It is essential that you have a reliable Disaster Recovery plan in place to act as the foundation for your multi-layered approach to cybersecurity. It can be hard to plan for the unknown, but with the combination of natural disasters, cyber attacks, hardware failure and human error, it is a matter of when you might experience data loss, not if. The cost of creating a disaster recovery plan might seem high initially, but when disaster strikes, this plan could be the difference between a bad day at work or putting your organisation out of business. Below is some guidance from on us on how to form your plan.
Step 1: Management
There is often a discourse between IT or security professionals and top management, meaning there is potential for them to see a disaster recovery plan as a wasted insurance policy for something that may never happen. The reality is that at some point in time your business will lose data, whether through error, natural disasters or cyber activity. As your disaster recovery plan will draw on the whole business, you will need approval and commitment from your top management team to ensure your plan is as effective as can be.
Step 2: Your Disaster Committee
In the run up to, and after a disaster, you will need a solid team around you to lead the planning process. There is not one department in your business who are exempt from this – a cyber attack or error or hardware failure could come from anywhere, so it is important that your disaster committee contains representatives from all areas of the business.
Step 3: A Risk Assessment
Your first actionable activity should be to perform a risk assessment. Throughout this process, you should identify areas of your business which you know present a larger risk than others. For example, high-risk employees may be remote workers who rely on public networks, or those who work off of their own device. High-risk departments will be those who handle sensitive personal data, for example the finance teams or customer service department.
Step 4: Set priorities
Unfortunately you won’t be able to plan for every single threat, so this is an important stage to understand your high risk areas. They should be given priority in your plan – some areas will need to be restored urgently to prevent business downtime and a loss of revenue, and some will take longer to fix than others. These areas should be tackled first in the wake of an attack or data loss.
Step 5: Data
Before you create a document outlining your plan, you need to collect some data from each department. You will need to know things like key members or staff, insurance policies, power providers and inventories.
Step 6: Document and test
Now you have collected the above information, you will need to document a plan for each threat you have identified. These should all follow a similar framework: identify and address the source of the threat, how you will secure your premises or infrastructure, how you will assess whether you can continue to operate and how you will begin the process of recovering your data. You will need to test this plan against certain criteria, for example, an acceptable time frame of recovery or whether your business can recover at all. It is essential to perform this test so that you can address any grey areas as soon as possible.
If you would like any more guidance on how to create a disaster recovery plan, get in touch with us.
To see how we can help you leverage a multi layered approach to cyber security, see our Complete Cyber Security offering.