Business Continuity and Disaster Recovery for InfoSec Managers

155

5

Disaster Recovery Phase

As discussed earlier in the book, the terrorist attacks of Sep-

tember 11, 2001 raised concerns among Americans about

the safety of their cities, communities, and workplaces, as

well as about the ability to respond quickly and effectively in

the wake of a disaster. Although these events were unprece-

dented, sooner or later every institution will face some type

of unforeseen event that could have a severe impact on its

operations, assets, or employees. To survive a catastrophe,

preparedness is crucial. Effective disaster response manage-

ment calls for risk analysis, disaster response planning, crisis

management communications, and business recovery strate-

gies. Disaster Recovery Plan (DRPs) are now mandated by

law. The Occupational Safety and Health Administration

(OSHA) requires facilities with more than ten employees to

have a written emergency plan. Top management support

and the involvement of every employee are imperative fac-

tors to having a successful plan.

There is no hard and fast definition of what constitutes a

disaster. Sometimes a disaster develops quickly, hitting full-

force with little or no warning. Other times, a disaster looms on the horizon

for a long period of time until it becomes large enough to become a threat.

When disasters occur, emergency response significantly affects the extent of

damages and injuries sustained. Disasters do happen, and often they

include injuries to people, fires, explosions, chemical spills, toxic gas

releases, and vandalism. Anticipating disasters and planning our response

can greatly lessen the extent of injuries and limit equipment, material, and

property damage. A critical part of handling any serious emergency situa-

tion is in the management of the disaster recovery phase.