One of the fallouts of the Sarbanes-Oxley law is a renewed emphasis on disaster recovery planning. Most practitioners call it Business Continuation these days to signify that it is more than having a tape backup. Recently, we've been working with many of our Indianapolis small business computer consulting customers to review, rewrite, or create plans that are significant enough to pass the muster of the auditors who spend time auditing SarBox sized organizations.

What we found as we started is that most of our IT outsourcing customers had the kind of plan that would allow them to say, "Sure we have a Disaster Recovery Plan. It's right here." The truth being that these were just place holder documents. They've not been touched since they were first created, while their computer network has gone thru enormous changes. As their IT consultant, I have to take the blame for letting them get by with this. However, in light of the mishaps that get reported nearly every day in the media, we're tackling this site by site, starting with ourselves. That's right. We had a check-the-box plan as well, and I know that most of my peers in the computer tech support field are the same way.


Today I finished the Port-to-Port Consulting Business Continuation Plan. It represents our computer network as it exists right now. It has scheduled tests of all of its features at least once per year. Surprisingly, I feel more comforted after having done it. The process pointed out things we had been overestimating about our ability to get back to work after a disaster.

If your DR plan was slapped together by a summer intern six years ago, you'd do yourself and your organization well to dust it off and give it a thorough review with your IT service manager.