The primary goal of your Disaster Recovery Plan will be to get the essential components of your business back to full operation as quickly as possible. For you to have any real chance of accomplishing that goal, you’re going to need to set out in advance all the things you need for those essential components to operate.
Those things, from software applications to computer and networking equipment, from HVAC systems to backup storage drives, are your Business-Critical Systems. The last thing you want to be doing when disaster strikes is trying to remember all those things – from big, obvious items like computers and phones, to the less-obvious yet very-necessary things, like charging cables.
Here’s how to identify your Business-Critical Systems…
Get Your Copy of our Disaster Recovery Plan Checklist
Identify Your Revenue-Generating and Essential Business Functions
The first thing you need to do is identify the specific services and operations that your business provides. For this aspect, focus primarily on only the business functions that either generate revenue or that are a necessary component of your business.
Note: Certain businesses have functions, systems, or operations that may not generate revenue themselves, but are a necessary component of the business. For example, in law firms, the system that performs conflict-of-interest checks does not generate revenue, but most law firms are required to perform the checks by their state bar and/or insurance company, so being able to perform that operation is not optional.
Bear in mind that not all business activities will continue following a disaster – this list is meant to be a list of applications/services/operations that are required for the business’s survival, based on a phased restoration of business-critical applications, services, and operations.
Once your list is assembled, to the extent possible, rank the list in order of most-business-critical to least-business-critical. The criteria for your determination should include how central the function is to your business’s regular, ongoing operations, and the length of time you could go without using that function or system without disrupting your operations.
A helpful list of questions includes:
- If not performed at all, how much loss would your business suffer?
- If not performed in a timely manner, how much financial loss would your business suffer?
- Is the application/system required to meet legal or contractual obligations or regulatory compliance obligations?
- How long can your business go without using/performing this application/service?
- Are there single points of failure (one-person departments, only one source of information, etc.) for the application/service?
Once you have a prioritized list of essential business functions, it’s time to list all the tools and equipment your business uses to perform those functions.
Identify Necessary Applications, Systems, Equipment, and Supplies
Once you’ve identified the functions that are essential for your business to survive, you need to identify all the tools your business uses to perform those functions. For the purposes of your Disaster Recovery Plan, these will be your Business-Critical Systems assets.
The assets themselves can be broken down into several different categories. I prefer essentially a three-part system (applications, equipment, supplies), but there are other options as well, and the list may be more complicated for larger companies or for Disaster Recovery Plans that need to provide for numerous recovery options.
Business-Critical Systems – Applications
The first list is the applications or software systems that your business uses to perform its Business-Critical Systems. These would include systems used to record sales (a Point-of-Sale system, for example), systems used to communicate with clients, accounting applications, or any other application that generates data that you use in your business.
Your Application List should include the name of the application, the manufacturer/developer, whether the application itself is critical to your business operations or not, whether it is a fixed asset or is either mobile or cloud-based, and its backup schedule (if applicable).
Since most businesses do not frequently change the software and applications used to perform Business-Critical Systems, it is unlikely that frequent auditing of this list will be necessary. You should evaluate your business’s use of its business-critical applications to determine how frequently changes are made to those applications. Regardless, make sure that the list is updated at least annually.
Example Application List
| Application name | Critical Yes / No | Fixed asset Yes / No | Manufacturer | Comments/Backup Schedule |
Business-Critical Systems – Equipment
Your applications and software are worthless without the equipment needed to run them. The next list you make, fittingly, is for that equipment. Your list of critical equipment should contain all the equipment that your business relies upon for operation. While your mind will first undoubtedly go to workstations, printers, servers, networking equipment, and the like, this list needs to also include any equipment necessary to keep the user-interfacing equipment running.
That means if your business has significant server and/or network storage facilities, your equipment list should include all the necessary HVAC equipment to keep your equipment that requires sustained environmental conditions running effectively as well.
One major difference between your applications and your equipment is based on the relatively ephemeral nature of software versus the physical nature of equipment. You need to know not just that you have an enterprise printer, but its manufacturer, model number, and serial number. Since this list will also serve as the basis for seeking replacements for the equipment in the event it is lost or destroyed, you will also need to record whether you own or lease the equipment (if it’s a lease, you probably need to include contact information for the vendor among your Disaster Recovery Plan’s third-party contact list).
It will also be helpful to list how much replacing that equipment will cost (although trying to figure out what the price would be in an emergency is probably going to be too difficult to predict, so I recommend simply listing the purchase price for a new or used replacement).
Unlike applications, your company probably changes out equipment at a regular pace. As such, it is recommended that your equipment list is audited and updated at least quarterly, but potentially more frequently depending on your business’s practices.
Example Equipment List
| Manufacturer | Description | Model | Serial No. | Own or Lease | Cost |
This list should include the following items:
Processing units
System printer
Disk units
Tape and optical devices
Models
Controllers
Workstation controllers\
I/O Processors
Personal computers
General data communication
Spare workstations
Spare displays
Telephones
Racks
Air conditioner or heater
Humidifier or dehumidifier
Business-Critical Systems – Supplies
The last category of things to catalog for your Business-Critical Systems lists are the miscellaneous inventory and supplies that your business needs to maintain normal operations.
Of all the lists in this section, this last one is the one you will probably need the most assistance in putting together. Unlike applications and equipment, which is largely information gathered by or from your IT department or vendor, the information on what supplies you need will involve significant input from your employees.
This list is where you put all the things that you purchase in bulk from an office supplies store or your business manager orders as a relative afterthought. These are the things that you always seem to have around, usually in significant quantity, and don’t realize how much you need until they’re not there.
Everyone has had that moment when your office panics when the printer toner has run out without a replacement. Now imagine that type of panic about supplies your business requires to keep operational, but does not have, in the middle of recovering from a disaster.
Get input from your employees about what materials they rely on to perform their roles. While I would certainly recommend that you perform an informal audit of those materials to determine whether they are truly necessary, rather than a convenience, I would not recommend spending too much time over the voracity of what your people say they need. If they report to you that they need it to do their job, you should probably just add it to the list.
Example Miscellaneous Inventory and Supplies List
| Description | Quantity | Comments |
Note: This list should include the following items:
Tapes
CDs and DVDs
PC software (non-essential)
Emulation packages
File cabinet contents or documentation
Language software (such as COBOL and RPG)
Tape vault contents
Printer supplies (such as paper and forms)
Optical media
This list is very generic. Your list will most likely be unique to your business, as many of the supplies will be dictated by the practices of your individual business and the needs of your specific employees.
