Senior management needs to be committed to the necessity for disaster recovery planning. It is important to enlist company wide, top-down support for emergency preparedness and disaster planning. Only your company's employees can save your business. Civic resources are concerned primarily—albeit understandably—with saving lives, not your company's assets. If a disaster occurs in your community, local government and disaster relief organizations will offer the assistance they can, but only those people who know your mission and operation can create an effective plan to minimize your losses. A crisis commonly precipitates confusion. In chaos, any emergency situation deteriorates. Armed with a plan, those people charged with its execution can respond in an orderly, rational way. A plan will allow decisions to be made along pre-established guidelines by people charged with the responsibility to make them and the authority to implement them.

The first step in the formation of a recovery plan is the appointment of the department and person in charge. In many organizations the responsibility falls to the security department, in others to safety. Regardless of where the task falls, recovery planning is best accomplished through a team effort. All departments and locations of an organization need to be involved. The functional heads of those departments and/or their direct reports are the logical choices. One official serves as the overall plan coordinator. There should also be a coordinator at each facility reporting to corporate headquarters. Ideally the coordinators should be tested decision-makers, regularly responsible for handling emergency situations. Plan coordinators liaison with local resources such as fire, Red Cross, police and community counseling groups as well as the local government representative responsible for emergency planning. Other commercial and public institutions also can be useful. In some states there is a directory of emergency response equipment and expertise available in the private sector. Emergency response coordinators also ensure that usual department boundaries do not impede a smooth disaster response. In a crisis, a reconfiguration of the usual lines of authority and status quo may be necessary. The organization's ability to be flexible is critical. It may be necessary, for example, to relocate some groups or functions. The coordinators' authority must take precedence during an emergency response or disaster recovery situation. Define your team members' responsibilities and authority. Evaluate each member's strengths and skills. Your public relations department head, for example, might be the logical choice for the company's spokesperson during the crisis. He or she would be most adept at handling the press and have the contacts necessary to elicit their cooperation. The company medical personnel would be the logical choice to set up emergency medical response; the security department to write an evacuation plan, etc. Each person and department will bring his or her own expertise to the planning process.

A generally agreed upon guideline suggests we first protect human life; second, eliminate or minimize the risk of injury; third, protect physical assets including electronic data; fourth, minimize inevitable losses; and last, resume normal operations as quickly as possible. Every organization is unique, and within these general guidelines a more specific plan needs to be developed. Evaluate your mission—the primary concerns for hospital are very different from those of a telephone company or a retailer, for example. Once the steps have been taken to preserve the lives and well-being of your organization's population, what is your next priority? Is it the resumption of service, the safeguarding of inventory or the preservation of data? Prioritize your organization's departmental functions. Determine which are critical to sustain or resume your operation. Ascertain what support systems: utilities, vendors, suppliers, etc., are essential to those functions' maintenance. Identify alternative sources. Make sure your suppliers have contingency plans.

Many organizations already have in place many of the pieces necessary to an emergency response/disaster recovery plan. An emergency response or disaster preparedness program typically falls under the auspices of the security department as many of the plan's elements are already incorporated into every day security procedures. Alarm systems serve as an early warning in the event of a fire, access control systems will tell you who is in a building, evacuation and bomb threat procedures may be in place. Staff members may be trained in first aid or certified as Emergency Medical Technicians. Company vehicles are most-likely inventoried and traffic control procedures in place. Each department in your organization may have valuable resources to contribute.

The plan should be in writing and be disseminated to every facility and department. Instructions should be clear and easy to follow, but allow flexibility for the contingencies of each unique situation. Communicate the existence of the plan to every employee. Make it accessible to everyone. Keep the Plan Up-to-Date Organizations change continuously. Any plan needs to be reviewed often to assure that changes in personnel and facilities will not render the plan obsolete. A computer program dedicated to disaster planning can be helpful in making the on-going changes and in reviewing the required disaster control resources.

A plan should not undergo its first test during a crisis. Regardless of how carefully crafted, the plan will probably reveal deficiencies during practice. A rehearsal will also provide employees with valuable training. Simulated exercises may be used to test parts of the plan so that your entire organization need not be disrupted. The communications team, data recovery team, emergency medical response people, etc. may practice their roles independent of the others. It is most important that everyone know his or her role and be proficient in its execution. A plan should provide the basis for orderly actions, communication and decision-making. A recovery plan can be comprehensive and detailed, including a contingency plan for every type of conceivable threat, or it may be generic and fairly simple. Most importantly, almost any plan is better than no plan.