|
|
 |
Planning Ahead Can Help Cities Avoid Loss of Vital Services
by Mike Taylor, MCP and Sherry Hilley, CISA
|
Unless you’re the luckiest person alive, eventually you will have to recover from some type of disaster, whether it’s due to a hurricane or the simple loss of data from a PC hard drive crash. The need for a thorough disaster recovery plan is a necessity to the continuity of operations and citizens’ continued accessibility to government.
The events of September 11 had a lot of businesses and governments scrambling to make sure they have a disaster recovery plan or that their plan is infallible. Following the disaster of September 11, many affected businesses and the government were operational within the first 24 hours. This was contributed to having a thorough disaster recovery plan.
Daily disasters of this magnitude are very unlikely, but there are other types of disasters that threaten our government agencies, especially in Florida. Hurricanes are a very real threat, with hurricane season running from June to November. Other natural disasters such as flooding, tornadoes and fire affect us here as well. A good disaster recovery plan can help your city return to normal operations with minimal down time.
The continued operations of a city depend on management’s awareness of potential disasters, its ability to develop a plan to minimize disruptions of critical functions, and the capability to recovery operations expediently and successfully. A disaster recovery plan is a comprehensive statement of consistent actions to be taken before, during and after a disaster. The plan should be documented and tested to ensure the continuity of operations and availability of critical resources in the event of a disaster.
|
|
The primary objectives for disaster recovery planning are to protect the city and its citizens in the event that all or part of the city’s operations and/or computer services are rendered unusable. Preparedness is the key. The planning process should minimize the disruption of operations, and should ensure some level of organizational stability and an orderly recovery after a disaster. Other objectives of disaster recovery planning include providing a sense of security for employees and citizens, minimizing delays, guaranteeing the reliability of standby systems or procedures, and minimizing decision-making during a disaster.
City management must support and be involved in the development of the disaster-recovery planning process. Management should be responsible for coordinating the disaster recovery plan and ensuring its effectiveness to the city organization. Adequate time and resources need to be committed to the development of a thorough disaster recovery plan. Resources could include both financial considerations and the effort of all personnel involved.
A disaster planning committee should be appointed to oversee the development and implementation of the plan. This committee should include representatives from all departments of the city, especially the administrative, finance, public works, technology, police and fire departments. The committee should prepare a risk analysis and business impact analysis that includes a range of possible disasters, including natural, technical and human threats. Each department of the city should be analyzed to determine the potential consequences associated with each disaster scenario. The risk assessment process also should evaluate the safety of critical documents and vital city records. It is important to assess the effects resulting from loss of information and services.
Each department within the city should define its critical needs and establish priorities for processing and continued operations. They need to evaluate and document functional operations, key personnel, information documents, processing systems, and policies and procedures. Critical needs are defined as the necessary procedures and equipment required to continue operations should a department, computer center, main facility or a combination of these be destroyed or become inaccessible. A method of determining the critical needs of a department is to document all functions performed. Once the primary functions and processes have been identified, they should be ranked in order of priority: critical, essential, and non-essential.
|
|
Once the critical needs have been documented, management can set priorities within departments for the overall recovery of the city. The activities of each department could be given priorities in the following manner:
Critical activities – A disruption in service exceeding one day would jeopardize seriously the operation of the city.
Essential activities – A disruption of service exceeding one week would jeopardize seriously the operation of the city.
Non-essential activities – This information would be convenient to have but would not detract seriously from the operation of the city.
The most practical alternatives for processing in case of a disaster should be researched and evaluated. It is important to consider all aspects of the organization, such as facilities, communications, hardware and software, data and other processing operations.
The plan should be thoroughly developed, including all detailed procedures to be used before, during and after a disaster. The procedures should include methods for maintaining and updating the plan to reflect any significant internal, external or systems changes. The procedures should allow for a regular review of the plan by key personnel within the city. The disaster recovery plan should be structured using a team approach. Specific responsibilities should be assigned to the appropriate team for departmental areas of the city. There should be teams responsible for administrative functions, facilities, logistics, user support, computer backup, restoration and other important functions of the city.
The management team is especially important because it coordinates the recovery process. This team should assess the disaster, activate the recovery plan, and contact team managers. Management team members should be the final decision-makers in setting priorities, policies and procedures. Each team has specific responsibilities that must be completed to ensure successful execution of the plan. The teams should have an assigned manager and an alternate in case the team manager is not available.
It is essential that the plan be thoroughly tested and evaluated on an annual basis. Procedures to update and test the plan should be documented. The tests will provide the city with the assurance that all necessary steps are included in the plan. Testing the plan identifies areas that may need to be updated and demonstrates the city’s ability to recover from a disaster.
Disaster recovery planning involves more than off-site storage or backup processing. Cities also should develop written, comprehensive disaster recovery plans that address all the critical operations and functions of the city. The plan should include documented and tested procedures that, if followed, will ensure the ongoing availability of critical resources and continuity of operations. It is the city management’s ultimate responsibility that the city has a documented and tested plan.
The probability of a catastrophic disaster occurring in a city is doubtful. However, a disaster plan is similar to liability insurance: It provides a certain level of comfort in knowing that if a major catastrophe occurs, it will not result in financial disaster or loss of service to citizens.
For information on the Florida League of Cities’ training, auditing and consulting services, e-mail Frank Hagy, chief information officer, or call him at (407) 835-3471, ext. 137.
Mike Taylor is information services assistant, and Sherry Hilley is training and development manager for the Florida League of Cities.
Reprinted from Quality Cities January/February 2002
Back to Top
Back to Quality Cities Resource Library Listing
|
|
|
