How to set up a business recovery plan?

During its existence, a company will have to face various crises and disasters of varying degrees of severity. From a simple computer failure to a natural disaster, including an economic crisis or a cyberattack, business life is rarely a long, quiet river. While it is then necessary to show composure, confidence, innovation and creativity to weather the storm and get out of it, it is essential to plan a business continuity plan (PCA) and/or a business resumption plan (PRA) to describe precisely how to react and thus save your business from bankruptcy.

Discover the 8 steps to set up a PRA within your company and thus ensure the almost immediate recovery of activity following a major crisis or disaster.

1. List all potential risks

Start by making a list of all the risks and threats your business may face. Hardware or software failure, human error, cyber attack, cyber attack, power cuts, power cuts, fire, fire, natural disaster, economic, financial or health crisis, pandemic, etc., whether they are technical, management or risks from the external environment, you should not forget anything. Bring together the managers of each department to help you with this process because you will not be able to think of everything by yourself.

2. Evaluate each risk

Once you have established a list of risks, you need to analyze and assess each risk to determine how likely it is to take place and what its impact will be on the functioning of the business or service concerned. Will it be possible to operate in degraded mode?

You should also ask yourself about business vulnerabilities. For example, in the case of a risk of cyberattack, is the company equipped with a powerful antivirus? Is it updated regularly? Is company data backed up regularly on an external and protected server?

Feel free to search the company's history to find out about previous crises and how they were managed.

3. Define RTO and RPO

The RPO and the RTO are the basic indicators for identifying viable strategies to be integrated into the business recovery plan. These strategies should allow the restart of an operational process in a period of time equal to or close to the RPO/RTO.

RTO, which stands for Recovery Time Objective, represents the maximum allowable duration of interruption of a business process or resource after a disaster in order to avoid serious consequences. This duration is defined according to the production needs of the company in order to continue to be profitable. For example, instant messaging may have a longer RTO because it is not an essential application, unlike a machine that allows production.

RPO or Recovery Point Objective, refers to the maximum amount of data that is acceptable for the business to lose. This indicator determines the goals and strategy for backing up data.

For example, if your business RPO is 24 hours (with a low volume of data), a full database backup at the end of the day may be enough to achieve this goal. RPO depends mainly on the sector of your business and the amount of data processed.

4. Identify critical activities

You must define which activities are essential to the business, which ones must be resumed as a priority to ensure its sustainability. Is it manufacturing, order taking, or delivery? What are the most strategic activities for the company? Which ones can temporarily stop working?

5. Appoint the managers of the PRA

To ensure the implementation, effectiveness and success of the PRA, you must mobilize and organize your teams by designating the responsible people who will have to intervene when a crisis occurs. It will also be necessary to train your people in the various procedures.

6. Writing the PRA

The PRA brings together the procedures to be followed and the solutions to be put in place for a rapid resumption of activities in the event of a disaster.

Here are the things your PRA should include:

• data backup strategy;
• risk management;
• the responses to be implemented in the event of a disaster;
• the team responsible for the PRA;
• procedures to be followed for all employees;
• the internal and external communication strategy in case of crisis;
• your insurance contract;
• legal and financial issues;
• appendices with standard forms, ready to fill out.

7. Determine the cost and time frame of the recovery

Setting up a PRA has a cost that must be expected. For example, to facilitate the remote work of your employees, you will probably have to invest in one or more tools. What other investments or expenses will you need to make in order for your business to resume quickly (a second server, additional production machines, laptops for remote workers, etc.)?

You must also take into account the time required to resume business. The longer your business is at a standstill, the more significant financial losses you suffer. It is therefore important to know how long (1 hour, 24 hours, two days, etc.) your business can resume normal or degraded activity.

8. Test your business recovery plan

It is important to test your PRA in order to verify its effectiveness and to detect its weaknesses to correct them before a disaster occurs. It is also an opportunity to see how your employees react in an emergency situation, and if they need to be further trained.

Finally, we live in a constantly changing society, and the dangers, threats, and other unforeseen events that may arise take on new forms every day. Testing your PRA is also an opportunity to update it.

Conclusion

The objective of a business recovery plan is to minimize the impact of an incident or crisis, to recover from it, and to ensure that the business returns to normal operations as quickly as possible.

Follow these 8 steps to set up an effective PRA and thus ensure the rapid recovery of your business activity after an incident, regardless of its nature.