Planning a Recovery That Isn't a Disaster

Computerworld - Trouble Ticket

At issue: The disaster recovery plan isnt worth the paper its printed on.

Action plan: Devise something of real value despite tight resources.

Every January, I have to update my agencys disaster recovery plan. The good news is that the state only requires me to fill in some forms. I could be done in half an hour. The bad news? Should one of the states major cities ever be struck by terrorists, this so-called disaster recovery plan would leave us looking like FEMA after Hurricane Katrina hit.

Im not the sort of person whos content to satisfy the minimum requirements when I know how inadequate they are. This year, Im considering revamping the entire plan, including testing it and training people on it.

But Im shaking my head while I write these words. If youve been reading this column lately, then you already know why. My state is experiencing a budget crisis, and Ive been bemoaning my lack of resources, especially the time and staff I need to do everything that needs to get done. Do I really think I can throw another big project in on top of managing a network and all of our information security?

My problem is that I cant help but identify with those nameless FEMA employees I have conjured up in my imagination. There were probably plenty of them who knew that what the agency had down on paper and stored away in dusty binders was pretty much useless because it hadnt been tested. I dont want to think I knew it would be this way after the fact. Lives are at stake, and I cant live with the potential consequences.

That means doing something more than the minimum this year, even though Ill probably have to do it on my own time.

I can start by assessing what I know. It could be that Im not informed about the states readiness to respond to a catastrophe. After all, my agency provides social services, not public safety. If a city blows up, who cares if social services shut down? The top priorities would be saving lives, searching for victims, discovering what happened, apprehending perpetrators and calming the public. My agency isnt involved in any of that.

Still, the state is more than one city, and we cant let everyone else down. Basically, we need to try to ensure that we can continue to operate, even if our main facility is destroyed or simply inaccessible.

Baby Steps

But first things first. As in any disaster recovery plan, employee safety is the No.1 priority. At the very least, I can update the employee roster so that locating employees (or their next of kin) wont be difficult. Then I can update the evacuation plans and perhaps expand them. Anything I do here is going to be an improvement, since the current plan is the equivalent of a fire drill.