Disaster Recovery Plan ( DRP)

A disaster recovery plan is a written plan describing the steps a company or individual would take to restore computer operations in the event of a disaster. Every company and each of its' department or division within an enterprise usually has it's own disaster recovery plan. A disaster recovery plan contains four major components: the emergency plan, the backup plan, the recovery plan, the backup plan, the recovery plan, and the test plan.

The Emergency Plan

An emergency plan specifies the steps to be taken immediately after a disaster strikes. The emergency plan usually is organized by type of disaster, such as fire, flood, or earthquake. Depending on the nature of disaster and the extent of the disaster, the procedures that are followed in an emergency will differ.

The Backup Plan

Once the procedures in the emergency plan have been executed, the backup plan is executed. The backup plan specifies how a company uses backup files and equipment to resume business processing. The backup plan should specify the location of an alternate computer facility in the event the company's normal location is destroyed or unusable.

When operations are so important that a company cannot afford to lose the operations to a disaster, the company often maintains a hot site, warm site or cold site:

Hot site - is a separate facility that mirrors the systems and operations of the critical site. The hot site always operates concurrently with the main site. This type of backup site is the most expensive to operate. Hot sites are popular with stock exchanges and other financial institutions that may need to evacuate due to potential bomb threats and must resume normal operations as soon as possible.

Warm site - A warm site is a location where the business can relocate to after the disaster that is already stocked with computer hardware similar to that of the original site, but does not contain backed up copies of data and information.

Cold site - is a site that mirrors some of the critical site hardware, but does become operational until the critical site becomes unavailable. It's the most inexpensive type of backup site for a business to operate. It does not include backed up copies of data and information from the original location of the business, nor does it include hardware already set up.

The location of the alternate site facility is important. It should be close enough to be convenient, yet not too close that a single disaster, such as an earthquake, could destroy both facilities. All sites should have high-speed Internet services.

The Recovery Plan

The recovery plan specifies the actions to be taken to restore full information processing operations. As with the emergency plan, the recovery plan differs for each type of disaster. To prepare for disaster recovery, a company should establish planning committees, with each one responsible for different forms of recovery.

The Test Plan

To provide assurance that the disaster plan is complete, it should be tested, several times. A disaster recovery test plan contains information for simulating various levels of disasters and recording an organization's ability to recover. Any needed recovery actions that are not specified in the plan should be added.

Security in the Enterprise and Small Business

Large organizations must deal with complex computer security issues. Web sites and hardware must be secure from threats both inside and outside the enterprise. Users should be allowed access only to the data and information for which they are authorized, which typically is limited to the amount necessary to do their job. Small business faces some of the same issues and should take the necessary steps to secure their systems.

Developing a Computer System Security Plan

A computer security plan summarizes in writing all of the safeguards that are in place to protect a company's information assets. A computer security plan should do the following:

• Identify all information assets of an organization, including hardware, software, documentation, procedures, people, data, facilities, and supplies.
• Identify all security risks that may cause a security breach which cause a loss in assets. Rank risks from most likely to occur to least likely to occur.
• Place an estimated value on each risk, including the value of lost business.
• For each risk, identify the safeguards that exist to detect, prevent, and recover from a loss.

Keep in mind that some degree of risk is unavoidable. The more secure a system is, the more difficult it is for everyone to use.