Every System Security Plan should address Disaster Recovery. We've spoken about whether your DR design needs to be exercised (Spoiler alert: It does, and more often than you'd like!) There are a number of DR strategies one could go with, but they typically fall into two camps: Fail-in and Fail-out. In pre-pandemic times, the standard was usually Fail-in. That is, when things went bad, the CISO, or other designated personnel, would send up the Bat signal, and staff would then gather at a COOP location and conduct recovery activities. Can you imagine asking employees to group together at an alternate location today? Fail-out, on the other hand, disperses the recovery team to disparate locations when the DR plan is activated. The good news is that you're probably already positioned to easily transition to Fail-out. As we've shifted to the new normal of working from home, we're continuously weaponizing the dispersed model of operation. But here's the thing: you still need to update your DR plan to take advantage of this. You also need to socialize and regularly exercise the new procedure. Some of the challenges with updating to fail-out will be as mundane as establishing new communication processes in the event of a disaster. The good news, again, is that you've probably already solved those issues, simply to facilitate your new working from home policy.
Even after doing that, however, you might find another quarter has gone by without exercising your DR plan. Get on it!
If you need help revamping, or formalizing DR plans, call us. We can help get you on track.