DR/BCP Make it Simple

By Norman L. Harris, CBCP, CRP and Tracy Cowan, CBCP, CRP

In today's fast paced, highly competitive, technology driven and profit motivated business world, we all find ourselves part of, almost no organization can afford to close their doors even for a short period of time, let alone a long period time for any reason. When that reason is because some catastrophe event has rendered their facilities, their computers, their networks or some other critical resource they depend on everyday in order meet their service level commitments to their customers and/or clients unavailable that organization is in big trouble. This is true even if they have a recovery plan and even more true if they don't have a plan. No organization of any size can afford to be without a Disaster Recovery/ Business Continuity Plan because that would almost certainly mean closing the doors forever.

The plan should be looked at as a tool, a guideline, a means of bring order to an out of control situation which contains critical information, documented correctly, that if followed by the right people will get the organizations doors open again with a minimum of service interruption. The plan should contain a simple set of tasks that when executed according to an agreed upon time line (Recovery Time Objective), will allow the organization to get back in business within an acceptable time frame.

It takes a lot of planning and execution to make sure the Recovery Time Objective can be met. The legendary Woody Hayes, long time football coach of The Ohio State Buckeyes, was often quoted as saying, "You win with people". This quote is very true when it come to many things and more than ever when it comes to recovery planning. We must remember that "People recovery from disasters not computers". Recovery plans must look at the skills required to accomplish even the smallest task in order to meet the recovery objectives.

Coach Hays also is crediting with saying, "There is no "I" in the word team". It takes the whole organization (team) pulling in the same direction to accomplish a recovery after a disaster. Everyone must do their assigned set of tasks. The plan is the document that outlines step by step how to make it happen, but to many times the plan is so large and cumbersome it can't be used. Many consultants, software developers and recovery coordinators try to be all things to all people hence the plan contains a lot of words (items) but misses the critical detail that is needed in order to get to the heart of the problem in a hurry, fix it and get back in business.

With companies and businesses continuously expanding their capabilities it's easy to get caught up in the "Bigger is better" syndrome when it comes to business continuity and recovery planning. Ultimately, bigger is NOT always better, simple detail is the key.

So what is simple detail? For starters, ask yourself: who is to do what, when is it to be done, where will it be done, how will it get done and what resources are needed to accomplish it? Once you have these answered, you'll be on your way to building a recovery plan that will get you through the difficult time following a disaster.

Who - Who is responsible for the activity, not a group or a committee but a person? Who then are the individuals who will support him or her (the team)? How does he or she communicate with and/or contact these support individuals?

What - What is the individual(s) responsible for (processes, tasks, resources, etc.) ? What does he or she need to do to accomplish this responsibility? Don't be vague, give it some detail. What are the resources you'll need to recover when things go wrong? What tasks need to be completed to get you back in business? Don't forget the step(s) before or after that you rely on someone else (team) to do?

When - When do you need to complete the activities outlined in the "What"? How soon do you need to be back in business? Keep it simple so all involved understand the goal.

Where - Where might be the key in knowing if you must be at a specific location in order to conduct your activities? Is there an alternate site involved? If yes, does everyone know where it is and how to get to it? Do your team members know who should be there and when? Or, can you conduct these activities somewhere convenient at the time? Explain in your plan what human skills and other resources are required to operate and why it is beneficial to be where you are.

The Key-- After you have thoughtfully evaluated the four W's, documenting these items logically is the key. Make sure your plan flows so that all who are involved can clearly see and be aware of their responsibilities. If you follow this simple plan for creating a basic plan and worry about the enhancement that will become apparent during testing of the plan you will provide your organization with a plan that works and one that can be followed by all who need to use it.

For more information contact Norman Harris at harrisnormanl@aol.com.

About the Authors

Norman L. Harris, CBCP, CRP

Norman L. Harris is President of Harris Recovery Solutions, Inc. He is recognized as a leader in Information Technology Management, and the founder of the Disaster Recovery Planning industry.

Mr. Harris co-founded CRISIS Magazine, one of the first disaster recovery publications and HSH, Inc., which became the largest disaster recovery consulting company in the US. Other positions held by Mr. Harris include Vice President and Director of Corporate Information Systems for BancOhio Corporation, Vice President of Information Systems for the Franklin Mint and Director of Information Systems for the United Telephone Company of Ohio.

For the last 25 years, Mr. Harris has consulted with thousands of business clients in every major industry including education, publishing, banking and finance, insurance and risk management, health care, federal, state, and local governments, manufacturing/distribution, wholesaling/retailing, utilities, and communications concerning their disaster recovery /business continuity planning requirements. He has worked with all of the major Disaster Recovery/Business Continuity Software Packages and assisted with the training of many in-house staffs in the use of the software.

Major corporations, national governments and higher educational institutions throughout the world have recognized the expertise of Mr. Harris, in the areas of information technology and disaster recovery/business continuity planning. A partial listing of Mr. Harris' career achievements includes such milestones as: the receipt of IBM's highest award for service to data processing and his selection by IBM as the "Data Processing Executive of the Year", development of the first disaster recovery plan, preparation and presentation of the first major address on disaster recovery planning at the Guide International Users Group meeting, founder of the Harris Recovery Institute; an organization dedicated to the testing and certification of recovery planners.

Recognized as a noted international speaker, Mr. Harris has made presentations on such diverse topics as Information Security Auditing and Cost/Risk/Benefit Analysis, Disaster Recovery/Business Continuity Planning, and developing Emergency Processing Procedures. He has addressed hundreds of audiences throughout North and South America, Europe, Asia, and Africa. He has participated in major symposia sponsored by IBM, Unisys, the Disaster Recovery Journal, DEC, and Honeywell/Bull. As a diligent author, Mr. Harris has contributed articles to Newsweek, Computer World, Computer Decisions, Info Systems, Bank Systems and Equipment, CRISIS Magazine, USA Today, The Wall Street Journal and many more. He appeared on "Good Morning South Africa", has had numerous television and radio interviews and has taught over 400 seminars, co-hosted 19 major conferences, and made several videos and CDs on the subject of Recovery Planning.

Mr. Harris has assisted many of the largest disaster recovery backup vendors with the establishment of their line of business plans and the definition of their product/service offerings. He coined many of the terms commonly used in the disaster recovery industry, including "hotsite", "coldsite", and "warmsite". Mr. Harris initialized "Disaster Recovery Planning" as the standard name for a new and rapidly growing industry

Tracy Cowan, CBCP, CRP

Ms. Cowan is a senior consultant with Harris Recovery Solutions, Inc. She has resolved business problems for insurance, government, financial, manufacturing and telecommunications companies. Her work expertise includes conducting Business Impact Analysis (BIA), Business Continuity/Disaster Recovery (BC/DR) Planning, defining business processes, strategic business and IT Networking capability assessments; information technology (IT) and telecommunications organizations; program management and the design and implementation of workflow processes, procedures and maintenance.

As a BC/DR Consultant, Ms. Cowan's clients included the entire range of Fortune 500 companies as well as start up organizations. Clients included United Services Automobile Association (USAA), Qwest Communications (formerly US West), Wells Fargo, American General Finance, Dell Computers, InfoCom Services, Arizona Health Care Cost Containment System (AHCCCS), Kinetic Concepts, Inc. (KCI) and Premiere Network Services. Ms. Cowan has provided support in recovery efforts for planning, implementing, exercising and maintenance of living documents as well as being engaged in strategic reviews of existing corporate recovery plans.

Ms. Cowan managed a Transition Team to convert 1,000 newly acquired bank locations national telecommunications support organization and designed and implemented a Program Management Office (PMO) for the support of the new acquired banks.

During various consulting projects, Ms. Cowan has assisted in teaching various Disaster Recovery Courses at organizations such as United Services Automobile Association (USAA), Internal Revenue Service (IRS), and American General Finance. Continued additional speaking engagements include: Disaster Recovery Journal conferences and state and local organizations. Recently, Ms. Cowan and Mr. Norman L. Harris has published an "interactive" seminar class called "BC Planning Made Simple" that is available on Video and CD as well as person-to-person.

Ms. Cowan's is proficient knowledge of tools are: All Microsoft (MS) Office Products, MS Project; MS Access (creating and using) Visio; Living Disaster Recovery Planning System (LDRPS) and Business Impact Analysis (BIA) Professional - Strohl Systems, Inc.; RecoveryPac - CSCI, Inc.; and PC Docs.

Ms. Cowan holds two certifications in Disaster Recovery: Certified Business Continuity Professional (CBCP) from The Disaster Recovery Institute (DRI), and Certified Recovery Planner (CRP) from the University of Richmond.

Currently Ms. Cowan is an active member of The Disaster Recovery Institute (DRI), Association of Contingency Planners - Capital of Texas Section (ACP), and The Institute of Electrical and Electronics Engineers (IEEE).