Philip Jan Rothstein quite literally wrote the book about developing and testing disaster recovery plans. While researching his book, Disaster Recovery Testing: Exercising Your Contingency Plan (www.rothstein.com), he interviewed organizations of every shape and size, from Fortune 500 companies to K–12 public school districts. And as president of Rothstein Associates, he specializes in helping organizations manage business risk in the face of unpredictable circumstances. Here’s what he thinks schools should be doing.
Q. What should a district consider when preparing for disasters?
A.Whether you’re a school or a business, the number one consideration is protecting the safety of your people. Employees, family, suppliers, and contractors—they are all essential to making any recovery or contingency program work. No matter how great the plan, it’s not going to happen without the people behind it. When those people are children, ensuring their safety becomes that much more important.
Q. Within the IT organization, what is the most important precaution to take?
A. Without a doubt, it is communications. Web sites. Phones. E-mails. If you can’t get the appropriate messages out, your recovery is going to be handicapped. In the case of a school, you need to be able to contact families, public safety, hospitals, or ambulances. You need to be able to get to the Web site and publish emergency information. When people are putting together disaster plans, too often they assume telephones and email are going to work. You can’t assume you’ll be able to pick up a phone and get a dial tone. You can’t assume district cell phones will have limitless battery life. If the power is out for a while, you can’t recharge the batteries in a cell phone. When approaching a disaster management plan, you need to ask yourself: If something didn’t exist at all, what would be your plausible alternative?
Q. How should a district protect its data from disasters?
A. The best way to protect data is to plan ahead. The first thing I’d advise is that you need to figure out all of this before something goes wrong. Go through a needs assessment. Do a risk assessment. Study the business impact of a disaster. If you’re really focused on exposure to loss, perhaps you can eliminate it. Once you assess your exposure, you can then decide on a strategy for recovery that makes sense.
Q. Whom should a school district involve in disaster recovery planning?
A. Clearly the superintendent and IT person should be involved. It’s also usually a good idea to get an outside perspective. That could be a consultant of course, but it also can be someone from another district, some other partner or organization that can provide some objectivity. Beyond this, at various stages, everyone in the district should be involved. Teachers. Parents. Everyone. Each audience will have their priorities and issues, and each will see risks or concerns that others miss. Similarly, the more contributors, the more likely you are to come up with a process that is cost effective as well as realistic.
Q. What should a good disaster recovery plan cost?
A. Years ago, people used to say that for IT, disaster recovery should be a certain percentage of your budget. What I say is that it costs whatever it costs. Some organizations spend 1 percent or less of their operating budget on disaster planning. Others spend 40 or 50 percent. What you need to do is look at this as an insurance risk, and ask: What premium are you willing to pay?
Q. Is disaster recovery something that can be practiced?
A. Absolutely. In my opinion, an unexercised contingency plan is worse than no plan at all. Without practicing your plan, you don’t know it’s going to work when you need it. The exercise process shows you the weaknesses or errors that need to be cleaned up and corrected. Exercise doesn’t have to be onerous. It could be as simple as getting a handful of people in a room and talking through a scenario for 30 or 40 minutes. Whatever you do, though, do something. Exercise and training keeps a plan alive.
Matt Villano is contributing editor of School CIO.
