TEST YOUR DISASTER PLAN

A couple of years ago a major business operating in the Midlands (no names!) engaged me to audit their disaster recovery plans and to run a live exercise to test their resilience. Their plan was professional and comprehensive. Not surprisingly because they had a first class systems team working on it. Their ICT department and datacentre were housed in their headquarters building and they backed up their data to a warm backup site. They even tested the time it took for the backup site to get online. Real textbook stuff. With one weak point.

The headquarters building was under the flight path of an international airport so the exercise involved an airliner crashing, on and obliterating, the headquarters building. How quickly could their operations get back on line?

On the morning of the test the dialogue with the IT manager (let’s call him “Gerry”) went like this:

ME: “at 0849 this morning an Airbus 320 impacted with this building completely destroying it and killing or incapacitating everyone inside. What is the next step?”
GERRY: “I phone the backup centre and authorise them to activate the suite”
ME: “and how are you going to do that?”
GERRY: “by phone. I will use my mobile. I have them on speed dial”
ME: “what time did you get to the office today?”
GERRY: “Eight-thirty”
ME: “So what does that make you?”
GERRY: “Oh … dead!”

Only one error but it kippered the entire plan and it was discovered because they were thorough and professional and ran an exercise. Most organisations never test their plan