A fire breaks out in your hosted data centre. What happens next? Or a ransomware message flashes across the desktops throughout the office. What do you do?
According to IBM, “The global average cost of a data breach in 2023 was USD 4.45 million, a 15% increase over 3 years.” Cyber incidents can cost a significant amount of money, enough to put you out of business.
Disaster recovery is the cyber security process that kicks into action in a data or systems cyber incident emergency. When disaster recovery is done right, you can feel safe in the knowledge that your data and systems are recoverable and won’t burn a huge hole in the business pockets.
Disaster recovery in the cyber security timeline
Disaster recovery plans, processes, and tools kick in when an event occurs that might result in the unwanted loss, change, or corruption of important business data, services, or systems.
Disaster recovery itself starts when the bad stuff begins. Those types of “bad stuff’ events can include cyber attacks, human error, natural disasters, failures in hardware, software, or third party services, regulatory provisions, and malicious insider attacks.
Because we can start to think about how a disaster might occur, we can see where it might impact, and then also consider the effect of the impact, based on data or system criticality, as well as the blast radius. With these ‘what-ifs’ in mind, we can plan for a disaster before it happens, and so we can mitigate and minimise its damage.
Damage can be measured in actual data and systems, monetary losses, regulator fines or restrictions, customer sentiment and attrition, and wider reputational damage. Some events can have the ability to completely decimate a business altogether.
What are the goals of disaster recovery?
While mitigating and minimising damage during and after a disaster are the main goals of disaster recovery, we outline other more specific goals:
- Keep critical services online for business continuity where possible
- Ensure minimal data loss and protection of sensitive data in the event of a disaster
- Reduce downtimes and mean time to recover
- Define and achieve optimal recovery point and recovery time objectives
- Keep customers and other stakeholder sentiments in check
- Test failover procedures before disasters occur
By outlining these goals, organisations identify the preventative, detective and corrective measures that must be made to meet these goals when disaster strikes.
What is included in a Disaster Recovery Plan?
A Disaster Recovery Plan (DRP) outlines how the organisation will achieve its set disaster recovery goals, in practice. The DRP covers:
- Naming responsible people and teams and their roles, tasks, and timelines during and after a disaster event through a Disaster Recovery Plan
- Identified threats and risks, with a strategic contingency plan for each predictable event
- Backup policies
- Communication plans in the event of a disaster, including in-house, to shareholders and the board if applicable, to customers, to regulators, and the public.
- Test plans and scheduling, including scheduled assessments of the DRP itself
What is the best way to fortify disaster recovery efforts?
Frameworks and standards can be a great jump-off point for organisations looking to formalise and fortify their disaster recovery. ISO 27031 is an international standard centred around the Plan-Do-Check-Act cycle in Incident Response and Business Continuity – or disaster recovery. ISO 27031 can extend the ubiquitous ISO 27001 for Information Security Management Systems.
There is also Disaster Recovery-as-a-Service (DRaaS), where organisations who don’t have the in-house resources outsource a DRP and disaster recovery in practice, assured by Service Level Agreements (SLAs).
Gain reassurance with expert disaster recovery
Working alongside a partner who is experienced in implementing and maintaining disaster recovery plans and systems is a clever option.
RIGA can help with creating your comprehensive Disaster Recovery Plan, setting up failover systems and controls, or even providing DRaaS. If you’re serious about making sure your business can stand up to an unexpected systems disaster, then make the call and get in contact with us today.