UK: Writing A Disaster Recovery Plan

This White Paper, the second in our three-part set on disaster recovery planning, describes specific methods for organising and writing a comprehensive disaster recovery plan. The first and third papers deal with the planning process itself and with data collection methods, respectively.

A well written disaster recovery plan is crucial to business continuity

A well organised disaster recovery plan will directly affect the recovery capabilities of the organisation. The contents of the plan should follow a logical sequence and be written in a standard and understandable format.

Effective documentation and procedures are extremely important in a disaster recovery plan. Considerable effort and time are necessary to develop a plan. However, most disaster recovery plans are difficult to use and become outdated quickly.

Poorly written procedures can be extremely frustrating. Well written disaster recovery plans reduce the time required to read and understand the procedures, resulting in a better chance of ensuring business continuity if the plan has to be used. Well written disaster recovery plans are also brief and to the point.

Standard format for disaster recovery procedures

A standard format for the procedures should be developed to facilitate the consistency and conformity throughout the disaster recovery plan. Standardisation is especially important if several people write the procedures. Two basic formats are used to write the plan: background information and instructional information.

Background information should be written using indicative sentences, while the imperative style should be used for writing instructions. Indicative sentences have a direct subject-verb-predicate structure, e.g. "Earthquakes cause considerable damage." Imperative sentences start with a verb (the pronoun "you" is assumed) and issue directions to be followed, e.g. "Tell employees to evacuate the building."

Recommended background information includes:

• purpose of the disaster recovery procedure
• scope of the disaster recovery procedure (e.g. location, equipment, personnel, and time associated with what the procedure encompasses)
• reference materials (i.e. other manuals, information, or materials that should be consulted)
• documentation describing the applicable forms that must be used when performing the disaster recovery procedures
• authorisations listing the specific approvals required
• particular policies applicable to the disaster recovery procedures.

Instructions should be developed on a preprinted form. A suggested format for instructional information is to separate headings common to each page from details of procedures. Headings should include:

• subject category number and description
• subject subcategory number and description
• page number
• revision number
• superseded date.

Writing methods for disaster recovery procedures

Disaster recovery procedures should be clearly written. Helpful methods for writing the detailed procedures include the following.

• Be specific. Write each disaster recovery procedure on the assumption that it will be implemented by personnel completely unfamiliar with the function and operation.
• Use short, direct sentences, and keep them simple. Long sentences can overwhelm or confuse the reader.
• Use topic sentences to start each paragraph.
• Use short paragraphs. Long paragraphs can be detrimental to reader comprehension.
• Present one idea at a time. Two thoughts normally require two sentences.
• Use active voice verbs in present tense. Passive voice sentences can be lengthy and may be misinterpreted.
• Avoid jargon.
• Use position titles (rather than personal names of individuals) to reduce maintenance and revision requirements.
• Avoid gender nouns and pronouns that may cause unnecessary revision requirements.
• Develop uniformity in procedures to simplify the training process and minimise exceptions to conditions and actions.
• Identify events that occur in parallel and events that must occur sequentially.
• Use descriptive verbs. Non-descriptive verbs such as "make" and "take" can cause procedures to be excessively wordy. Examples of descriptive verbs are:

Scope of the disaster recovery plan

Although most disaster recovery plans address only data processing related activities, a comprehensive plan will also include areas of operation outside data processing. The plan should have a broad scope if it is to effectively address the many disaster scenarios that could affect the organisation.

A "worst case scenario" should be the basis for developing the disaster recovery plan. The worst case scenario is the destruction of the main or primary facility. Because the disaster recovery plan is based on this premise, less critical situations can be handled by using only the needed portions of the plan, with minor (if any) alterations required.

Disaster recovery planning assumptions

Every disaster recovery plan has a foundation of assumptions on which the plan is based. The assumptions limit the circumstances that the plan addresses.

The limits define the magnitude of the disaster the organisation is preparing to address. The assumptions can often be identified by asking the following questions:

• What equipment/facilities have been destroyed?
• What is the timing of the disruption?
• What records, files and materials were protected from destruction?
• What resources are available following the disaster:

Typical disaster recovery planning assumptions

Below is a list of typical planning assumptions to be considered in writing the disaster recovery plan:

• The main facility of the organisation has been destroyed.
• Staff are available to perform critical functions defined within the disaster recovery plan.
• Staff can be notified and can report to the backup site(s) to perform critical processing, recovery and reconstruction activities.
• Off-site storage facilities and materials survive.
• The disaster recovery plan is current.
• Subsets of the overall disaster recovery plan can be used to recover from minor interruptions.
• An alternate facility is available.
• An adequate supply of critical forms and supplies are stored off-site, either at an alternate facility or in off-site storage.
• A backup site is available for processing the organisation's work.
• The necessary long-distance and local communication lines are available to the organisation.
• Surface transportation in the local area is possible.
• Vendors will perform according to their general commitments to support the organisation in a disaster.

This list of assumptions is not all inclusive, but is intended as a thought provoking process in the beginning stage of disaster recovery planning.

The assumptions themselves will often dictate the make-up of the disaster recovery plan; therefore, management should carefully review them for appropriateness.

Team approach to disaster recovery

The structure of the contingency organisation may not be the same as on the existing organisation chart.

The team approach is used in developing a plan as well as in recovery from a disaster. The teams have specific responsibilities and allow for a smooth recovery.

Within each team a manager and an alternate should be designated. These persons provide the necessary leadership and direction in developing the sections of the disaster recovery plan and carrying out the responsibilities at the time of a disaster.

Potential teams include:

• management team
• business recovery team
• departmental recovery team
• computer recovery team
• damage assessment team
• security team
• facilities support team
• administrative support team
• logistics support team
• user support team
• computer backup team
• off-site storage team
• software team
• communications team
• applications team
• computer restoration team
• human relations team
• marketing/customer relations team
• other teams.

Various combinations of the above teams are possible, depending on the size and requirements of the organisation. The number of members assigned to a specific team can also vary depending on need.

Summary

The benefits of effective disaster recovery procedures include:

• eliminating confusion and errors
• providing training materials for new employees
• reducing reliance on certain key individuals and functions.

For more information on disaster recovery planning please see our related White Papers, Developing a disaster recovery plan and Collecting data for a disaster recovery plan.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.