Two critical cogs in every DR plan — and they must be done in the right order.
A robust Disaster Recovery Plan is a necessity for all businesses — big and small. Two crucial cogs in any DR plan are Business Impact Analysis (BIA) and Risk Analysis. However, they must be executed at the correct stage and in the right sequence for the overall plan to be effective.
The BIA must come first. Its purpose is to determine the most critical business functions and the assets that support them. Once critical functions are identified, Risk Analysis lists the vulnerabilities — both external and internal — that those assets can be subjected to. Together, they form the foundation of a plan that can genuinely restore operations after a disaster.
Device strategies and procedures to help an organization resume normal operations after a disaster
Achieve normal or near-normal production within the shortest possible time after disruption
BIA must be completed before Risk Analysis — identifying critical functions is the prerequisite
BIA determines what matters most — and what questions to ask each operating unit to build an accurate picture of production criticality.
BIA factors in every function that could impact production during a disaster — including halt in revenue-generating activities, loss of production center, death or incapacitation of key staff, and damage to production assets.
By questioning key members of each operating unit, the order of criticality of all functions emerges. Critical questions include: revenue loss per hour during downtime, minimum staff needed to stay operational, minimum assets required for production, and minimum data recovery time.
A well-formulated BIA provides clarity on potential problems, the probable cost of each problem type, the level of protection each unit requires based on criticality, and the minimum asset and staff levels needed to maintain production until normalcy returns.
Once critical functions are identified through BIA, Risk Analysis maps the vulnerabilities — and the common disasters every DR plan must address.
Physical destruction or forced closure of the primary facility — requiring alternate site strategies and standby operations to be defined in the DR plan.
Accidental or malicious data loss — including errors by employees, system failures, and ransomware attacks — must be covered by documented backup and recovery procedures.
System outages, hardware failures, and manufacturing equipment breakdowns that prevent the business from producing goods or services at required levels.
Death, incapacitation, or unavailability of critical staff — addressed through succession planning, cross-training, and documented minimum staffing requirements in the BIA.
Tornadoes, hurricanes, floods, and water damage — using area-specific statistics to assign realistic risk factors and plan responses proportional to probability.
Fire at production centers and power outages are among the most common disaster types — and among the most manageable when adequately anticipated in the DR plan.