New statistics* shows disaster recovery (DR) is getting more attention, and more upper level execs become involved with DR issues. Ideally, each company should have an emergency plan in case of power/system failure, loss of access, outside attack, sabotage or else – called DRP (disaster recovery plan) or even DRRP (disaster response and recovery plan). DRP is only a part of risk management practices which ensure emergency preparedness and risk reduction and include such initiatives as regular data backups, stocking recovery software, archiving, etc. – these activities are reflected in PMI and NIST standards.

Contrary to risk management DRP is meant for providing clear-cut instructions in case of emergency, indicating activities required to recover the critical data or services and optionally people responsible for these activities (if not mentioned in other directives) , and thus should be clear and concise, take a look at the DRP diagram. There are two main recovery objectives.

First is the recovery time objective meaning how long a business can continue to function without the critical data or services. And the survey results* show the recovery time objectives are currently reduced to 4 hours.

Second one is the recovery point objective which stands for from what time can an organization recover damaged or lost data, which practically means how often an organization should back up their data and how much info they are prepared to lose. In this respect Symantec survey* demonstrates that more than a third of virtual environments do not back up their data on a regular basis, explaining this by absence of good automation.

In a disaster recovery situation a formula “time is money” gets its critical point, as you have limited time not only to restore and get in order your data, but also to find necessary means for this. Hopefully, the DRP specifies all necessary contacts and services to help you avoid taking unwise steps in a rush.

Another time-dependent problem appears to be testing and absence of necessary resources for regular tests. According to the report results the most popular reason why companies are unwilling to do testing is because of a lack of resources in terms of people’s time (48 % respondents)*.

Relying on their previous studies Symantec claims lack of resources is a general problem throughout many years. I agree with them that introducing tools for easy regular audit and recovery minimizes human involvement and reduces the need to turn to third party services. What I’m also driving at is that our tools are good both for regular password audit and urgent data recovery, e.g. Elcomsoft System Recovery or Advanced EFS Data Recovery.

*Symantec’s fifth annual IT Disaster Recovery survey

** The IT disaster recovery plan