Business Continuity and Disaster Recovery for InfoSec Managers

288 A.1 Recovery Checklist (Incident Response Team)

Functional Team Leaders

 Call, Assemble, and Brief Team Members Page/Section

 Make team member assignments

 Coordinate travel arrangements with the incident manager/IMT

 Retrieve, inventory, verify, and ship or pack backup tapes

 Dispatch appropriate team members to alternate facilities (as

appropriate)

 Participate in Salvage and Clean-up (as required) Page/Section

 Conduct Secondary Notifications Page/Section

 Corporate

[name/phone] . . .

 Vendors/Suppliers

[name/phone] . . .

 Key Users

[name/phone] . . .

 Initiate technical environment recovery procedures at the alter-

nate facility

 Receive inventory, and check equipment and backup tapes

 Install operating system using backup tapes

 Restore applications and data from backup software

 Restore applications development machine

 Conduct system test

 Synchronize the data

 Notify users

 Conduct user acceptance test(s)

 Obtain user acceptance

 Schedule “catch up” input of accumulated work

 Resume production processing

 Establish a New Tape Library Page/Section

 Operate in Crisis Mode Page/Section

Functional Team Recall Roster

Name Title Home Office Mobile

A.1 Recovery Checklist (Incident Response Team) 289

Appendix A

 Implement New Backup Procedures Page/Section

 Assist in Site Restoration Page/Section

 Assist in Return Home Plan Development Page/Section

 Transition from Crisis Mode to Home

Site Operations Page/Section

 Conduct a full system backup

 Ship backup tapes to the home site

 Deploy personnel from the alternate site to the new home site

 Inspect/accept new site

 Install equipment/inspect new equipment

 Install operating systems

 Restore applications and data from backup software

 Conduct system tests

 Notify users

 Conduct user acceptance test(s)

 Obtain user acceptance

 Begin production

 Return to “Business as Usual” Page/Section

 Conduct a postincident review

 Review all activity logs

 Debrief team personnel

 Document “lessons learned”

 Prepare an After-Action Report

 Update Disaster Recovery Plans Page/Section

This Page Intentionally Left Blank