Ten Tips for Dealing with Disaster Recovery and Business Continuity Issues
If disaster strikes, your success will be determined by your people. How will they react? How have they been trained? Have you given them the tools they need?
Many of the articles you will find about disaster recovery and business continuity tend to focus only on technologies to consider and the proper formats for your written plans. These are, of course, important topics, but you cannot overlook the human element.
Let's take a look at 10 things that can get overlooked if you pay too much attention to only the technical issues, but that will play a vital role in your ultimate success.
1. Identify the Key People.
Who will play key roles in disaster recovery? What happens if they are not available? Who are the backups? Who are your leaders? Who do you want with you in a crisis? Let's face it; some people will react better than others will in a crisis situation. Identify them. Assume that there is a disaster. Do you know who will be sitting in the room when the first decisions must be made? Why not?
2. Select Your Teams.
Disaster recovery and business continuity both require a high level of cooperation and collaboration. In addition, people have to care about the organization enough to be willing to work at getting it back into action. Putting together teams and training them in advance will make a world of difference. Do you have your teams in place?
3. Designate a Meeting Place.
Assume that your office is destroyed. Where will your business be located? How will you know who is missing? Where will you meet to get things restarted? Designating places to reassemble may turn out to be the best first step you can take.
4. Update Your Scenarios.
Pay attention to the news. Read the latest thrillers. Watch 24, other spy shows and suspense movies. How would your plan work in these scenarios? Play out different scenarios. Question your assumptions. Is your plan really just a plan to "fight the previous war?"
5. Involve Lawyers and Clients.
Is disaster recovery just an IT function? I don't think so. Part of the learning from 9/11 is that clients are willing to help law firms get through difficult periods. Is your law firm willing to do the same for your clients? Are there ways you can make preparations in conjunction with your major clients own plans? Do you know what your lawyers will need, and in what order? Have you talked to your lawyers or are you just making untested assumptions? Make it a priority to have these conversations.
6. Get Agreement on What Really Matters.
Setting priorities in a crisis can be impractical at best and impossible at worst. Think through these issues in advance. If all of your communications are wiped out, what do you restore first? If you make your decisions in advance, your task will be one of implementation. If you do not decide on priorities in advance, you'll have many voices clamoring that their individual priorities matter most. In that case, everyone loses.
7. Run Some Fire Drills.
In times of stress, we can get some sense of stability by performing routine matters that we have practiced before. Firefighters can handle completely new fire situations under enormous pressure because they have experience and they practice on a regular basis. Do some dry runs and tests. Evaluate what happens rigorously. If you fail in practice, what gives you confidence that you will be successful in a real crisis? Must you change your plans? Restore your backups and see what really happens. Reset the whole system on the fly and see if your procedures work. Give your people a chance to learn the skills that they will need and to practice enough to be comfortable. Reward successful drills and dissect what went wrong in failed drills.
8. Publicize Your Procedures.
After 9/11, I checked and could not easily find evacuation and other procedures for my then law firm and the building I was in. Imagine how you increase the level of panic by not making procedures and instructions readily available in an emergency. Are you assuming that someone will activate the 911 system when no one is assigned that task? How many people have the authority to activate your off-site disaster recovery systems? What happens if they aren't available? Are they all still with your firm? Highlight the general approaches you will take and make the plan easily accessible.
9. Get Top Management to Treat These Issues Seriously.
I am the son of a volunteer fireman, so I might think about some of these issues more than others do. Whenever I hear about firms where executive committee partners do not bother to participate in fire drills and other emergency matters because their time is to valuable, I become concerned that this attitude will filter through the organization, resulting in senseless deaths because fire alarms are not treated seriously. If top management does not help plan, participate in and endorse your efforts, there is little chance that they will be effective when a crisis comes, unless you are very lucky.
10. Deal with the Cultural Issues.
I've worked in places where people waited around when fire alarms went off to find out whether they were "real" or not. If an alarm is real, they've reduced their chances for survival. In the IT area, some firms have cavalier attitudes about backup and disregard other standard practices. In other firms, preparations for disaster and crisis are seen as subject for humor or even derision. Education must play a key role. You can make important points about these issues with humor, but training is no laughing matter.
Disaster comes in many guises. I was at a firm with the proverbial one-person IT department and one morning found an envelope on my chair with our IT department's pager, keys, and resignation letter. We did not have a plan for this contingency. Fortunately, we had three people who could address the issues on the fly, but I didn't get any legal work done that day. Nothing sharpens your disaster planning like a good crisis. However, I have come to the conclusion that the more you can prepare for up front, the better off you will be. The key to your successful navigation of a crisis will be your people and your main goal is to get them the instructions, training and tools to be able to do the job when that unfortunate time comes.
About the Author
Dennis Kennedy is a technology lawyer, legal technology consultant, and well-known blogger based in St. Louis, Missouri. An award-winning author and frequent speaker, Dennis has written extensively on the technology of electronic discovery and co-authors the "Thinking E-Discovery" column at DiscoveryResources.org. His website and blog are well-regarded resources on legal technology and electronic discovery topics. He is a member of the Council of the ABA's Law Practice Management Section and the Webzine Board. He podcasts with Tom Mighell about legal technology, with a focus on the Internet, in The Kennedy-Mighell Report.