Developing a Contingency Plan - Impact assessment
(Page 2 of 4 )
Before a meaningful plan can be developed, it's necessary to know precisely what is at stake. In short, unless an organization has a clear understanding of the relative value of its assets, there is a serious risk of targeting resources inappropriately, and of providing inadequate protection where it is most required. An impact assessment can help minimize this risk, by establishing a clear hierarchy of the priorities the contingency plan will address.
The basic approach to impact assessment is first, to identify the organization's essential IT resources; second, to identify the likely impact of disruptions to these resources, with particular emphasis on defining acceptable down times; and third, to establish a hierarchy of recovery priorities.
Resource identification involves analyzing the various IT resources to establish which elements of the infrastructure perform which critical functions. When resources have been accurately correlated with their functions, it will become clear which elements of the infrastructure are critical, and which are less so.
Disruption impact analysis takes the data gathered in the previous step and evaluates the impact of disruption to the critical resources, both over time and across related dependent systems. From this analysis the planning architect can identify the point at which the cost of disruption becomes greater than the cost of preventative measures. This assists greatly in determining for how long the organization can afford to accept system downtime, as well as helping to assign appropriate financial resources to implementing the plan.
Recovery priorities will usually be self-evident if accurate data has been gathered and collated in the first two steps. The planning architect will assign relatively greater resources to the recovery of more critical components within the overall framework.
Select measures and controls
The impact assessment stage will help to identify areas where disruption can be significantly reduced by implementing preventative measures. Although in principle prevention is always better than cure, whether this is true in any specific case will come down to a cost assessment.
For example, if the financial cost to the business of system downtime is greater than that of generators to virtually eliminate the risk of this, the generators are a sound investment. However in many cases the reduced financial outlay required to ensure rapid restoration will be more than adequate. Many such decisions will need to be made by the planning architect during the development of the plan.
A wide variety of preventative controls, at various levels of expense, are worth considering. These will typically include, but are by no means limited to, things like UPS devices, generators, fire detection and suppression systems, water sensors and off-site storage arrangements for backup media.
Next: Recovery strategies >>
More Server Administration Articles
More By Bruce Coker
