How do you update your disaster recovery plans?

An observation I've made is: 1. Not having a dedicated position responsible only for Emergency Coordination, Planning, Preparedness, Assessment, induction and training, and Scheduled 6 month renewal of assessments (or sooner as needed) such an when a new project is started or ended. 2. Not utilising historical data. Everyone focuses on now and a bit of the future but hasn't researched the historical data that was captured by predecessors. Historical data can be the key to implementing the best Multi Hazard Contingency Plan.

How well trained is the ERT team. How well equipped are they. Incase of an event, how will the IRP be deployed and managed. These are also questions that needs to be asked. With the pre assesment, how well is the fire system incorporated?

Update your disaster recovery plans Assess the current situation to avoid potential risks. Iidentify the critical functions, assets, and resources to prevent threat.

You can start with a threat and vulnerability assessment. FEMA's THIRA training is a great place to start. If you identify the threats around you, you have a better chance of planning and preparing for these incidents. This information can be shared with your organization to ensure everyone knows, which is a great place to begin updating disaster recovery plans. It is rather complicated to update plans if you aren't aware of what could happen.

Understanding your specific organizations capability versus leaders expectations is crucial. Gaps should be known through completing a Threat Hazard Identification Risk Assessment. If there are gaps these should be communicated with a remediation plan. A Planning, Organizing, Equipping, Training, and Exercising (POETE) analysis is a great way to address these gaps to organize your remediation actions. Be sure to socialize all remediations and either get approval or raise awareness the risk of not implementing change.

Understanding your specific organization's capability versus leaders expectations is crucial. Gaps should be known through completing a Threat Hazard Identification Risk Assessment. If there are gaps these should be communicated with a remediation plan. A Planning, Organizing, Equipping, Training, and Exercising (POETE) analysis is a great way to address these gaps to organize your remediation actions. Be sure to socialize all remediations and either get approval or raise awareness the risk of not implementing change.

Organizations change, people leave/retire, and new equipment/resources are implemented over time. A Disaster Recovery Plan is a living document, and should address the organization at the time of the disaster. For this reason it needs to be updated regularly. It should be clear and easy to use. Planners should understand the organization, and tailor the plan to the organization for use. Be sure to notify all stakeholders of changes, and incorporate changes into your test and exercise schedule to build familiarity.

To highlight the importance of updated plans, policies, procedures, etc ... Years ago we had a safety policy for the city, written on it (in bold capital letters) "confidential". After the first evaluation, the writers and 'owners' could not believe that nobody knew what to do. Well, nobody read the document because it was "confidential"

Testing offers a chance to build capability of each responder while building familiarity with their plan. There are some portions of organizations that respond regularly and others that may not. As your disaster recovery plan improves over time make sure to update your test objectives to test these new capabilities and validate new processes or equipment. Additionally, the testing outcomes are a great way to capture the value of changes made or new capabilities that have been added to leaders. Take every chance to tell the story of your efforts.

In the private sector in many cases emergency management and business continuity professionals work with business units who may not have a background in these topics. It is important to educate your stakeholders. For plans to be accurate and planning to be successful to increase preparedness these stakeholders need a baseline understanding of the process to supply accurate information to prepare for outages/disasters. In many cases these efforts are seen as compliance activities. Spend the time to make the case for emergency operations and business continuity showing the value and why these actions are needed. Developing relationships with each stakeholder is crucial to turn them into advocates for the program.