Developing Plans and Procedures

1. Developing Plans and Procedures Chapter 5

2. You Will Learn How To… • Determine what disaster recovery procedures need to be developed • Develop and write disaster recovery procedures • Review and approve disaster recovery procedures • Develop basic disaster recovery plans for a facility • Publish the disaster recovery plan

3. What Disaster Recovery Procedures Are Needed • Recovery procedures fall into one of six categories • Direction, control, and administration • Internal and external communications • Safety and health • Containment and property protection • Resuming and recovering operations • Restoring facilities and normalizing operations • Classifications of disaster • Catastrophic, Major, and Minor

4. Types of disaster recovery procedures

5. Classifications of a Disaster

6. Developing and Writing Disaster Recovery Procedures • Planning team should monitor committee work for thoroughness and consistency • Subcommittees of the disaster recovery team may form to work with departments to develop procedures • All affected parties must draft and approve procedures, including those employees that implement the procedures • Procedures should be maintained on paper, intranets may make the more accessible

7. Generic Procedure Worksheet

8. Reviewing and Approving Disaster Recovery Procedures • Entire planning team reviews drafts • Subcommittee of planning team or group of middle managers not involved in procedure development can act as independent reviewer • Reviewers should ensure that the procedure has the following attributes • Clearly documented • Easy to Read and understand • Consistent with other procedures • Does not contradict other procedures

9. Reviewing and Approving Disaster Recovery Procedures • Review committee submits changes to drafting committee • Drafting committee resubmits the changed procedure to the review committee • The review and revision process continues until the disaster recovery team and review committee are satisfied • Acceptance is a formal process involving the entire disaster recovery planning team, allowing all members of the planning team to comment

10. Developing Basic Disaster Recovery Plans for Every Facility • Basic rules for a disaster recovery plan • Everything must be clearly documented • The plan must be understandable by all employees • Multiple copies of the plan must be available from multiple locations to ensure the plan is accessible • All response teams need copies of the plan • Team members should be listed on a separate page in the plan, including their names, department, and contact information

11. Basic Disaster Recovery Plan Outline • Front matter: • Title Page, Table of Contents, Introduction • Primary Disaster Recovery Staff • Disaster Classification • Disaster Recovery Procedures • Appendices: • Contact Lists, Building Plans • Risks assessment reports • Organizational agreements, Requirements

12. Outline for a Basic Disaster Recovery Plan

13. Basic Disaster Recovery Plan Front Matter • Title Page • Name and location of facility or business process • Legal confidentiality statements • Contact information for Disaster Recovery Staff • Table of Contents • Introduction • Overview of the plan • Summarize specific laws, policies and regulations • Detailed exhibits may be referenced in an appendix

14. Basic Disaster Recovery Plan Front Matter • Primary Disaster Recovery Staff • Names, Titles, Addresses • Phone numbers and e-mail addresses • Disaster Classification • Clearly define how to classify catastrophic, major, and minor disasters • A catastrophic loss may be downgraded if other facilities can be used for the same purpose, and no employees are dead or missing • Planning team classifies events to provide response teams with enough information to classify and respond to an event

15. Direction, Control, and Administration Procedures • These procedures enable managers to direct the organization from response to recovery • Organizing the response team • Establishing an emergency operations center • Establishing first alert notifications • Confirming a disaster • Declaring the disaster • Keeping an activity log

16. Composition of Disaster Response Team

17. Emergency Operations Center • Especially necessary for catastrophic disasters • Response team leaders direct response from this location • Response team may work and rest at this location • Location may be one of the organizations facilities in a community • Local hotel with conference facilities may also be used

18. Emergency Operations Information Sheet

19. First Alert Procedures • Methodical and structured process for notifying • Managers • Employees • Emergency Services Organizations • Who is responsible for initiating first alerts • Who can authorize a first alert • Names of those to contact first after a disaster • An authorized manager must initiate the alert, but the manager’s staff may make contacts

20. First Alert Information Sheet

21. Disaster Confirmation Procedure • Verifies that a disaster has occurred • Validates the impact of the disaster • Determines the initial damage and scope of the disaster • Once confirmed, disaster declaration is made • Disaster is initially classified as catastrophic, major, or minor

22. Disaster Confirmation and Declaration Report

23. Disaster Recovery Activity Log • Describe the activity, date and time, contact information for the activity • Recovery plan should provide a sample log to be used to record recovery activities • Detailed instructions on how the log should be maintained • Risk assessments help the team understand which operations are affected by an activity • Individual teams may keep logs to integrate into the master activity log

24. Disaster Response Activity Log

25. Safety and Health Procedures • Two teams should be organized • Evacuation and Rescue Team • Security Team • Both teams need access to building plans • Teams develop procedures for facility evacuation, reentry, movement of employees, and crisis counseling • One team member keeps the log, entire team may be debriefed after initial response to complete log • Evacuation and rescue team employees should be trained to supervise evacuation procedures and initiating rescue efforts

26. Evacuation and Rescue Team

27. Security Team • Ensure facilities and valuable properties are protected during evacuation, after evacuation, and during recovery

28. Procedures for Internal and External Communication • Establish a communication team • The communication team establishes contact with all parties and provides consistent explanations of the recovery • Timelines for expected recovery activities are distributed after being approved by the director of the disaster response team

29. Communications Team • Activity log is maintained listing organizations and individuals contacted, and when they were contacted • Contact lists are maintained in an appendix of the recovery plan • Agreements and external relationships that can assist in recovery documented in an appendix • Team members can manage internal and external communications and facilitate disaster response • Team is responsible for contacting law enforcement, government agencies, and media

30. Communication Team

31. Procedures for Containment and Property Protection • Establishes an insurance and damage assessment team • Consists of trained employees that can • Prepare initial, detailed damage assessments • File reports with insurance companies • Work with demolition crews or construction contractors for cleanup and repairs

32. Insurance and Damage Assessment Team

33. Procedures for Resuming and Recovering Operations • Procedures that may be necessary to resume operations • Determining the duration of the shutdown • Activating back-up systems • Activating alternate systems • Activating hot or cold sites • Moving records • Moving equipment • Moving supplies • Recovering critical systems and functions • Recovering essential systems and functions • Recovering necessary systems and functions • Recovering desirable systems and functions • Business continuation team develops and executes these procedures during recovery

34. Business Continuation Team • Consists of trained employees with the skills to manage operations and restore critical business systems and functions • Team responsibilities • Moving employees into temporary quarters • Providing telecommunications, computer networks, and computing support • Managing shipping and receiving

35. Business Continuation Team

36. Procedures for Restoring Facilities and Normalizing Operations • The organization’s restoration team is responsible for executing these procedures • The team consists of employees who can manage the restoration or rebuilding of facilities • Team responsibilities • Obtaining restoration estimates • Managing temporary repairs • Preparing facilities for reoccupation

37. Restoration Team

38. Publishing the Disaster Recovery Plan • The disaster recovery planning team appoints a plan publishing team leader • Team leader should have a background in technical writing, publishing, or procedure documentation • Works with all parties to make sure all materials are accurate and approved • Team leader establishes the document flow from the planning team to the publishing team • Planning team determines how the plan is published, a copy of the plan must always be accessible • All departments receive a copy of the plan • Training materials are developed from the plan to train employees • The plan is confidential material and the planning team should keep a log of who has copies of the plan

39. Disaster Recovery Plan Distribution Log

40. Disaster Recovery Confidentiality • All employees receiving a copy of the plan should sign a confidentiality and nondisclosure agreements • A blanket nondisclosure agreement signed initially by employees may cover receiving a copy of the recovery plan

41. Confidentiality Agreement for Disaster Recovery Plan

42. Assessing Progress and Moving Forward • Organizations must develop detailed recovery procedures • Disaster recovery procedures must be documented to smoothly recover operations • Chapter 6 discusses the importance of organizational relationships in disaster recovery • Chapter 7 explains how to develop procedures for responding to computer attacks • Chapter 8 covers documenting recovery procedures for special circumstances

43. Chapter Summary • The disaster recovery planning team needs to evaluate all facilities and business operations to determine what kinds of procedures it must help develop • As planning team members oversee the development of recovery procedures, they should continually monitor the drafts for thoroughness and consistency of formatting • Subcommittees of the disaster recovery team must work with the necessary departments to develop procedures • The procedures must be drafted and approved by all affected parties, as well as by employees who must implement the procedures

44. Chapter Summary • The entire disaster recovery team should review drafts of all recovery procedures • Planning team members not developing procedures or a group of middle managers not involved should review the procedures • Every facility should have at least a basic disaster recovery plan in place • A team leader should be appointed to oversee publication of the disaster recovery plan