Establishing Disaster Recovery and Business Continuity Plans in Your Administration

While many believe that disaster recovery and business continuity are the same, the two terms represent different but related strategies for how your local government must prepare for, and react to, an event that disrupts municipal operations. In response to the current COVID-19 pandemic and its unprecedented impact on private and public sector entities, CIOs across the nation are looking to refine or develop both their disaster recovery and business continuity plans.

Both strategies are needed to ensure that your community can recover from an unexpected disaster. Learn the fundamental differences between the two, and how to expedite your planning process today.

What is Disaster Recovery?

Disaster recovery refers to a security strategy involving the development of specific policies and workflows to restore data and applications critical for business operations should a data center, servers, or other instrumental infrastructure become damaged or destroyed. Every public and private sector entity should have a disaster recovery plan in place to minimize any operational downtime.

Threats to Civic Data

CIOs know that a wide variety of risks already keep their staff members on alert. However, a mandate for staff to work from home, natural disasters, local or international acts of terrorism, fires that damage paper records, equipment breakage, loss of electric power, downed communication lines, a digital security breach, or a hack of your local government website could all be events that require a disaster recovery plan to be put into effect.

What is Business Continuity?

Business continuity planning is a strategy that ensures business operations can continue with minimal downtime when a disaster strikes. Having a business continuity plan in place means identifying all possible threats and risks to municipal services and being able to quickly execute a plan to ensure critical personnel can accomplish the work needed to move operations forward. In the case of local governments that do not run from 8 to 5 Mondays through Fridays, business continuity considerations are much more complicated and involved than those of the private sector.

Threats to Municipal Operations

In addition to the impact that COVID-19 has had on the nation and the world, natural disasters, acts of terrorism, and cyber-attacks may also impede standard government administrations. A comprehensive business continuity plan should also address the unexpected departure of key employees or elected officials or civil unrest.

Local Government Information Technology Disaster Recovery Considerations

CIOs of cities, counties, and other municipalities should include the following considerations in any municipal disaster recovery plan:

• Server restoration
• A digital file back-up and recovery system
• Securing the use of local networks

Also, the following functions should be taken into consideration when creating a business continuity plan:

• Employee payroll
• Pension payments
• Distribution of citizen tax notices
• Collecting and processing taxes and other citizen payments
• Staffing contingency plans
• A safe building out of which staff may operate in the event their primary work areas are inaccessible

Getting Started

COVID-19 has heightened the awareness of the need for disaster recovery and business continuity plans. It’s not too late to put processes into place to protect your community, even amidst the current organizational emergency response priorities. To get started developing the necessary emergency preparedness strategies in your community, follow the tips below.

• Get Help. The first step is not to put pressure on yourself to build a strategy in a silo. Organize a business continuity team with representatives from all critical administrative departments to ensure decision-makers are considering all perspectives during the planning process.
• Identify Causes. Identify the types of unexpected and disruptive events that could trigger another implementation of your disaster recovery or business continuity plan. Any activity on your list should have the potential to impact:
  • A loss of information
  • A loss of data access
  • A disruption of employee productivity

• Analyze. Conduct a business impact analysis in collaboration with leaders of all departments to identify the time-sensitive, critical business components, and operations that would be impacted by an unexpected disaster, and the resources that support them.
• Identify Key Functions. Identify the business functions that are mission-critical and then ensure employee cross-training occurs to eliminate points of failure should specific staff members or departments ever be inaccessible. For each essential service, calculate the Recovery Time Objective (RTO). This analytical component is the point in time when a function or process must be recovered before potentially devastating consequences could occur.
• Outline Manual Workarounds. Any disaster recovery plan should include the identification and detail of manual workarounds if digital systems are unavailable. For example, could retiree payments be processed manually if your billing system ever went off-line for an extended period?
• Train Staff. Ensure all employees, especially managers, receive training on what their roles are, and how they should obtain necessary information in the event a business continuity or disaster recovery plan is executed.
• Test. Ideally, you would test the procedures outlined in your plan in advance of a disaster. Given the current landscape, consider your test to be a small roll-out or trial and feedback session with a strategic number of relevant, impacted staff members. Even if you are currently in a crisis response mode, your planning will be rendered ineffective if miscalculated. Separate testing of each plan component will give all involved the confidence needed to act accordingly in the event of a real emergency. It will also provide you with time to make the necessary adjustments to ensure your plan will be successful if an emergency occurs.

• Communicate Externally. Citizens need to know your community has established and validated a disaster recovery and business continuity plan. Doing so will reinforce their confidence in their local leaders and will let them know what to expect from their local government’s operations in the event of a local disaster.

While the COVID-19 pandemic is rapidly redefining how public and private sector entities operate, it is comforting to know that while challenging, we will all learn valuable lessons from this experience. By leveraging what we learn, we will be best positioned to respond the next time any disaster disrupts our society.