices, or charts. Not all components of this outline will apply to all organizations. The planning process is in the development of the contingency plan not just the documentation of the plan. Contingency planning should be a process and not just a one-time start stop project. To be successful it must be driven and supported from the very top of the origination. Contingency planning is a management process it is not a technical solution.
|
| I. |
Initiation |
|
Work group or team membership and objective
- Roles and responsibilities for planning, plan approval, and quality assurance
- List of services confirmed as vital
- Strategy and schedule for planning
- Contingency planning processes and protocols
- Progress reporting
- Plan review
- Plan approval
- Issue resoluction process
- Communication and coordination strategy with relevant intra and inter-agency
organizations (including local government and community organizations)
- Affirmation of executive support
- Assessment of current disaster recovery or emergency preparedness plans
|
| II. |
Business Impact Analysis |
|
- Minimum Acceptable Levels of Service
- List (or matrix) of service dependencies
- List of service interfaces
- Commitments to other organizations (specific services and service levels)
- Minimum acceptable levels of service and/or output which could be tolerated
under extraneous circumstances
- List (or matrix) of components critical to support minimum levels of service
- Executive approval for mimimum acceptable service levels
- Failure scenarios (potential risks)
- Window of vulnerability (time perios during which the service may be at
risk)
- Assessment of internal remediation effort status and likeliehood to be
complete on time
- Assessment of reliance on, and condition of extrenal services, suppliers
and dependencies (confidence in continued availability or resource)
- Potential failure scenarios with likelihood of occurrence
- Impact of each failure scenario on vital business services with likelihood
of occurrence
- List or matrix of impact of each scenario on vital business services with
likelihood of occurrence
- Services for which contingency plans will be developed
- List of services and the scope of contingency required (specific components
or systems supporting the service that require contingencies)
- Excecutive approval of contingency scope
|
| III. |
Contingency Planning |
|
- Relevant contingency efforts of local and/or regional partners
- Contingency strategies
- List of services, components (if applicable), considered contingencies
which support them and the benefit of the contingency
- Considered contingencies and required resources
- Assessment of considered contingencies
- How well do the contingencies mitigate risks of disrutption to service?
- Assessment of time required acquiring, testing and implementing the contingency
- Sustainability of contingency within resources constraints
- Executive approval for contingency strategies
- Detailed contingency plans (for each contingency)
- Contingency obhective and scope
- Contingency triggers
- Schedule for preparation and deployment of contingency
- Monitoring strategies to ensure identification of triggering events
- Roles and responsibilities for contingency preparation and deployment (including
updated contacts, contact mechanism and numbers)
- Status reporting processes and protocols
- Instructions to carry out contingency
- Coordination strategy with local and regional organizations (if applicable)
- Requried resources and estimated costs
- Agreements and assumptions with suppliers on whom each contingency is dependent
- Communications strategy
- Business resumption strategy
- Criteria for business resumption
- Priorities, processes and resources for business resumption
- Roles and responsibilities
- When to resume
- What to resume
- How to resume
- Validation/testing strategy for contingencies and business resumption
- Which components will be tested?
- Members of test team(s)
- Validation/testing plans
- Objectives
- Approach
- Required equipment and resources
- Necessary personnel
- Schedules and locations
- Procedures
- Expected results
- Acceptance criteria
- Validation/testing results (Assessment of capability of contingencies and
business resumption)
- Adequacy to support vital service
- Capacity to manage, record and track contingency activities
- Adequacy of controls
- Adequacy of resource availability to implement and sustain contingencies
- Adequacy of business resumption activities
|
[ back to top ]
|
