Understanding BCP, DRP, and COOP ◾ 309
© 2011 by Taylor & Francis Group, LLC
alternative methods must be developed, like satellite phones or radios, or local
teams need to be empowered to make decisions autonomously and be given the
tools they need to implement those decisions.
is section may be an appropriate place to keep contact information on each
team member; alternatively, it may be included as an appendix. Keep in mind that
you can never have enough contact information. Especially for key recovery per-
sonnel, you may wish to include work and home phones and email addresses, faxes,
cell phones, neighbors, relatives, etc.
is is the rst point in the development of the plan where you must design
actual procedures to be followed during a crisis. It is impossible to develop good
procedures of any complexity without playing them out. For this reason it is criti-
cal that the procedures developed for this section be tested in actual use, just like
the recovery procedures themselves. It is also useful, during the development of the
plan, to role-play a crisis, preferably with the people who will actually be involved,
in order to think through the necessary steps.
Plan Section 4: Recovery Phase
is is the second of the three major sections documenting actual recovery opera-
tions, but it is the one that most of us have in mind when we talk about a DR
plan. is is the section of the plan that documents in detail the solutions to be
used to recover each system and the procedures required to carry out the recovery
and restore operational capabilities.
e organization of this section is simple. For the organization as a whole and
for each system individually, the plan identies a sequence of recovery goals (for
example, to restore Internet connectivity or to switch email services to a backup
system at a secondary site) and provides documentation on the procedures required
to accomplish each of them. Procedures may be as simple as a couple of bullets, or
they may be many pages of instructions and checklists, depending on the complex-
ity of the recovery solution and, of course, of the system.
ere are two aspects to your work in developing this part of the plan: actu-
ally implementing solutions that align with the recovery strategies you identied in
Step 4 and then documenting the procedures required during recovery. Implementing
your recovery strategy is, of course, the major work here. is includes everything
from evaluating and purchasing hardware and software solution components, design-
ing and implementing the solution around these components, equipping alternate
sites for your systems, negotiating with managed service facilities, vendors, and IT
consulting companies and so on. To lay out everything you need to know would
require a substantial book just for this discussion. Further, in this dynamic environ-
ment, details could be out of date as soon as published. erefore, you should take
the generic concepts and keep yourself up to date through conferences, research, and
general awareness through networking.