How To Create Your IT Disaster Recovery Plan In 9 Easy Steps

March 15, 2020

IT disasters happen every day. No one—not even a technology services company—is safe from bad patches, memory loss, or cybersecurity attacks. Not unless you’re prepared for it, of course.

If we could have one motto that underlies our entire way of approaching IT disaster recovery plans (IT DRP), it would be this:

“An ounce of prevention or a pound of remediation.”

Today, we’re going to walk through just that: how to approach IT disaster recovery plans in a way that simplifies the process for you, delegates tasks to your team, and ensures every stakeholder knows what your plan is should something go wrong.

What qualifies an IT disaster?

Anything that threatens the continuation of your IT—whether that’s daily operations, data retention, or compliance & security—qualifies as an IT disaster.

An IT disaster can be as small as bad code interrupting your ability to access a piece of information or as large as a full-blown cybersecurity breach. Both are viable for an IT disaster recovery plan. If you think you don’t need one, then you’re putting your business and your customers at risk for doing business with you.

Why write an IT disaster recovery plan?

In today’s world, creating data is inevitable. No matter how or if you store that data, it lives online and remains important to protect and retain. Some data is vital for the continued operations of your business while other is simple data used to connect better with your customers.

No matter what, the risk of not having an IT disaster recovery plan could potentially be significant, and therefore, worthy of having a plan should anything go wrong.

At its core, an IT disaster recovery plan does one thing: prepares you and your team for the following steps after a disaster—big or small—happens. It allows you to refocus your energy on proactive solutions that make steps towards minimizing the effects of the disaster rather than panicked decisions that may exacerbate the disaster. Most importantly, it empowers your team to recognize they have a significant role in supporting your business should anything go wrong.

What’s included in an IT disaster recovery plan?

There are seven main ingredients to an IT disaster recovery plan that you need to outline before you can begin writing the official document. Remember: any disaster recovery plan is part of your overall business continuity plan, therefore making it an essential document that all leadership should be aware of.

Here are the seven pieces to a well-rounded IT DRP:

1. Goals

Having a clear goal to aim towards in the midst of a disaster helps your analytic team members focus on a single point of action while supporting the emotional team members through the stress of a disaster. Your goal should include the Recovery Time Object (RTO) and the Recover Point Object (RPO); i.e. the maximum downtime allowed for each critical business system and the maximum amount of acceptable data loss, respectively.

2. Personnel

At each step in your IT DRP, delegate actions to a single person. This can be the same person repeated, but ensure that they verbally agree to taking on that role. It’s wise to delegate a backup as well, should something happen to the initial delegate.

3. IT Inventory

IT inventory includes both hardware and software. Later on, you’ll do a risk assessment of your most vulnerable positions within this inventory, so you can begin making note of that now. Ensure you also list whether they are leased, owned, or used a service, as well as where they’re stored (whether physically or within a computer system).

4. Backup Procedures

Make note of exactly where your data resources are backed up and how to recover backups—list the devices, folders, and instructions step-by-step to ensure complete clarity.

5. Disaster Recovery Procedures

List your “worst-case scenario” recovery procedures. How you respond to different kinds of emergencies in order to limit the damage as quickly as possible, including last-minute backups, mitigation, and, at worst, eradication of data.

6. Disaster Recovery Sites

Data backup wouldn’t be complete without data center backups, too. Ensure you have a remote site set-up, ready to take on your entire operations, should disaster strike.

7. Restoration

And, of course, be sure to list what recovering from total systems loss to full recovery of operations looks like, step-by-step.

Create your IT Disaster Recovery Plan

With your major key players identified and your IT inventoried, you can begin the strategic work behind creating your official document. This may take months to complete. Don’t let the length of time dissuade you from creating a robust, fully functional document, though. A well-maintained IT DRP could be the difference between minimized damages during an emergency and a total system shutdown.

Here are the 9 steps you need to take in order to create your IT disaster recovery plan:

1. Map out your assets

If you’ve been following along, this will already be mostly done. Your assets include your entire IT inventory as well as any critical data you must maintain in order to stay “live” as a business. This looks like your network equipment, hardware, software, vendors, cloud services, and the locations—both physical and digital—of all of these assets.

2. Contextualize data impact

Remember: your IT disaster recovery plan is for any employee in your business. Clearly mapping out how your assets are used and their importance can make or break this entire plan during an emergency situation. Classify the impact each asset has on your business operations by high, medium, and low impact.

3. Conduct risk analysis

Every business has its own unique set of risks it faces more often than others. The best people to help you conduct a thorough risk analysis are the people engaging with your high-impact systems daily. Ask them what are the most likely causes of interruption and how they suggest preventing that.

4. Define recovery objectives

Do you know what the impact of interruption to each of your critical systems would be for one minute, one hour, one day, or more? For some critical systems, it means the total loss in cash flow for that moment. For others, it could mean your entire data storage is wiped. Ensure you know the risk at hand to define your RTO and RPO, as mentioned above.

5. Envision your final IT disaster recovery setup

Now that you’re armed with your assets and the risk at hand, imagine what your final IT disaster recovery setup will involve. Will you need an off-site data storage center? If so, where will it be located? Self-hosted or cloud-based? Which critical systems need to be maintained and how will they be in a worst-case scenario? Do you currently have the appropriate partnerships and services to support your desired setup? If not, this is the time to consult with technology services experts.

6. Set a budget

While the price of your business’s continuity is priceless, we still all must operate within a budget. When it comes to your IT disaster recovery plan, your budget should be allocated to achieving your desired disaster recovery setup and, hopefully, your complete RTO & RPO objects. Work with your company leaders to decide on this piece.

7. Draft your plan

Work with one or two critical team members to put together the initial plan, including everything we outlined in the seven main ingredients to a well-rounded IT DRP. Get sign-off from all key members in your business on the final plan.

Everyone in your company should know what your IT disaster recovery plan is and where to access it at any given time. As the nature of IT disasters affects digital storage, be sure to have a few printed copies throughout your office or as part of your onboarding package for new employees to reference as they need it.

9. Test and review!

A theoretical IT disaster recovery plan is just as good as that: a theory. By conducting realistic drills (after a reasonable amount of time has passed since first introducing the finalized plan), you can actively see how staff act according to your plan. Don’t use the plan as a disciplinary device, but rather learn from it and modify the plan accordingly. The most important aspect of your IT DRP is reviewing the plan as often as you do your overarching business goals—roughly every six months.

Disaster Recovery as a Service (DRaaS) in Alaska

Ultimately, your IT Disaster Recovery Plan is up to you to strategize, outline, draft, and implement. Without one, your business and customers are at constant risk of cybersecurity attacks or worse. With one that hasn’t been looked at in years, your newest services and features could be at just as much risk.

If you know you need an IT DRP, but don’t know who to turn to, consider reaching out to a qualified data backup and disaster recovery specialist. Alaskan businesses have unique needs unlike any other businesses in the world, and should have just as specialized care put into their IT Disaster Recovery Plans.