8 Best Practices of Disaster Recovery

For any organization, disaster recovery is important when it comes to protection of mission-critical data and IT systems. In this blog, we talk about how a well thought DR plan can help organizations prevent downtime which can result in loss of customer confidence and damage an organization’s reputation. We also discuss the best practices of disaster recovery that can help you create a good and reliable DR plan.

To simplify your reading experience, here is a brief overview of what we will cover in this blog.

1.   Supporting the Business

One of the most common things we’ve observed is that IT teams and businesses leaders are not in-sync when it comes to disaster recovery planning.

When you talk to business leaders about what is their disaster recovery plan and what are their business requirements or what are their Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs)? It is very rare that the business and IT is in sync on exactly what they need.

The DR plan needs to be clearly sketched out, priorities have to be decided and everybody has to be on the same page, before the accusation of the DR solution.

2.   Plan Ahead & Document

A disaster recovery plan is a very important document. It has to cover different scenarios. You assume the worst; you overestimate the risk because you have to plan for what’s the human impact. 

Human Impact

Human impact is in different things. Are they going to be available? Are there going to be at a 100%? Are they functioning as they need to do?

Oftentimes, its realizing that in a DR event the easier path, even though it might not be a hundred percent of your business back, might be the better way to go. I’d much rather have ninety percent of my business back up and running within a shorter timeframe than to wait a lot longer to get a hundred percent if I really don’t need that last 10 percent.

Never Develop the Plan in a Vacuum

It is also essential to allow others to participate in the plan and make them feel that they are part owner of the plan. You need to let them review it and criticize it and help craft it. These are the key elements that you should not overlook.

Another important thing is to make sure that you actually use your DR plan. Don’t just craft it and leave it in the corner for the dust to make it its own. It doesn’t do any good to document if you’re not actually using it. You let the document evolve as your business evolves. 

Keep Changing the Document as your Business Evolves

Disaster recovery needs to be part of your change management process. As you’re deploying new items or new things into IT, the document itself needs to evolve with those. You need to get it off-site as well as it doesn’t do you any good if you have your disaster recovery plan sitting in your IT shop and it just got demolished by an earthquake or hurricane etc. Make sure you have copies with multiple people, not just on-site but off-site in multiple locations so people can easily access it when needed.

3.  Replicate Everything

Oftentimes, we see people say; ‘why back up my data’? Similarly, you’d be surprised to hear how often people say; ‘I have it on a USB stick or a tape’, or ‘some type of removable media sitting in the trunk of my car’ or ‘down the street in our warehouse or some other location’.

The key here is that you need to replicate everything. You need to replicate the applications, the database and everything you’re going to need to recover your business from an IT perspective. So you need to make sure that’s all in place and it’s available to you somewhere. Don’t just protect the data, protect all that you need to run the business.

4.  Protect On-Site & Off-Site IT Systems

One of the most important thing is to protect on-site and off-site IT systems. You would actually be surprised how many people still, if they are even backing up, will leave the back up on-premises or in the same facility somewhere not making sure they’re protected. So the best recommendation is to have copies on-site and off-site and at least follow the 3-2-1 rule of data protection which states to have 3 copies of data, stored in 2 different types of storage media and 1 copy of it should be stored off-site in the cloud.

 To read more about the 3-2-1 rule, click here.

5.   Automate Disaster Recovery

Everything needs to be automated. In an event of a disaster, you’re asking people to do things that they don’t normally do in a time of crisis and they’re under stress, they’re worried about their families etc. So you know you need to figure out how much of the recovery process you automate so that you can mitigate the human errors, you can mitigate the need for that technical expertise and you don’t require that one key resource.

6.   Testing Your DR System

Testing is the most important practice of DR IT is not a static environment, it’s changing all the time and that is why testing is important. Did I capture the changes? If something changes, did I catch it before a live event? That’s why disaster recovery should be a part of the change control process.

We have seen organizations set up DR systems and not test them at all. This leads to inconvenient situations in the event of a disaster. Make sure you test everything and its interesting people sign up for disaster recovery but they don’t test that often, it’s a shame.

With today’s technology it’s easy to test on a fairly regular basis. Whether it’s every several weeks, testing your entire environment or testing individual servers every day. The other nice thing about it is that you can automate the testing process. You don’t have to rely on human interaction every time and consume consequent resources in the process.

The big thing is test regularly but also test ad-hoc. Your testing thought process should include; we want to fail over our environment today. Sometimes you want to do a live test or you want to fail everything over and start running in the secondary location. Those are things that you need to do from time to time and that’s all part of a good testing plan.

7.   Data Security for Mission-Critical Workloads

Data security is not some conventional security; it is more like these checkboxes;

• Do you have secure data centers?
• Do you have the right certifications based upon the compliance requirements of the business?
• Do you have the proper and right technologies in place?
• Do you encrypt the data when it’s in flight?
• Do you encrypt the data when it’s at rest?

So it’s really, about answering these questions. It’s about whether your data is in the cloud or on-premises, not that is the cloud secure or not as we have moved pass that. Everybody knows that they have their mission-critical workloads in the cloud and they need to undergo certain steps to make sure they are safe and secure.

8.   Choose the Right DR Partner