ITSM Service Continuity Methods and Best Practices
The disaster recovery planning methodology consists of many disaster recovery planning processes. The contemplated disaster recovery planning effort, which will be performed after the disaster recovery business impact analysis, will be accomplished utilizing the disaster recovery planning processes, which are summarized below.

Important ITSM Service Continuity Information Areas (Remaining 7 of 14)
     8) Critical Application Systems Recovery - The procedures and strategies required for recovery of each critical application system needed in the event of a disaster should be documented and tested. Application system recovery is the process of restoring application system data and software to a point of known integrity after the original integrity of the processing, or data, has been lost. Once the total recovery process has been completed, the system can be restarted and normal operations resumed. Recovery techniques will vary depending upon the nature of the processing; whether it is batch, on-line, or a combination of both. The criticality of the system and the data involved dictates the degree of recovery measures implemented. Recovery can involve the use of techniques to reconstruct the status of the system as it was immediately prior to failure. If the system cannot be recovered to where it was immediately prior to the disaster, the recovery process also involves the reconstruction and/or correction of any data that was lost or damaged. Systems recovery should be closely coordinated with off-site backup efforts to assure the proper and most current data is available.
     9) Vendor Contact Information - Documentation of vendor information is needed to provide for expeditious recovery. Designation of individuals at each vendor company will provide a focal point when emergencies occur and allow a vendor to be familiar with the requirements for successful recovery. Vendor agreements should be copied and maintained with the disaster recovery plan. This will allow easy reference and provide the information vendors require to service the account. Special procurement, supply and shipment considerations from vendors, in the event of a disaster, should be negotiated, documented and included in the agreements.
     10) Support Considerations - In the event of a disaster, a timely and orderly recovery of data processing capabilities is dependent on the availability and coordination of personnel and resources throughout the entire company. Therefore, as the disaster recovery strategy is formulated and external tasks and resource requirements are identified, involvement from external organizations (e.g. finance, facilities, personnel, public relations, etc.) is mandatory to produce a workable plan.
     11) Facility, Office and Reconstruction - Facility specifications and office space requirements needed in the event of a disaster should be documented. This forecast of facilities and office space must consider the recovery priorities assigned to each system, the amount of time during which processing will be performed without full capability and the hardware, software and support needs of existing systems. One approach to defining facility and office requirements in the event of a disaster is to document existing facilities, office space, physical and environmental specifications and any other information pertaining to the current environment. This specification of the current environment will serve a two-fold purpose. It will provide a reference for defining and documenting minimum facility and office requirements in a disaster situation and will assure the availability of documentation needed for reconstruction if a total disaster occurs.
     12) Training - Personnel should be knowledgeable of their responsibilities, roles and specific tasks required to execute the disaster recovery plan. Each supervisor or manager who has disaster recovery responsibilities or whose work force members are expected to participate in disaster recovery operations should insure that assigned personnel receive proper instructions. Well-trained personnel can often prevent a disaster or, at the very least, limit the resulting damage. Participation in plan testing and documentation of test results will insure that training takes place, that disaster recovery awareness exists and that responsibilities are understood and executable.
     13) Testing - In order to evaluate the disaster recovery plan and verify the accuracy of the data and strategies developed, the plan must be tested on a reoccurring basis. Testing serves to:
          • Demonstrate the ability to recover from a disaster
          • Verify that the disaster recovery plan documentation works
          • Test the feasibility and compatibility of backup facilities
          • Identify and correct weaknesses in the plan
          • Train members of the disaster recovery teams
          • Increase confidence in the ability to recover
          • Evaluate the adequacy of external support
          • Enforce continual maintenance of the disaster recovery plan
The overall testing of the disaster recovery plan usually proceeds in phases. The first phase tests the contents of the off-site storage facility. The next phase is a "paper" test involving each disaster recovery team. This is followed by testing recovery at the alternate processing facility with involvement of team members. A large "paper" test involves all teams working together to solve an exercise in responding to a disaster. It is best to wait until the plan has been tested many times before calling a mock disaster where most participants do not know when a test will be run. It is usually practical to start with testing components of the plan and, as problems are resolved, to build up to more comprehensive tests. An un-tested, un-maintained disaster recovery plan can be worse than having no plan at all since your organization and its Management may believe the business is protected, when in reality it is not.
     14) Maintenance and Review - The primary objective of maintaining disaster recovery capabilities is to ensure that planned and tested procedures will work properly regardless of personnel, hardware or system changes. Maintenance requirements must be incorporated into normal business functions and accomplished on a continuing basis. Maintenance instructions should be a part of the standard documentation that is used in the normal course of business operations. Changes in software, hardware, facilities, telecommunications or personnel require maintenance procedures to keep the disaster recovery plan up to date. This ensures that procedures are accurate and reflect the current environment.

In the next Newsletter we will present IT Infrastructure and Service Continuity considerations.