What are the most important MIS best practices for disaster recovery and business continuity?

In my experience, the most crucial MIS best practices for disaster recovery and business continuity center around meticulous planning and proactive measures. It's imperative to have a well-documented disaster recovery plan that outlines specific procedures for data backup, storage, and recovery. Conducting regular risk assessments is vital for identifying potential threats and vulnerabilities, allowing for the implementation of robust security measures. Additionally, ensuring that staff are trained on disaster recovery procedures and regularly testing the plan for effectiveness are essential. Continuous improvement based on test results and evolving threats is key to maintaining a strong business continuity strategy.

The summary is partially accurate. You must conduct a risk assessment. But the specific type of risk assessment needs to include a proper Business Impact Analysis (BIA) so you understand what processes and services are most critical to your organization, which then maps to dependencies on information systems and other assets and resources (people, technology, process and premise) required to support your business operations. Only at this point are you ready to develop a Business Continuity Management System (BCMS). The threats to availability of critical assets are irrelevant if you don’t understand what your critical assets are which is a product of understanding your critical business processes and services.

RTO, RPO, MTD are all metrics that should be captured at the process or service level, driven by a formal BIA. The asset dependencies of the process or service will inherit the Criticality of the process or service. (In most instances)

Consider 4 major areas here as far as comprehensive BCDR planning and coordination: 1. Systems Failover & Fail-back Plan 2. DR communication & Logistics Plan (travel, meals, per diems, local resources) - if premise relocation is required; let’s say to avoid a hurricane impact 3. Security Controls Assessment (post failover) 4. System Reconstitution Procedures (an important nice to have)

It’s the little things that get you. Make sure to conduct an Annual Business Impact Analysis involving leaders from other business units for completeness and accuracy. This also provides awareness of Availability processes across the organization. Each year you learn new little nuances and dependencies that incrementally lead to a solid BCMS. And you MUST perform annual test failovers as systems change frequently. How aggressive you are with testing will be driven by how critical your Availability is to your organizations viability. Finally, make sure to perform semi-annual Business Continuity and Disaster Recovery (BCDR) Tabletop Exercises (TTX). This will help your team to prepare and will help to catch gaps in planning and response.