Business Continuity and Disaster Recovery for InfoSec Managers

168 5.5 Disaster Recovery Phase Report

5.4.4 Handling Media during the Disaster

Recovery Phase

Media contact during the disaster recovery phase has to be handled very

carefully. All information released to the public at this time has to be accu-

rate, and speculation should be reduced to the minimum. Media interviews

and press release statements should be handled by persons who have been

specifically authorized to undertake such duties. Other persons who have

not been authorized to speak to the media should be strongly discouraged

from doing so. Prepare a policy or strategy in advance of an emergency situ-

ation to be followed by the person authorized to release information to the

media. This section of the BCP should contain information on the policy

to be followed and the name and emergency contact numbers of the per-

sons authorized to speak to the media.

5.4.5 Maintaining an Event Log during Disaster

Recovery Phase

It is important that all key events during the disaster recovery phase be

recorded. An event log should be maintained by the leader of the disaster

recovery team. This event log should be started at the commencement of

the emergency, and a copy of the log should be passed on to the business

recovery team once the initial dangers have been controlled. The format of

the event log was discussed previously but, at a minimum, it should include

the date, time, title of the event, a brief description of the event, and out-

comes. It should also include follow up action needed, as appropriate.

5.5 Disaster Recovery Phase Report

On completion of the initial disaster recovery phase, the DRT leader

should prepare a report on the activities undertaken. The report should

contain information on the emergency, who was notified and when, the

actions taken by members of the DRT, and the outcomes arising from those

actions. The report will also contain an assessment of the impact to normal

business operations. This report is also known as an “After-Actions Report”

and should answer the following questions:

 What have you learned while managing this disaster?

 How can it help in future disaster response operations?