In successful contingency planning, it is important to test and
evaluate the plan regularly.
Data processing operations are volatile in nature, resulting in
frequent changes to equipment, programs, and documentation. These actions
make it critical to consider the plan as a changing document.
Table 1 should be helpful
for conducting a recovery test.
Table 1. Checklist for testing the
disaster recovery plan
Item |
Yes |
No |
Applicable |
Not applicable |
Comments |
Conducting a Recovery Test |
|
|
|
|
|
- Select the purpose of the test. What aspects of the plan are being evaluated?
- Describe the objectives of the test. How will you measure successful achievement
of the objectives?
- Meet with management and explain the test and objectives. Gain their agreement
and support.
- Have management announce the test and the expected completion time.
- Collect test results at the end of the test period.
- Evaluate results. Was recovery successful? Why or why not?
- Determine the implications of the test results. Does successful recovery
in a simple case imply successful recovery for all critical jobs in the tolerable
outage period?
- Make suggestions for changes. Call for responses by a given date.
- Notify other areas of results. Include users and auditors.
- Change the disaster recovery plan manual as necessary.
|
|
|
|
|
|
|
|
|
|
|
|
Areas to be tested |
|
|
|
|
|
- Recovery of individual application systems by using files and documentation
stored off-site.
- Reloading of system save media and performing an initial program load
(IPL) by using files and documentation stored off-site.
- Ability to process on a different computer.
- Ability of management to determine priority of systems with limited processing.
- Ability to recover and process successfully without key people.
- Ability of the plan to clarify areas of responsibility and the chain of
command.
- Effectiveness of security measures and security bypass procedures during
the recovery period.
- Ability to accomplish emergency evacuation and basic first-aid responses.
- Ability of users of real time systems to cope with a temporary loss of
online information.
- Ability of users to continue day-to-day operations without applications
or jobs that are considered noncritical.
- Ability to contact the key people or their designated alternates quickly.
- Ability of data entry personnel to provide the input to critical systems
by using alternate sites and different input media.
- Availability of peripheral equipment and processing, such as printers
and scanners.
- Availability of support equipment, such as air conditioners and dehumidifiers.
- Availability of support: supplies, transportation, communication.
- Distribution of output produced at the recovery site.
- Availability of important forms and paper stock.
- Ability to adapt plan to lesser disasters.
|
|
|
|
|
|