| “What does disaster recovery mean to whom?” That is the guiding question for determining what recovery plans to create as part of an overarching BCP. Often, when I read about BCM, where a BCP is one of the deliverables, people state that there are a number of recovery plans to fabricate. That’s right. What one then often does in the specialist literature is give a list of document titles. Those serve as examples of what kind of recovery plans one can create. And I think that is a step too fast. Not that it is wrong to give some ideas of possibilities but there needs to be a structured approach. And with that structured approach comes a “lead question.” And so that question, is “What does disaster recovery mean to whom? | In this contribution I give my own opinion, not that of any organization. |
Author: Manu Steens
Experiences of BC managers
In most experiences of BC managers that I read in specialized social media, Disaster Recovery is limited to developing a BCP and some recovery plans. To determine which recovery plans one thinks one needs, one eagerly reads lists of colleagues that give titles and topics. But that is never an exhaustive list. In addition, not all recovery plan titles and topics apply to every organization. Moreover, most of those recovery plans must not be written by only the BC Manager.
Better than skimming lists of titles or topics for recovery plans is imho to follow a procedure to identify the relevant recovery plans, including their co-authors.
The Procedure and the Lead Question
The procedure consists of nothing more than thoroughly examining and answering the question “what is disaster recovery for whom?
The “what” is not the starting point in this but the “who” is.
For the ‘who’, you check the organizational chart of the organization, with its functions and their corresponding names.
Each of those job titles, has an assignment to which the person attaches importance on behalf of the organization. Those assignments give rise to filling in the ‘what’ in the “lead question.” And sometimes that ‘what’ belongs to the sphere of interest of several functions.
An example : A multinational company
Possible organizational components of a multinational company
An organization I would like to take as an example is a multinational, with production halls, R&D, ICT, logistics, offices, service purchasing, printing, service sales, HR, accounting, internal audit, car parks, security etc. Examples of such multinationals exist in the pharmaceutical sector, food sector etc.
Zooming in on the facility manager
The Facility Manager of such an organization, for example, has a lot on his mind: he is responsible for the proper development of the buildings and sites.
So having a recovery plan (recovery portfolio rather imho) for his management domain is very important. In doing so, his plan will depend on the needs and wishes of a lot of others.
Also, partially, the BC Manager is responsible for creating the portfolio and will need to talk not only to the Facility Manager, but also to his stakeholders. R&D will have different needs than ICT, than production halls.
For example, ICT will need locations for software developers, for placing hubs, for placing WiFi in the best places, for having a server room that is not just tucked away in a place where water damage easily occurs etc.
So for such facility-related issues, not only will the Facility Manager along with the BC Manager need to talk to the ICT manager. There will also need to be a reference to the Facility recovery portfolio from the ICT recovery plan and vice versa.
Working with a matrix
To succeed in this way, to forget no one, the BC Manager should make a matrix of cooperation in the recovery plans. In doing so, he creates a table, with the list of stakeholders in the left column, and in the top row.
In the cells where the stakeholders cross, he puts the points in which both parties’ recovery plans depend on each other. There are two cells where each pair of stakeholders appears together, of which one is in the top row and the other in the left column.
Each cell describes how the column stakeholder supports the row stakeholder’s plan.
This could look like the following (non-exhaustive example – without details):
| ICT | HR | R&D | Logistics | Finance | Facilities | |
| ICT | ICT requirements for realization of HR recovery plans | ICT requirements for realization of R&D recovery plans | ICT requirements for realization of Logistics recovery plans | ICT requirements for realization of Finance recovery plans | ICT requirements for realization of Facilities recovery plans | |
| HR | Required personnel for execution of ICT recovery plans | HR requirements for realization of R&D recovery plans | Required personnel for realization of recovery plans | HR requirements for realization of finance recovery plans | Required personnel for realization of recovery plans | |
| R&D | ||||||
| Logistics | Logistical requirements for realization of ICT recovery plans | Logistical requirements for realization of HR recovery plans | Logistical requirements for realization of R&D recovery plans | Logistical requirements for realization of Finance recovery plans | Logistical requirements for realization of Facilities recovery plans | |
| Finance | Required contingency budget for realization of recovery plans of ICT | Required contingency budget for realization of HR recovery plans | Required contingency budget for realization of R&D recovery plans | Required contingency budget for realization of recovery plans of Logistics | Required emergency budget for the realization of facilities recovery plans | |
| Facilities | Location for Wi-Fi; Location for server room; Requirements for development rooms after recovery | Location requirements for HR staff upon realization of recovery plans | Requirements for laboratories, requirements for research sites | Location requirements for realization of logistics recovery plans | Location requirements for realization of finance recovery plans |
Conclusions
Working with such table as a method has a double advantage:
1° It provides a list of stakeholders who need the recovery plans.
2° It indicates who are stakeholders in whose recovery plans.
This allows for nuanced points of attention to be made by organizing the logical sequence of recovery activities in an overarching manner once all of these activities are known.
You do this by having everyone talk to everyone. It is then easier to have the recovery activities take place in an optimal order for each of the stakeholders. This increases the quality of the BCM process.
With this, I hope to have shown that recovery plans can differ between organizations (even within the same industry) for two reasons:
- The nature of the business practices.
- The structure applied to the business practices in the structure of the organization, including supporting processes, and the organizational chart.
And so one can see that simply cherry-picking types of recovery plans is not the best method for starting recovery plans. This way is more likely to provide completeness by asking who is involved (see table), keeping in mind the question ”What does disaster recovery mean to whom?”.