This chapter is from the book
This chapter is from the book
This chapter is from the book
Disaster Life Cycle
Although the BCP deals with what is needed to keep the organization running and what functions are most critical, the DRP's purpose is to get a damaged organization restarted so that critical business functions can resume. When a disaster occurs, the process of progressing from the disaster back to normal operations include
- Crisis management
- Recovery
- Reconstitution
- Resumption
When disasters occur, the organization must be ready to respond. Table 7.3 shows a sample disaster recovery checklist.
Table 7.3. Disaster Checklist
|
Time |
Activity |
|
When disaster occurs |
Notify disaster recovery manager and recovery coordinator |
|
Within 2 hours |
Assess damage, notify senior management, and determine immediate course of action |
|
Within 4 hours |
Contact offsite facility, recover backups, and replace equipment as needed |
|
Within 8 hours |
Provide management with updated assessment and begin recovery at updated site |
|
Within 36 hours |
Re-establish full processing at alternative site and determine timeline for return to primary facility |
Individuals responsible for emergency management will need to assess damage and perform triage. Areas impacted the most will need attention first. Protection of life is a priority while working to mitigate damage. Recovery from a disaster will entail sending personnel to the recovery site. When employees and materials are at the recovery site, interim functions can resume operations. This might entail installing software and hardware. Backups might need to be loaded and systems might require configuration.
Each step might not occur in series. As an example, while the recovery process is taking place, teams will also be dispatched to the disaster site to start the cleanup, salvage, and repair process. When those processes are complete, normal operations can resume.
When operations are moved from the alternative operations site back to the restored site, the efficiency of the new site must be tested. In other words, processes should be sequentially returned from least critical to most critical. In the event that a few glitches need to be worked out in the new facility, you can be confident that your most critical processes are still in full operation at the alternative site.
Teams and Responsibilities
Individuals involved in disaster recovery must deal with many things; when called to action, their activities center on emergency response, assessing the damage, recovery operations, and restoration. Figure 7.5 illustrates an example of disaster recovery activities.
)
Figure 7.5 Disaster recovery timeline.
The salvage team is responsible for the reconstruction of damaged facilities. This includes cleanup, recovery of assets, creation of documentation for filing insurance or legal actions, and restoration of paper documents and electronic media. The recovery team has the necessary authority and responsibility to get the alternate site up and running. This site will be used as a stand-in for the original site until full operations can be restored. Although the CISSP exam will not require an in-depth understanding of all the teams and their responsibilities in a real disaster, a few additional teams and their roles are as follows:
- Emergency response team—The first responders for the organization. They are tasked with evacuating personnel and saving lives.
- Emergency management team—Executives and line managers that are financially and legally responsible. They must also handle the media and public relations.
- Damage assessment team—These individuals are the estimators. They must determine the damage and estimate the recovery time.
- Communications team—Responsible for installing communications (data, voice, phone, fax, radio, video) at the recovery site.
- Security team—Manages the security of the organization during the time of crisis. They must maintain order after a disaster.
- Emergency operations team—These individuals reside at the alternative site and manage systems operations. They are primarily operators and supervisors that are familiar with system operations.
- Incident response team—This team responds to incidents and acts as a central clearinghouse for information.
- Transportation team—This team is responsible for notifying employees that a disaster has occurred, and is also in charge of providing transportation, scheduling, and lodging for those needed at the alternative site.
- Coordination team—This team is tasked with managing operations at different remote sites and coordinating the recovery efforts.
- Finance team—Provides budget control for recovery and provides accurate accounting of costs.
- Administrative support team—Provides administrative support and might also handle payroll functions and accounting.
- Supplies team—Coordinates with key vendors to maintain needed supplies.