Disaster Recovery Things You Should Know

Glossary of Terms

Action Plan A succinct listing designed by the Incident Management Team containing specific response actions, recovery strategies and resumption assignments selected to serve the strategies and meet objectives to minimize losses from the current interruption.

Activation The implementation of recovery procedures, activities, and plans in response to an emergency or disaster declaration.

Alternate Crisis Management Center or Alternate Command Center In the event the primary Command Center location is not available, an alternate Command Center will be chosen and activated. (See Crisis Management Center.)

Alternate Site An external space that is activated upon identifying the need to temporarily relocate the conduct of business. Arrangements for occupation and activation of support services and utilities should be maintained as part of disaster recovery planning.

Alternate Team Leader The designated individual who leads and manages the team in the absence of the designated Team Leader.

Assembly Location (Evacuation Site) A clearly identifiable area away from danger, to promote life safety and to allow accounting of employee presence. It should be an area where personnel can remain until the decision for remaining at work or release from work is made. This site may vary depending on the recovery team and circumstances.

Business Functions The principle elements of essential business processes performed by individual work groups or business units. Recovery team responsibilities should directly map to conducting or supporting these functional elements.

Business Impact Analysis (BIA) An analysis that identifies the tangible and intangible impacts of interruptions to business processes. Operational vulnerabilities are usually identified and documented, as well as the effects of information loss, time duration effects, and possible strategies and solutions to minimize both the impacts of interruptions and the effort to recover and fully resume business processes. One should be conducted every four to five years.

Business (Disaster) Recovery Plan A document or set of documents that address response, recovery and resumption procedures for the entire corporation. Areas addressed include Control, direction and information flow , Time to task allocations, Consideration of emergency procedures, Functional task assignment, Resource and material needs, Information use and protection, Risk management and loss mitigation, External business contributors and recipients

Business Resumption Coordinator (As part of Disaster Preparedness) The individual responsible for leading and managing the Disaster preparedness program. Responsibilities include plan maintenance and personnel education and training on the plan.

Business Resumption Coordinator (While Incident Management Team (IMT) Activated) The individual assigned to coordinate and manage all administrative and logistic functions of the Incident Management Team such as logging events, maintaining files, mail delivery, telephone reception, Command Center activation and Alternate Site activation.

Central Office Used by telephone service providers to designate the main switching facility for a region. Most metropolitan areas have several Central Offices.

Cold-Site One or more data center or office space facilities equipped with sufficient pre-qualified environmental conditioning, electrical connectivity, communications access, configurable space and access to accommodate the installation and operation of equipment by critical staff required to resume business operations. In the case of a Data Center, the area should have raised floor, adequate air and water cooling, fixed protection, and sufficient power loading and back-up.

Contingency Planning The activities used to produce a workable Disaster Recovery Plan.

Crisis A time period or continuing condition initiated by an event or incident that precludes the use of normal processes or procedures, demanding focused management attention to prevent intolerable (undesirable) or unacceptable (catastrophic) losses.

Crisis Management Center An on- or off-premise office space, less than a 10 minute drive, where initial assessment, evaluation, and decision making activities take place. It houses the Incident Management Team personnel and other advisors prior to Disaster declaration. Upon activation of the recovery plan, the Command Center, sometimes called the Crisis Management Center, is usually relocated to the Alternate site.

Damage Assessment The post-incident appraisal or determination of actual effects on human, physical, economic, and natural resources.

Damage Restoration The post-incident application of restoration, salvage and scrap criteria, and the coordination, scheduling and management of external vendors and service suppliers.

Data Center Recovery Plan The compilation of strategies and actions that minimize both the impacts of a business interruption and the effort to recover and fully resume business processes. Limited in scope to only those functions commonly associated with information systems organizations such as application creation, maintenance and improvement; central processing operations; computer room maintenance and risk reduction; data base administration, creation and maintenance; data network services and maintenance; digital information protection; "help desk" and end user assistance; production operations and management; system software maintenance and improvement; and voice network services and maintenance.

Data Security The securing and safeguarding of electronic information owned by an organization using technology such as security software packages and data encryption devices.

Disaster An incident prompting implementation of response and recovery activities to avoid or minimize losses. Disasters are unplanned events, often causing physical loss, but always causing intolerable or unacceptable business interruption or disruption.

Disaster Declaration The formal recognition that an incident has interrupted or disrupted business processes long enough to create loss and that extraordinary measures must be taken to prevent further loss. This is the point at which business process recovery must be initiated to prevent unacceptable losses. A formal disaster declaration also triggers insurance provider responses as outlined under contracted coverage.

Disaster Recovery Coordinator (As part of Disaster Preparedness) The individual responsible for leading and managing the Disaster preparedness program. Responsibilities include plan maintenance and personnel education and training on the plan.

Disaster Recovery Coordinator (While Incident Management Team (IMT) Activated) The individual assigned to coordinate and manage all administrative and logistic functions of the Incident Management Team such as logging events, maintaining files, mail delivery, telephone reception, Command Center activation and Alternate Site activation.

Disaster Preparedness Program A group of responsibilities and activities which supports personnel education and training in recovery procedures, management of recovery contracts, recovery plan maintenance, monitoring of supporting programs such as information protection, emergency policies, and contract negotiation for disaster coverage by service providers.

Disaster (Business) Recovery Plan A document or set of documents that address response, recovery and resumption procedures for the entire corporation. Areas addressed include Control, direction and information flow , Time to task allocations, Consideration of emergency procedures, Functional task assignment, Resource and material needs, Information use and protection, Risk management and loss mitigation, External business contributors and recipients

Emergency Programs Corporate policies and directives to provide life safety direction, property and environmental protection, communications and loss prevention.

Emergency Purchasing Policy Criteria, directives and instructions implemented by the corporate purchasers during an emergency to govern acquisition until normal procedures are resumed. These should be more simple and direct than ordinary acquisition processing.

End User An entity that relies on a service or the product of a process.

Evacuation Site A clearly identifiable area away from danger, to promote life safety and to allow accounting of employee presence. It should be an area where personnel can remain until the decision for remaining at work or release from work is made. This site may vary depending on circumstances.

Financial Impact An operating expense that continues following an interruption or disaster, which as a result of the event cannot be offset by income and directly affects the financial position of the organization.

Hazard Identification The process of identifying situations or conditions with the potential of causing injury to people, damage to property, or damage to the environment.

Home Site The original or replacement location of the business operation.

Hot-site A data center facility with sufficient hardware, communications interfaces and environmentally controlled space capable of providing relatively immediate backup data processing support.

Impact Analysis A pre-incident study to estimate the effect that specific incidents can have on an entityÕs operations or activities.

Incident Any unplanned event with the potential to interrupt or disrupt critical business processes, for example: Sabotage or strike, Earthquake, Hurricane, Extended power failure, Sprinkler failure, Fire or explosion.

Incident Command System The combination of facilities, equipment, personnel, procedures, and communications operating within a common organizational structure with responsibility for the management of assigned resources to effectively accomplish stated objectives pertaining to incident.

Incident Commander That individual responsible for leading and managing the incident response and business process recovery and resumption when activity speed, complexity, or duration will be escalated to deal with serious or extreme circumstances. Usually a Vice President or a Chief "X" Officer of the Corporation (for example, CEO, CFO, COO). Assisted by the Incident Management Team. The Incident Commander reports to Executive management.

Incident Management Team A designated group of executive and line managers that controls actions, directs personnel and manages information flow to prevent or minimize loss. Responsibilities include incident assessment and loss evaluation, communication control, escalation actions, administrative and logistic support duties, strategy and reaction selection, disaster declaration and recovery plan activation.

Incident Management Team Plan A consolidation of strategies and activities that promotes Control, direction and information flow, Time to task allocations, Follow up to emergency procedures, Functional task assignment, Resource and material needs, Information use and protection, Risk management and loss mitigation, External business contributors and recipients, Disaster preparedness, Documentation

Specifically, this plan guides the direction of action from recognition to disaster declaration, then from declaration to return to home site, then from plan annotation to plan modification. This plan provides the linkage between the various elements of a comprehensive business recovery.

Information Protection Program Policies and directives that safeguard information in any form (paper records, computer files, microfilm/fiche, magnetic and optical) from damage, destruction, tampering or theft. Should include information required by regulation (e.g., financial records), business value (e.g., copyright or company proprietary), legal (e.g., personnel records in EEO defense), or business requirement (e.g., custom CPU applications).

Maintenance Program A semi-annual internal review process to maintain the quality of the recovery plan. It generally will entail a series of coordination meetings including team leaders and the Business Resumption Coordinator, modification or revision of plan documents, attachments, and forms to reflect evolution of the business, and an exercise of some or all of the recovery plan phases.

Mass Care The temporary housing, feeding, and care of populations displaced by a disaster.

Media Briefing Center A site or telephone number designated and disseminated by the Incident Management Team for controlled release of public statements and information to the mass media.

Media or Official Public Statement A release, drafted by General Counsel and senior management, to provide incident specifics to the mass media and used by all employees in response to status requests and external queries.

Minimum Acceptable Recovery Configuration A time-phased listing of necessary resources needed to re-initiate essential business processes. Each Recovery Team determines its needs based on its functional tasks and their established priority and restart schedule. The MARC includes minimum facility parameters and equipment configurations, and must be reviewed during the ongoing incidentÕs Consolidated Action Plan development.

Milestones Achieving goals and objectives specified in the Recovery Strategy that mark the transition from one phase to the next.

Mitigation Activities taken to eliminate or reduce the degree of risk to life and property from hazards, either prior to or following a disaster.

Mobilization The activation of the recovery organization in response to an emergency or disaster declaration.

Mutual Aid Agreement A pre-arranged agreement developed between two or more entities to render assistance to the parties of the agreement.

Needs Assessment The identification of resources needed to restore vital functions.

Operational Impact An impact that is not quantifiable in financial terms but its effects may be among the most severe in determining the survival of an organization following disaster.

Ongoing Incident File A centralized place, usually a notebook or portable filing box, to safeguard written documentation generated during the crisis. The Business Resumption or Disaster Recovery Coordinator is responsible for establishment, maintenance, completeness and accuracy of inputs and the finished file. This file and its contents should be used by Legal personnel, the Risk Manager, and other executive managers to review and evaluate the actions taken during the crisis.

Organization Assignment List The employee list generated as changes are made to individual employee location, duties and tasks. Maintained by the Incident Management Team for monitoring and resource management. Serves the same purpose as the Personnel Location form, but is tailored to the Incident Management Team.

Outage The interruption of automated processing systems, support services or essential business operations that may result in the companyÕs inability to provide services for some period of time.

Personal Accountability Constant awareness of the location and function of all personnel who are within controlled access areas.

Phases Grouping of milestones and tasks used for ease of textual organization and sequential discussion. for example: Emergency Response, Notification, Team Activation, Assessment, Action Planning, Declaration, Site Activation, Recovery, Resumption, Return

Plan Activation Procedures Those instructions described in each Team Plan to give specific directions for plan initiation and implementation.

Point of Presence (POP) Used in telecommunications to designate that place or situation where the providerÕs responsibility for service ends and the clientÕs responsibility begins.

Preparedness Activities, programs, and systems developed prior to a disaster that are used to support and enhance mitigation of, response to, and recovery from disasters.

Pre-positioned Resource Material (i.e. equipment, forms and supplies) stored at an off-site location(s) to be used in business resumption and recovery operations.

Prevention The process of planning for and/or implementing controls to prevent incidents and manage risks by decreasing the potential for incidents or the affects thereof that may threaten the assets of the organization.

Recovery Those activities performed to enable the re-initiation of business processes.

Recovery Materials Any non-human entity required for response, recovery and resumption. For example, emergency operations manuals are response materials; the Command Center chairs are recovery materials; backup tapes containing the latest data are resumption materials. See Minimum Acceptable Recovery Configuration.

Recovery Solutions Planned recovery resource acquisition techniques, such as those for replacing furniture, equipment, supplies, and for restoring information. Sample recovery solutions include purchase at time of disaster, store redundant equipment offsite, or contract for shippable equipment

Recovery Status Reports A format used by the team leaders to provide status information on milestone and goals accomplishment. Provided to the Incident Management Team at least daily and as objectives are achieved.

Recovery Strategies Planned response and recovery approaches, developed by executive and line management, that include criteria for recovery; criteria for response; facilities for recovery; function priority and restart order and need; and personal and work group responsibilities and tasks.

Recovery Teams Organizational entities created to meet the recovery and resumption needs and charged with specific recovery responsibilities and actions. Each team has a designated Leader, an Alternate Leader(s), and sufficient members to resume functions according to the strategy.

Recovery Team Plan A document that describes the team membership, the procedures to be followed and the MARC necessary to execute the plan.

Recovery Timeline Specific actions that must occur in a calculated, sequential order if recovery from a disruptive event is to be completed according to the Disaster Recovery Plan. Typical sub-groups of the timeline are:
Evaluation and Decision Timeline
Notification - during and after business hours
Management team assembly and initial briefing
Impact and damage assessments
Assessment briefing
Action Plan
Disaster declaration decision

Logistics Timeline
Notification - during and after business hours
Recovery teams assembly and Action Plan briefing
Travel and shipping

Recovery Timeline
Operational recovery
Production recovery

Recovery Window A period of time in which time sensitive business operations must be resumed.

Response Those activities immediately undertaken to prevent or diminish loss. Much like physical reactions to harmful events, like covering eyes and ears during an explosion.

Response Procedures Descriptions of actions and tasks to be rapidly implemented, cited within a Recovery Team plan. These tasks usually have minimal operational impact and should delay or mitigate the losses from business process disruptions or interruptions.

Restoration The process of planning for and implementing full-scale business operations which allow the organization to return to a normal service level.

Resumption The process of planning for and/or implementing the recovery of critical business operations immediately following an interruption or disaster.

Risk Management and Loss Mitigation Programs Programs to control and reduce potential loss. Examples of these include Casualty insurance, Records management programs, Security programs and policies, Audit & control programs

Support Functions Tasks and activities performed in support of other efforts, possibly different in scope during a recovery, for example: Public Relations , Personnel notification, Legal, Mail delivery, Telephone reception, Security

Support Groups or Individuals Entities providing support functions as opposed to resuming critical business processes. Support functions include Human Relations, Legal and Mailroom.

Staging Placing items where they can be obtained, especially during response, recovery and resumption.

Task Any action that contributes to the achievement of a milestone. For example, activating utilities, assigning locations, and scheduling personnel are all part of Alternate Site activation.

Vital Records Any information resource (paper records, computer files, microfilm/fiche, magnetic and optical) that is essential to the conduct of business, identified by management, and under safeguard by the corporationÕs information protection program.

Walk-Through Exercise A training and evaluation event that guides the recovery and resumption organization through a staged business interruption. Subsequent events should occur at least semi-annually as part of the Maintenance program. An oral evaluation review should follow each event.

Warm-site A data center or office facility which is partially equipped with hardware, communications interfaces, electricity and environmental conditioning capable of providing backup operating support.

Work Group The lowest level common organizational unit included within the recovery plan. Work Groups usually parallel the existing business organization (e.g., department, area, section) and have common manage-ment, requiring common response and recovery activities and possessing common recovery resource requirements. For example, a large organizationÕs administrative or operational Work Group includes a single manager or department head, several line supervisors, and 20-50 employees. Smaller organizations may have Work Groups with only a line manager and five employees.