Disaster Recovery Plans -
A Guide

Disaster Recovery Plans do sound like a lot of work, particularly when you don't know where to start or how to break it down into manageable chunks. This guidance is meant to offer some pointers on how to begin to tackle this daunting but crucial issue. Half the battle is knowing where to start and where you need to get to.

The commitment for the creation of Disaster Recovery Plans needs to come from the top of the organisation. Like your Fire Risk Assessment, it can't be rushed. You need to allow the appropriate amount of time and allocate a sufficient staff resource to handle it properly. Alternatively, allocate financial resources and seek the help of a Health and Safety Consultant.

Disaster Recovery Plans Help to Prevent Disasters

If you work through your Fire Risk Assessment and the various sections under the Fire Safety section you should be well on the way to drastically reducing the chances of ever being faced with the consequences of a fire in your place of work. However, not everything is within your control and it is sensible for all businesses to have Disaster Recovery Plans in place to set out the steps required to get the business back up and running following a fire, or indeed any other such disaster.

The process of preparing Disaster Recovery Plans will itself put your business in a stronger position, because it will make you focus on any areas of weakness where your recovery would otherwise be difficult. People who prepare Disaster Recovery Plans gain a greater understanding of where their business is exposed if the worst should happen, so they are able to take precautions and remedial action in advance. These precautions may not stop the disaster happening, but they will make it much more possible for your business to make a rapid and full recovery.

Are Disaster Recovery Plans the Same As Business Continuity Plans?

Your Fire Risk Assessment and Fire Safety work are an important part of Business Continuity Planning, because they are helping to ensure that you don't have a disaster in the first place. Business Continuity Plans are about what you can do to mitigate risks to your critical business functions rather than just focussing on the worst case scenario of the disaster actually happening.

Disaster Recovery Plans are concerned with what you need to do when the proverbial hits the fan and the worst actually does happen. Our focus here is with fire, but you need a plan that will apply to any disaster that wipes out your premises, or even just a small but vital part of your premises, such as your IT kit. Often you will find the term Disaster Recovery Plan used to refer specifically to an IT or data loss disaster

Disaster Recovery Plans - Not Just Another Pile Of Paper

One of the benefits of preparing Disaster Recovery Plans is that they will tell you what you need to actually do now to protect your business. You lose many of the benefits of Disaster Recovery Plans if they are just created as something to be seen on the shelf when the rep comes round from your insurance company.

Bear in mind that Disaster Recovery Plans should protect people first and foremost - a major fire could destroy not just your business, but the personal lives of your employees and their families.

Disaster Recovery Plans - Finding Your Critical Functions

What can your business not function without? You need to think about all your business functions and systems, and identify the things in your business that are essential to your operation. You need to know what they are, even if you then decide they are things that do not actually require further action to safeguard them.

Prioritise your different areas of business in terms of what the cost is going to be if they are non-operational. Are there things that, if you don't do them, you may be liable for costs in addition to simply lost revenue?

Even in a limited fire that was quickly brought under control, you could lose all your IT data if you do not duplicate it off site. What would the impact on your business be if that happened?

Data is important to all businesses these days, to some it is everything. Get it out of the building! Either back files up automatically to a completely separate location, of do daily backups and then remove them from the building each day to a separate place for storage.

How much data can you afford to lose in terms of time? If you lost one day's worth of data would that be OK or a disaster? The answer may be minutes rather than days for some applications. Either way, you need to know what your parameters are and protect accordingly. If you have some systems where you can't afford to lose even a few minutes of data, then that is perfectly possible, with 'real-time replication' of your data, resulting in almost zero data loss. See the separate section on Data Recovery Services.

You may well have documents or files that are critical to your business, but which you need to keep on site. If you can't keep regularly updated copies elsewhere, then you need to look at fire proof safes or boxes. These might include things like insurance details, accounts information, personnel files, a copy of your Disaster Recovery Plan, etc.

You should seriously consider setting up a Recovery Box to be stored off-site, which would contain a lot of basic but essential paperwork and equipment that you would need in order to begin functioning if your usual premises were destroyed or out of action.

What Should Disaster Recovery Plans Include?

• Identify specific risks and their impact on your business. Carry out a Business Impact Assessment and Risk Assessments. This should form a good basis for focussing the needs of the disaster recovery plan. Look at the risk and determine what the consequence would be to your business if it actually happened?


• Think about your critical functions. What can you do to protect them now, and in the event of a disaster, how would you recover them?


• What constitutes a disaster - define the conditions for the Disaster Recovery Plan coming into action.


• Have a pre-arranged place that your team will meet to discuss future action. There will need to be an initial evaluation of the disaster - define the crisis management team.


• Decide team responsibilities. Who is the Crisis Team Leader? List actions to be taken and timescales.


• If possible have an agreement for temporary office space in the event of a disaster.


• Create Staff contact lists with address and at least two phone numbers. What would the chain of communication be immediately after a disaster? How would you and others find out and how would you contact everyone else?


• Have a list of your critical customers.


• What customers will you need to contact, who will do this?


• Provide lists of suppliers you will need to call on who can provide essential equipment at short notice. Consider IT (hardware, software, cabling), Telecommunications (phones, fax, phone lines), photocopier, furniture, stationary, kitchen equipment, etc.


• List all of the resources and equipment that will need to be acquired.


• Create checklists of tasks that need doing in the event of a disaster. These should list specific tasks that need to be carried out, with room for deadlines and ticking off when accomplished. These should be assigned in advance to specific, appropriate people as their responsibilities.


• Decide who will deal with press and media enquiries, or public concern.


• Make sure a copy of your Disaster Recovery Plan is available off-site, preferably in a Recovery Box with other essential equipment and paperwork.

If this still seems very daunting and does not leave you feeling like you could happily tackle a plan from scratch, there are various types of Disaster Recovery Planning Software on the market that can help by building your information into a per-designed structure.

© copyright Fire-RiskAssessment.com 2008-09