How do you write a Disaster Recovery Plan document?

Disaster Recovery Plan DRP THE DRP PROJECT DOCUMENT TITLE Author Title Company CurrentDate Document Version Control Information

1. Introduction 1 Purpose of this document Objectives Insert the purpose of this document its objectives and its intended audience. Example. The purpose of this document is to formally recognize and codify the policies and procedures Company wishes to enact in order to both safeguard the Company’s Business and ensure its continuity in the event of disaster or other event. The goals and objectives listed in this plan are meant to allow the Company to minimize any interruption to its businesses and individual recovery plans may be enacted to safeguard and restore specific Company resources assets or business process. In order to continue its business operations The Company provides its Employees Staff and Vendors this Disaster Recovery Plan DRP as an overview of the required steps and policies to be enacted following an emergency. 1 Scope of Document Insert description of the scope of this Disaster Recovery Plan and whether this covers the entire company; specific business unit or department; or shall be governed or supersedes other policy documents that may already be in place. 1. 21 Scope Constraints

Insert constraints such as schedules costs interactions overview or any other information relevant to the testing of the development requirements. 1 Goals of this Plan Insert an overview or brief description of the product software or other desired end result that is being tested under this Disaster Recovery Plan. 1 Business Context Insert an overview of the business or organizations impacted by this Disaster Recovery Plan. Include the business or organizations critical components and reliance on specific vendors services or other assets. Note. This section will be primarily used to set priorities and identify and classify risk to the Company as it pertains to recovery from Disaster Event. While it is generally understood that every possible manner in which Company or its continuity could be impacted by an event would not be outlined here this section is intended to quickly communicate in plain language “how” “what” and “who” is important to the business in the event of disaster. Following disaster and the enactment of this plan it is important that personnel involved in the coordination and recovery from disaster event understand the impact to the Company’s operations and the dependent business processes so they may better identify further business interruption that may occur from enactment of the plan. e. g. additional or cascading business failures due to missing resources or recovery efforts. 1 Goals Defined The Overall Goals of the DRP are to provide easy and accessible methods for Company to recover from any of the following events or occurrences. * Loss of hardware and critical equipment

* Loss of critical infrastructure or personnel * Loss or critical vendors dependent services or other “up stream” service providers. * Loss of installed software and applications see Company Software Disaster Recovery Plan * Containment of secondary damage resultant from or the proximate cause of disaster or other event. * Identification and containment of security risks and potential secondary damage resultant from the loss of critical resource following disaster or other event. * Loss of software installation disks packages or other media including software proof of license or ownership * Loss of any other asset resource vendor direct service provider data information or any other asset deemed resource critical to the continuity of the Company’s business. 1 References and Reference Material

Insert list of all reference documents and other materials related to the Software Disaster Recovery Plan. References will often include but are not limited to. * Company Business Continuation Plan BCP * Company Software Disaster Recovery Plan SDRP * Company Recovery Point Objectives RPO * Company Recovery Time Objectives RTO 1 Documentation Items Insert references to documentation or contact lists which may include but are not limited to. * Company Critical Services List * Company Critical Vendors List

* Company Critical Location List * Company Department Head and Manager List * Company Disaster Response Team List 2. Plan Components 2 Software Inventory Catalog and Control A centralized Software Database and Control System SDCS for inventory is maintained for all software licensed by the Company. A complete copy of all SDCS data is maintained off company property and updated on regular basis. The SDCS shall be the first resource the Company utilizes in the event of critical Software failure or interruption.

2 Hardware Inventory Catalog and Control A centralized Critical Infrastructure and Control System CICS for all assets deemed necessary and critical to the continuity of the Company and its business is maintained for all assets owned by the Company. A complete copy of all CICS data is maintained off company property and updated on regular basis. The CICS shall be the first resource the Company utilizes in the event of critical hardware or infrastructure failure or interruption. Information contained in the CICS shall contain but is not limited to. * Descriptions of Company infrastructure and dependent equipment vendors and services. * Inventory and locations of all company assets deemed critical and the locations of all spare back up or reserve equipment. * Lists of all Company personnel who have access or the ability to interact request or otherwise direct vendors to act on Company’s behalf. e. g. Account Owners or Administrators * Directing Staff to any additional manuals and documentation.

Insert additional descriptions of the tasks to be performed. 2 Inventory Audits Company shall conduct periodic audits of all resources to ensure compliance and integrity of our inventory data. Regular checks of employee hardware software and license counts may be conducted on random basis. The Company will also conduct complete audit annually and compare it to the CICS. Insert additional descriptions of the tasks to be performed. 2 Off site Storage

Off site storage of all information contained in the CICS shall be facilitated by the Company. This includes whenever possible copies of all purchase information service agreements warranties installation media documentation licenses serials and other relevant information. Regardless of whether multiple copies of the same asset or resource are being utilized it shall be necessary to store copies of each relevant warranty service agreement End user License Agreement EULA or any other information that may be specific to an individual or serialized asset. Data will be updated on regular basis and more than one member of the Incident Response Team shall have access to this storage at all times. Insert additional descriptions of the tasks to be performed. 2 Proof of Ownership All original supporting Proof of Ownership documents shall be retained off site while the Company shall retain copies of Proof of Ownership onsite for auditing purposes. Insert additional descriptions of the tasks to be performed.

2 Documentation Whenever possible photocopies or reproductions of all documentation should be made for employee use while the originals are stored off site. Insert additional descriptions of the tasks to be performed. 2 Plan Objectives This Disaster Recovery Plan may be superseded by actions taken by individual Company Disaster Recovery Plans such as those governing Software Employees and Personnel utilizing alternate locations or other specific plans that are part of the Company’s Business Continuity Plan BCP. The following shall be considered to be objectives of the Disaster Recovery Plan. * Safeguard the lives and personal safety of all Company employees and other staff members.

* Gain assistance direction and support from civil services such as fire police and emergency management. * Secure information and establish channels of communications concerning natural disaster event from fire police and emergency management in order to tie into Company Command and Communication Centers. * Company Recovery Point Objectives RPO The Company Recovery Point Objective RPO shall be considered point in time in which operations must be restored in order to be acceptable to Company within the context of the following. 1. The difference in time between back up resource or asset and the disruptive event that could occur. 2. The Company’s tolerance for loss of data and continued operations. 3. The Company’s tolerance for risk and exposure to risk during disaster event 4. The Company’s exposure to cost and financial loss due to restoration of data and or time spent recovering or re entering data. * Company Recovery Time Objective RTO The Company Recovery Time Objective RTO shall be the acceptable boundary of time in which recovery efforts must be accomplished in order to meet the expectations the Company has determined critical to meet when disaster event or business interruption occurs.

* An individual RTO may be established for each process covered under this recovery plan as established during the Company Business Impact Analysis BIA for each department. An RTO may also encompass series of processes as well. All RTO’s are to be determined by Senior Management and or the Executive Team. 3 Implementation of the Plan Insert the overall objectives for implementation of the plan. Your Disaster Recovery Plan may contain several different approaches for certain events large or small. 3 Definition of Disaster Event A disaster event shall be defined as an event or occurrence which results in the sudden or unexpected loss of key resources functions software licenses components dependencies or any other failure of an asset deemed critical to the Company’s continued business.

An event may include but is not limited to. * Fire or Smoke Damage * Floods or Water Damage * Power and Utility Failures * Natural Disasters * Terrorist Attacks * Theft or Criminal Activity * Computer Viruses or Security Breeches

* Hardware and Equipment Failures * Human Error or Omissions * Legal Issues * Riots Strikes and Civil Disturbances * Planned Maintenance and Testing

* Unplanned Maintenance and Testing 3 Notification of an Event In the event of an occurrence of any event or disaster regardless if it is known to impact single user department or the entire company the following people must be immediately notified. Insert notification information here including back up secondary notification information. specific person will be noted as “Disaster Recovery Coordinator” which you will want specify who in your organization must take on that role. Be sure to specify all back up and secondary notifications that must take place as well as who the role of “Disaster Recovery Coordinator” falls to in the event that the primary point of contact cannot be reached. 3 Event Recovery Strategy Business interruption events or disaster have different levels of severity or degrees of impact to the Company. The strategies procedures and objectives of this Business Continuity Plan outline plan of action that deals with the worst case scenario that the Company could face should such an event occur. Insert summary for the specific strategy the Company wishes to employ for managing disaster events. The Company recovery strategy is high level overview of the recovery process that the Company will enact if disaster event or interruption occurs. This strategy shall include but is not limited to. * Current Company Command and Communication Centers

* Alternate Company Command and Communication Centers * Use of alternate business operations methods or other alternative business processes. * Use of alternate data processing or processing centers. * Use of alternate data and voice communications. * Descriptions for when to move critical data to off site storage facilities and vendors and what control document or plan is to be enacted following such decision. * Descriptions of the Company’s alternate locations; the functions of these locations and how they fit into the continuity of particular business process; the control documents or plans that govern these locations and their capabilities and all other relevant information to the strategy concerning the utilization of alternate locations for assets equipment and personnel. * Use of additional or temporary work personnel or contractors. * Use of telecommuting and remote work locations. 3 Event Classification and Response