|
THE CARE AND FEEDING OF THE DISASTER RECOVERY CULTURE "Who has the responsibility for disaster recovery planning?" When this question is proffered throughout the organization, most often the returning answer will be, "the disaster recovery coordinator". But when seeking information regarding the various approvals required to implement or activate the recovery plan, the response most often received is, "top management". SEEK SUPPORT AT ALL LEVELS Most of us responsible for recovery planning have heard...and have many times said ourselves: "You MUST have top management support for your recovery project or program to ensure its success". In our haste to ensure the success of our programs, we may overlook the support of the integral management levels--namely middle management, lower management, supervisors, and individual staff members. And--don't forget the disaster recovery coordinator--just because someone has been named to a particular position doesn't guarantee his or her support of that job's slate of responsibilities. EMPHASIZE ASSET PROTECTION Needless to say, there is a sole responsibility for which there is mutual agreement at every level of the organization--that is, to protect the assets of the organization. You will find little disagreement here. However, when we look at the multitude of ways we can protect those assets, disaster recovery planning falls right in line with security, auditing, and risk management melding together to form a meaningful asset protection program. A breakdown in any one of these facets will insert a weakness into the program and subject the organization to unacceptable exposures. Then why do disaster planners continue to exclaim that they must obtain top management's support, when in reality the underlying concern is to obtain the support of everyone, including top management? As for top management support, it has clearly demonstrated its support merely by putting these protection capabilities in place. If this is true, then again, why is it we recovery planners FEEL we don't have this support? Just remember, along with protection of organization assets goes the responsibility for managing revenues. The answer is simple: when we ask top management to show its support by spending money, they usually say, "NO!" TURN NO TO YES! Disaster recovery planners probably hear the word "NO" more often from top management than do funds seekers representing other business functions. We need to examine why it appears that top management does not support our recovery efforts. Top management, in reality, does only two things: they say "yes" ... or ... they say "no". Everything else associated with their responsibilities leads up to and prepares them for these decision-making responses. Because these executives have given their support by providing for these capabilities, their negative responses must, therefore, be the result of our inability to provide them with the information they require. It could be our failure to meet their expectations in a manner required to convince them to say "yes". We must be aware that we haven't worked successfully toward this end nor have we received the support we need from the other levels of management to lend acknowledgment to this project as a higher priority. Projects are prioritized in the management ranks and they compete for project funding. When other projects continue to receive approval ahead of disaster recovery projects, we, the recovery coordinators, must accept the responsibility. NURTURE YOUR DISASTER RECOVERY CULTURE As a profession, recovery coordinators must discover ways to im-prove our approval rating. Clearly, one way is to create the disaster recovery culture within the entire organization. In this environment, everyone accepts the responsibility that his or her job is important to the protection of the organization's assets, and disaster recovery awareness is felt and practiced by every staff member. Create this culture within your organization prior to requesting "needed funding" and seeking "top management support". Some suggestions are: • Involve as many staff and organization levels as possible in a risk assessment and risk identification. You can do this quickly and at little cost. • Conduct a detailed security review. If you possess an adequate set of questionnaires, you can perform this activity by yourself at no additional expense to the organization. • Hold meetings or merely mention disaster preparedness in any meetings you attend. This will keep the issue off the back burner. • Develop a business impact analysis. As you conduct this exercise, the information gathered will cause staff members and managers to examine more closely their organizations and to evaluate various scenarios and their implications. This can go a long way toward getting the approvals you need when you present it to top management later. • Collect and distribute disaster recovery articles. Find articles pertinent to various business functions in your organization and send them to those managers. • Present disaster recovery ideas to different levels of management within the organization. As the recovery awareness picks up momentum and communications increase, the recovery culture development is well on its way. • Create a policy statement and objectives for top management's approval. Because of their busy schedules, they will appreciate your taking this initiative. If you do your homework and accumulate some good, hard facts, you can easily gain the involvement of other staff members in your disaster recovery efforts. You can cause disaster recovery thinking to be included in the systems development life cycle used in system designs. Once you get managers to envision their probable losses, they will begin to question how their functions would be able to continue if a disaster were to occur. Once disaster recovery preparedness becomes a way of life, the "No" you received before will have turned to "YES", and your disaster recovery culture will be alive and well, supporting and protecting the assets of your organization. About the author: |