Disaster Recovery Test

[Ed Panek]

I was going to use the COVID epidemic in which we utilized our Disaster plans and SOPs as part of our recovery and planning execution for most of 2020 as evidence we performed this exercise in 2020. Our QMS requires we do this test annually. Is that a valid thought?

 

[Ninja]

Howdy...
See here for a start...Testing cloud-based backups

Consider what makes sense to do annually...and perhaps update your own requirements...
Testing the most important parts annually makes sense...but what should that "Test" look like. How thorough?
It's cost/benefit...so think through both sides of that...
JMO.

A number of folks (my wife included) had to go to the office in order to restart after a windows or network update. What if the office wasn't physically there anymore? What would she do then? Remote desktop doesn't work if the host computer is (off, requires restart, burned up, underwater, stolen, etc.).

 

[Richard Regalado]

Hello.

Test the critical parts of the business (i.e., processes and activities) against the identified significant threats to the organization. The frequency depends on the process being tested, the scenario, the resources required, requirements from contractual, legal or regulatory entities. Tests should add value and confidence through out the supply chain.

Richard

 

[KylieWilson]

Such tests are necessary for your own confidence and the exclusion of risk factors.

 

[mehr.qasim]

My best bet is yes, go for it. I do believe that the disaster recovery model should be done annually to minimize any risk factor and uncover any vulnerabilities in the system.

 

[Tidge]

Frankly, I don't know why there is ever any resistance to disaster mitigation/recovery in businesses. I realize that this is one of those peculiar areas where a business might see this is a "no-value added" activity and hesitate to expend funds/time/effort, but the irony is that for companies that apply that sort of thinking very broadly, disaster preparedness is almost certainly the one area that will provide the greatest ROI.

Annual seems right to me, but once there is a demonstrated "complete recovery" (whatever that means) it is entirely possible that regular, smaller scope efforts could provide confidence that the plan is still valid.

I've faced a serious struggle convincing my peers to take disaster recovery seriously. Some of the crumbs I've been dropping into the head-space to motivate actions:

1. "If you think someone else has it covered, but don't know what their plan is, it is most likely there is not a plan."
2. "If you think you don't need a plan because we trust in the talent of the people, then it should be trivial to establish a plan."
3. "Disaster planning isn't about guaranteeing that we can immediately recover to the level where we are, it is about raising the floor so that we don't fall as far."

(1) is a common (understandable) attitude among managers, especially ones who feel that "it's not my area of authority". I appeal to such attitudes by saying something like "as a good manager, aren't you capable of recognizing when someone else has control over their own area without simply relying on testimony?"

(2) is by far the most annoying to deal with (IMO), because it walks the line between asking people who may or may not be prepared, but are certainly busy, to take the time to demonstrate their expertise... employees and managers in certain areas (such as IT) may not be used to oversight and often get overly defensive when "outsiders" start asking too many questions. It has been my experience that such folks usually have zero experience with typical quality system audits so I try to calm them by reminding them that this isn't radically different than a regular audit of financial systems (and transactions). I make sure to explain that I don't question their competence, I just want to know that there is an established plan that they are going to follow so that when disaster happens they don't have to be distracted trying to explain what they are doing to "outsiders"... because if they are annoyed with questions when there isn't a disaster in progress, I ask them to imagine how they are going to feel when three different directors and VPs are calling every 10 minutes for an update.

(3) This is supposed to be the explicit recognition that it is impossible to know the exact nature of the disaster. There will be common disasters that can be planned for, but there will be unpredicted ones as well.

 

[Emmyd]

It would also be wise to verify how quickly your company could recover in the case of a major cyber attack. My company's servers were held in ransom last year, and the IT department couldn't get a way around the encryption to recover all our information. It may not be a disaster in the traditional sense, but it was rather catastrophic trying to supply customer demand without any of the resources that we depend on daily. It took over 2 months to get our servers back up and ultimately required the company to do things that were against judgment. Now, as a department manager, I'm taking additional steps to back up information on the cloud in addition to the servers because we are still vulnerable to this type of disaster.