Over the past 25 years, the continuity profession’s ideas regarding what constitutes a good recovery plan have undergone substantial evolution. Excess detail, preparing for one event at a time, and a hazards-oriented approach are out, while four key principles—including the idea that a recovery plan should be tailored to fit the culture of the organization—are in.
Related: The Science and Art of Writing an IT/DR Recovery Plan
Summary
- Modern recovery plans should give knowledgeable people the right level of guidance without burying them in unnecessary detail.
- Plans should reflect the organization’s culture, prepare for multiple simultaneous disruptions, and focus on impacts rather than specific hazards.
- Activation criteria, mobilization steps, and the transition back to normal operations are practical details that help make a recovery plan usable.
Three Outmoded Recovery Plan Ideas
In the 25 years that I’ve been working in the field of business continuity, a few things have definitely not changed. To give just one (unfortunate) example, the leaders of today are no more eager to invest in business continuity than the executives of a quarter-century ago. However, many things in the field have changed dramatically.
Most of the shifts have been in the area of technology, but another domain that has undergone substantial change is the recovery plan—specifically how such plans should be written and what they should include.
Back then, three ideas about recovery plans seemed self-evident. Today, most practitioners and consultants regard them as ill-advised, to say the least.
We used to think that a recovery plan should be written with so much detail it could be implemented by people with no knowledge of the organization or business area. We realized this was misguided when it started resulting in plans so bloated with elementary explanatory content, nobody could penetrate them.
Another idea we used to have was that it was sufficient to plan to recover from one disaster at a time. This certainly made things easier for everyone, but it always amounted to wishful thinking. And in today’s landscape of far-flung supply networks and proliferating threats, this approach has been recognized as fundamentally irresponsible. Nobody today can safely expect outages will come at them one at a time, with each new one politely waiting until the previous ones are resolved.
The third outdated idea was that recovery planning should be organized around specific hazards. Now we recognize that what matters most is not the nature of the disruption but the nature of the impact, so we keep our recovery planning event neutral.
Principles of a Modern Recovery Plan
Even as certain concepts about recovery plans have been discarded, others have retained their relevance or only recently emerged. In my view, there are four principles that make up the most up-to-date thinking regarding the contents of a good recovery plan.
1. Write the Plan for People With Expert Knowledge
A recovery plan should be written with the expectation that the recovery will be performed by someone with expert knowledge of the relevant field. Rather than spelling out every detail of the required tasks, the plan should focus on essential recovery procedures and information specific to that organization, such as codes, dependencies, and nonstandard implementations. Plans should be written to the “Goldilocks standard”: not so detailed as to be impenetrable but not so sketchy that even a knowledgeable person is at a loss what to do.
2. Tailor the Recovery Plan to the Organization’s Culture
The recovery plan should be tailored to fit the culture of the organization. As a consultant, I wouldn’t write a recovery plan the same way for a Hartford insurance firm and a Silicon Valley tech company. Chances are the two organizations would have vastly different needs, expectations, and levels of patience in terms of background information and policy.
3. Prepare for More Than One Disruption at a Time
In today’s world you need to make sure your plan is designed to address more than one disruption at a time. The world has become more volatile and interconnected, and many companies are more far-flung in their footprint and supply chains than they were 25 years ago. These changes mean that contemporary planners need to prepare their organizations to handle multiple disruptions simultaneously.
4. Keep the Recovery Plan Event Neutral
Keep the plan event neutral. Don’t write plans that discuss what to do in the event of hurricanes or power outages or what have you. We now understand that’s taking the shovel from the wrong end. Write your plans based on the impact to the organization. Four key scenarios to consider are: 1) loss of facility or region, 2) loss of technology, 3) loss of people, 4) loss of a critical supplier. Write plans to enable you to recover from these scenarios.
In sum, a good recovery plan is one that people can actually use: one that gives them the right guidance, fits the organization, and prepares them to recover from multiple disruptions regardless of what caused them.
Other Essential Elements
The four principles above provide the foundation for a good recovery plan. But a few additional elements are essential to making the plan work in practice:
- Determine ahead of time what triggers or benchmarks will prompt you to activate the plan.
- Establish the steps for activating the plan.
- Decide how you will mobilize the people needed to carry out the recovery.
- Determine how the organization will transition back to normal operations once the disruption has been resolved.
If you neglect these practical details, even a strategically sound recovery plan can fall apart when you need it most.
Make Your Recovery Plan Work
The profession’s thinking regarding what constitutes a sound recovery plan has evolved significantly over the past 25 years. Old ideas that plans should spell out every detail, address one disaster at a time, and be built around specific hazards have given way to a cleaner, more practical approach.
Today, we understand that the most effective plans are written for knowledgeable people, tailored to the organization, designed for multiple simultaneous disruptions, and focused on impacts rather than causes. We also recognize that organizations need clear criteria for when to activate their plans, a way to mobilize the people needed for recovery, and a plan for returning to normal operations.
A recovery plan is only as good as its ability to guide people through a real disruption. MHA Consulting can help you evaluate your plans, identify gaps, and make sure your recovery strategy is practical, actionable, and suited to your organization. Contact us to discuss how to strengthen your recovery planning.
Further Reading
- The Science and Art of Writing an IT/DR Recovery Plan
- Double Trouble: How to Handle Multiple Business Disruptions
- How to Create a Business Continuity Plan: 20 Practical Steps
- The Devil Is in the Details: How Small Oversights Can Derail Your Recovery
- In the Era of Rogue AI, Recoverability Matters More Than Ever
Frequently Asked Questions
What are three outdated assumptions about recovery planning?
Recovery plans no longer need to spell out every detail for people unfamiliar with the organization, assume that disruptions will occur one at a time, or be organized around specific hazards. Modern plans focus on practical recovery needs and the impacts of disruptions.
How detailed should a recovery plan be?
It should follow the “Goldilocks standard”: detailed enough to give knowledgeable professionals the essential recovery procedures and organization-specific information they need, but not so bloated that it becomes difficult to use.
Why should a recovery plan reflect the organization’s culture?
Organizations differ in their needs, expectations, and tolerance for background information and policy. A plan for an insurance firm, for example, may need to look quite different from one for a tech company.
How should modern recovery plans address disruptions?
Plans should anticipate multiple disruptions occurring simultaneously and focus on their impacts rather than their causes. Key scenarios include the loss of a facility, technology, personnel, or a critical supplier.
What additional elements help make a recovery plan effective?
Organizations should establish clear criteria and procedures for activating the plan, determine how to mobilize the people needed for recovery, and plan for the transition back to normal operations. Without these practical details, even a well-designed plan can fail when it is needed most.
