Version: 3.0
Status: Proposed: 05/01/03
Contact: Valerie Adkins
As the VCCS implements more and more mission-critical applications over the Internet,
the greater the potential for unscheduled interruptions. This is also true of business
processes that could be located on the campus or distributed throughout the college. The
objective is to be aware of these potential disasters, to develop a plan to minimize
disruptions of critical functions, and to enable the recovery of operations as quickly as
possible. The disaster recovery plan is one of the essential components of the VCCS
Information Technology Disaster Prevention and Business Recovery Program.
Definition
A disaster is defined as a suddenly terrible event that causes damage, loss or
destruction. The main objective of a business recovery plan is to minimize the effect an
unscheduled interruption in an application will have on the on-going operations and to
provide for the continuation of critical business functions. The purpose of the
business
recovery plan is to protect the organization in the event that all or parts of its
operations are rendered unusable. Creating a plan should minimize the disruption of
operations and ensure some level of stability and an orderly recovery after a disaster.
Planning
The business recovery plan should contain general assumptions and a sequence of events that need to be followed to achieve recovery of resources. The plan is the road map from disaster to recovery. The planning process should also include a detailed study of disaster recovery alternatives. Reciprocal agreements, pooling resources, backup sites, etc. are a few examples of strategies that can be implemented to provide a smooth path to recovery. The plan should also include adequate coverage of emergency response procedures.
For the recovery process to be effective, the plan is organized around the team concept. Each team has specific duties and responsibilities once the decision is made to invoke the disaster recovery plan. Since the size of each college will vary, the sizes of each team and the number of teams will also vary. Each college will have to develop a plan that is applicable to their business needs.
Recovery
Each college should determine their recovery strategies. These strategies should be based on the business needs of the college and the established priorities of the college. The most practical alternatives for processing in case of disaster should be researched and evaluated. It is important to consider all aspect of the business at each college, such as, facilities, hardware, software, communications, data files, customer operations, end-user systems, etc. This information can be obtained from the Business Impact Analysis and Risk Assessment Analysis.
Document and test the plan
The business recovery plan should be thoroughly developed, including all detailed procedures to be used during and after the disaster. The business recovery plan should be kept up-to-date through updates, testing, and reviews. As recommendations are completed or as new areas of concern are recognized, the plan should be updated to reflect the current status. To plan for various situations that occur, copies of the business recovery plan should be safeguarded both at the college and in a secure off-site location. A copy of the plan should also be sent to the VCCS Chief Security Officer.
In conclusion, a business recovery plan should address all the critical operations and business functions of the college. The plan should include documented and tested procedures, which, if followed, will ensure the ongoing availability of critical resources and continuity of services.