Report on disaster recovery plan

Executive Summary

Introduction

The following is the Disaster Recovery Plan (DRP) for general medical practice ‘St. Paul Medical Services’. The DRP is specifically designed to assist and manage a disaster when it occurs, and also to specify the steps and procedures to take when the worst happens in order to continue operations and return to normal state as soon as possible.

It must be noted that disaster recovery is a team effort. It requires unrelenting dedication and commitment in order to solve the on-going problems on hand. The DRP taskforce should therefore, be an integrated taskforce and not just one that consists of people trying to fulfill their responsibilities by merely working in a solitaire environment.

The planning process is also to protect the medical practice in the event that the network services and operations are deemed unusable. The planning process should also minimize disruptions to normal business operations, while also maintaining stability and instilling the people with preparedness to deal with the disaster in an orderly manner.

Disaster Recovery Planning

There are a few mandatory steps in planning for a disaster recovery plan, which is made up by:

• Organizing DR planning team
• Establish roles and responsibilities
• Risk Assessment
• Develop policies and procedures
• Training and awareness
• Testing and rehearsals

Manpower List

Practice Manager: James

Doctor 1 (Full-time): Peter

Nurse 1: Emily

Doctor 2 (Full-time): Wayne

Nurse 2: Alice

Doctor 3 (Full-time): Steve

Nurse 3: Pauline

Doctor 4 (Part-time): Ray

Nurse 4: Audrey

Counter Staff (Administration): Ellen

Counter Staff (Bookings): Terry

Counter Staff (Billing): Edrissa

IT Services Administrator: Roger

Organizing DR Planning Team

It is vital to have support from all the highest level of management to demonstrate the importance of the disaster recovery plan. For the planning process, a ‘disaster recovery planning coordinator’ will be responsible for the leading the planning team. One who is from mid-level management will occupy this role. This is mainly because the coordinator must dedicate large amounts of time for the planning process. Dr. Ray will fulfill this role, as he is the one who is working part-time and will have adequate spare time to coordinate and lead the planning team.

The planning committee should involve at least one person from different departments so as to cover a wide area of expertise to aid the planning process. An executive champion will be nominated to support the disaster recovery coordinator and the practice manager, as well as to gather resources, ensure participation and cooperation among peers. Team members are expected to coordinate with the executive champion and also to understand their own roles and responsibilities involved.

The purpose of an awareness campaign, which will be kick-started as soon as possible, is to inform the practice that there is a DR planning effort in place, and also to collate enough funds and manpower to work on the plan. The breakdown of roles and responsibilities are listed as below:

Disaster Recovery Scope Statement

“To write an emergency contingency plan, that will serve to recover the organization’s normal business operation from a disaster, in the shortest amount of time possible. Thus plan, will also minimize and try to mitigate risks by assessing the potential threats and take prompt corrective action to review/update upon any discrepancies spotted.”

Roles and Responsibilities

A general breakdown of roles and responsibilities.

Coordinator Tasks

Reporting progress to the manager, James
Develop budget for the plan
Maintaining files for the planning team
Schedule team meetings
Document DR policies and procedures
Handling external vendors for DR support
Schedule tests and rehearsals
Managing maintenance works on the DR plan
Updating the DR plan if necessary

Risk Assessment

Risks are events or actions that might cause a dire consequence to an organization. Therefore to accurately reflect the importance of a certain risk, the assets and the probability of the risk occurring for the asset must be identified.

Assets will be broken down into:

• Personnel
• Office Equipment
• Information Technology

An overall inventory list will be maintained to keep track of the items that show the location of the item, and the updated status for the item. To complement the inventory list, a separate inventory list for personnel, office equipment and information technology will be drawn up as well to show alternatives for the asset in case of an emergency.

Prioritizing Assets for Recovery

After the threats have been identified, the assets will be listed down and analyzed for the criticality to the medical practice. This is to ensure that assets that are deemed most critical to the organization will be given restoration priority in the event of a disaster. The criticality of the assets will be categorized into four categories:

• Critical: Absolutely must be in place for a business to function at all
• Essential: Must be in place to support day-to-day operations
• Necessary: A necessity that contributes to smooth operation and comfort of work for the employees
• Desirable: Enhances the organization’s performance, is a luxury choice

Policies and Procedures

Basic recovery procedures must be in place for all facilities and assets, and the procedures must be specifically designed to suit the specialized needs of the organization. The manager, planning team and all employees for consent, will review the procedures implemented. Disasters can be documented and classified into four different categories:

The DR plan should be straightforward and should contain a sufficient amount of information and procedures that allow for effective response. There are a few mandatory policies that every plan should have:

• Everything must be clearly documented
• Procedures must be written in a clear, concise common language so everyone can understand
• The plan documentation must be available in digital and printed paper format
• There must be separate copies of the documentation at multiple locations
• Every team member must have a copy of the plan
• Every team member should have their contacts listen in the plan

When distributing documentations of the plan, a log has to be maintained to keep track of the amount of copies that has been distributed. Also, the plan is confidential and the procedures in it should not be exposed to anyone else. Therefore, every employee will be required to sign a confidentiality and non-disclosure agreement:

Training and Awareness

Once the DR planning team has come up with the plan, an implementation plan must be developed to ensure responsibilities of team members are assigned, schedules drawn up, documentation distributed to every employee, launching of awareness and training programs.

Organizational levels for distribution will be divided into:

• Organizational level: Required only when doing training, and raising awareness of DR plan
• Facility level: Required when purchasing new equipment and assets for a facility
• Department level: Required only when changing procedures and policies that affects the department
• Work group level: Required only when changing procedures and policies that affects the work group

The purpose of awareness campaigns is to make employees aware of the DR plan, so as to understand disaster recovery and learn about its details and also their individual roles and responsibilities. To ultimate goal of the awareness campaign is to instill in employees the importance of disaster response and recovery.

There are several ways to portray and communicate awareness campaigns; this can be done through the use of:

• Newsletters
• Bulletin boards
• Motivational posters
• Email bulletins and quotes of the day
• Intranet circulation of security information
• Vendors website

The HR department and the public relations department will develop agendas during awareness meetings and training sessions. The announcement will include:

• Basic description of the DR plan
• Mission statement and scope
• Status of the planning process
• Status of implementing the recovery plan
• Schedule for training
• Schedule for testing

It is important to have a orderly and easily understandable training module that will allow for greater interest, and motivate employees towards the common goal, hence, a training module and its elements has been suitably created for the medical practice according to the organizational structure

Testing and Rehearsal

An organization needs a gauge on how well the disaster recovery plan and procedures are going to work when it is put into operation. It is recommended to review the planning team by testing the procedures using a step-by-step testing process, or by using audits once per annum. Live-walkthroughs of the plan will also ensure that procedures are actually implemented and it is a good measure of the effectiveness of the group and the procedures.

During the day of the tests, the following must be taken into consideration and determined before the test commences:

• Time/date, duration, nature of the test (natural disaster, hacking, human error)
• Description of facilities on-going on test date
• How is the test monitored, and who is in charge of monitoring
• What are the procedures tested and the scope of the test
• How are the results gathered and analyzed
• Parameters of the test (what is available and what is not)

When the test commences, the following are the questions that the in-charge of the auditor will want to ask to assess the plan:

• Is the contact information correct for the company?
• Did the procedures include contact information and emergency services?
• Did the procedures include the circumstances in which to contact these services?
• Were the facilities appropriate for the company?
• Were there proper instructions given to the response team?
• Were there proper documents available to the response team when they arrive at the scene?
• Were the appropriate members present at the time of the disaster?
• Was the response team able to assist effectively upon their arrival?
• Was there any on-going communications to request assistance from external vendors?
• Were the procedures documented for forensic purposes?
• Was there a confidential location for trade secrets?
• Is there an off-site designated beforehand?
• Was the transportation of the trade secret to an off-site secure?
• Was the response team given proper instructions on how to enter the disaster scene?
• Were the procedures familiar to the external vendors?
• Were the external vendors able to assist the response team upon their arrival?
• Was there any human error involved during the implementation of the plan
• How quickly did the response team respond to the alarm
• Were the proper items available to emergency services upon their arrival?
• What was the time lapse between the first response time, and the time when the incident happened?

At the end of the tests, employees will be required to fill up a survey, which will determine the effectiveness of the test on employees:

Conclusion

In the wake of various securities related incidents happening in the IT industry, disaster recovery has been in the limelight for the present moment. However studies do show that most organizations are still woefully unprepared for the occurrence of disasters.

If there is a need for a disaster recovery plan, the plan must be tested regularly, so as to keep the technologies within the plan updated and current, as well to prevent vulnerabilities from infiltrating those multi-million dollar machines breathing in the server rooms. A plan that has been under tested will be more of a hindrance to an organization than having no plan at all, for all the resources and manpower will be wasted, because the plan has no real benefits when an actual disaster strikes.

The future of disaster recovery planning lies in the utilization of new technology, which should be market-proven and should fit an organization’s disaster recovery needs. Being flexible in the disaster recovery planning process allows for changes over time and ensures sustainability, which in turn, reaps functionality.

One example is the use of GPS technology to aid in the disaster recovery process. Using a GPS tracking system, a disaster recovery team will be able to visually track first responders in real time and coordinate efforts in order to save critical assets. An integrated system, the mobile tactical collaboration system (MICS) is a web-based wireless-enabled software application that allows personnel to effectively communicate in real time using tactical graphics and digital maps to command and control a team without the need for a command post.

Even with new technologies appearing on the horizon, the essential steps of the planning of the disaster recovery plan remains unchanged, these includes risk analysis, testing, monitoring, training and reviewing of the existing system. With this emphasis on hand, any daunting scenario can be overcome by focusing on the critical processes and establishing a practical and relevant disaster recovery plan for the organization.

Disaster Recovery Plan – Preparation Phase

Introduction

“The difference between losing your business and surviving in business depends on how well you’re prepared for the unexpected.” (Dolewski. R, 2008)

“The primary purpose of DR planning is ultimately the preparation of corporate personnel to respond rationally to the great irrationality of a disaster.” (Jon. T & Margaret T, 2000)

After developing the disaster recovery plan, the next step will be the preparation phase. The purpose of preparation phase is to make sure that everyone involved in the disaster recovery plan is able to react in accordance to what had been documented in the plan. It may sounds easy, but it takes a lot of effort and tremendous amount of team work into getting the job done.

The preparation phase tests on the state of readiness, the efficiency of the disaster recovery team upon activated due to a disaster which had taken place. The definition of ‘preparation phase’ in this report is pretty unique. It is define as the period where a disaster had occurred.

Assumption

“Sometimes, things will change on the fly. An incident can become a disaster in hours, days, or minutes.” (Dolewski. R, 2008)

On the night of 15 March 2010, the manager of the St. Paul Medical Service, Mr. James received a call from the police notifying him that the medical practice was badly affected due to an arson act done to the neighboring store beside St. Paul Medical Service.

Mr. James rushed down to the scene to have a clearer understanding of what had happened and did a general assessment of the damage level done. The police told him that the arson took place at around 2330hr and the arson was targeted at the clothing store next to medical practice. As fabric is a material which catches fire easily, the fire became wild and spread rapidly to St. Paul Medical Service.

Mr. James was relief that the arson took place after working hours which meant that there was no casualty reported. However the medical practice was so badly damage that it is impossible to carry on business. Mr. James then contacted the planning coordinator of the disaster recovery team, Dr. Ray for assistance.

Plan Activation Procedures

The plan activation procedure is an execution of a series of steps which had been documented in disaster recovery plan. When an actual disaster had taken place, everyone will be in a state of chaos; most of the people will be too taken aback and petrify to do anything but to stare at one another. Hence the plan procedure comes in handy at this point of time, giving disaster and recovery team a step-by-step direction to follow through.

Disaster Alert Notification Directory

“Communication is essential for command and control in disaster situation.” (Jon. T & Margaret T, 2000)

Disaster alert notification directory contains a list of persons to be contacted when a disaster occurs. This includes team members, equipment vendors, governmental departments and warm site representatives. The following table shows the contact list of all the important key personnel who are supposed to be notified with regards to the disaster.

Emergency/Disaster Management Flowchart

An emergency/disaster management flowchart is important as it depicts the sequence in which recovery process will be undertaken. It enables disaster recovery team to comprehend the disaster recovery plan as a whole.

The flow chart below shows an overview of St Paul Medical Services Disaster Alert Notification Process.

First-Alert Response

First alert response objective is to ensure that management is informed of a disaster immediately after discovery of the event. The person who is being notified will then verify the severity of the incident, whether to categorized it as incident or disaster.

Upon receiving the phone call and a brief description of what had happened to the medical practice from the police, Mr. James headed straight to medical practice site to have a clearer understanding of the scene and what actually happened. In this case, Mr. James was the first-alert responder.

Disaster Verification

Disaster verification is a process performed to assess the level of damage done, so as to determine whether or not all the recovery teams are to be activated. Mr. James had a general assessment of the scene and was able to categorize the state he saw as a disaster. He was unsure if all the recovery teams had to be activated as he was not involved in the development of disaster recovery plan; hence he contacted Dr. Ray for advice. After further evaluation done by Dr. Ray, he came to a conclusion and that was the disaster required immediate attention as they were unable to continue their business.

Determining Personnel Status

One of the most crucial steps in disaster recovery plan is to determine personnel status. It ensures the safety of personnel onsite after the disaster.

The policeman told Mr. James on the phone that there was no casualty as the fire broke out after working hours. Upon reaching the site, Mr. James reassured himself that there was no casualty reported by checking with the policemen on site and making call to each and every staff working in St Paul Medical Service to ensure they are safe and sound.

Assembling Team Leaders at Command Center

The command center selected was at Lucky Plaza #04-55. However, as the disaster occurred during the small hours, the shopping mall had closed; thus Mr. James and Dr. Ray agreed to hold an immediate meeting at Dr. Ray’s apartment, located at 24 Everitt Road. Dr. Ray apartment is well-facilitated with proper communication devices, internet access and computer systems.

Dr. Ray activated all the disaster recovery team leaders to his apartment for a meeting. The objectives of the meeting were to resolve the following issues:

Damage Assessment Evaluation

The scope of damage assessment is to establish the extent of damage done to critical medical equipments, server hardware infrastructure and facilities. The main focus is to bring critical business functions up and running.

The damage assessment team arrived during noon when the police had completed their investigation and declared that the arson scene was safe and clear to enter. The team consists of the following personnel

• Dr. Ray (Planning Coordinator)
• Dr. Peter (CHAMPION)
• Mr. Roger (Network Leader)
• Dr. Steve (Hardware Leader)
• Miss Ellen (Facilities Leader)

The team walk-through the medical practice, assessing every piece of equipment and facility in detailed. Dr. Ray concluded that the disaster was major near catastrophic. The following diagram showed a list of the equipments left after the arson.

Notification of Personnel

All disaster recovery team member notification will be done by team leaders, who were notified by Dr. Ray. The following information will be revealed to the team member via phone call or e-mails if they are unreachable.

Site Activation

After verifying the condition of the primary site and damage assessment evaluation done, Mr. James, Dr. Peter and Dr. Ray had decided to activate the warm site.

The warm site chosen is a clinic co-shared by St Paul Medical Service and Life Savior Family Clinic as an alternative site in the event of a disaster. Thus, the clinic is already been equipped with the basic medical tools and equipments, furniture and IT systems in placed. However, due to the space constraint, patients who require X-ray will have to proceed to the nearest hospital, Mount Elizabeth Medical Center, which is located behind Lucky Plaza.

Declaring Disaster with Warm Site

In order to declare disaster with warm site, Dr. Chua has to be kept informed. In addition, a list of disaster recovery team personnel who are authorized to formally declare a disaster with warm site coordinator has to be documented.

Location of Warm Site

It is important for the disaster recovery team to know the exact location of the warm site in the event of disaster, so that they can plan whether they are able to go there on their own or require transportation to the warm site. The following map features the location of both original site and warm site.

Transportation Services Available

As the warm site is situated in Lucky Plaza, there are many means of transport which bring the disaster recovery team right to the door step of Lucky Plaza. The following information displays the various types of transport.

BY TRAIN (SMRT)

Alight at NS22 Orchard – North South Line (Red)

Travel By:-

• East West Line (Green) – Transfer train at Raffles Place (EW 14) or City Hall (EW 13)
• North East Line (Purple) – Transfer train at Dobby Ghaut (NE 6)

BY BUS

Alight at Bus Stop (09048) – In front of Lucky Plaza

Travel by:

SBS Buses

Bus No. 7, 14, 14e, 16, 65, 111, 123, 175, 502, 502A, 502B

Transit Link Night Rider

Bus No. NR 1, NR 2, NR 3, NR 4, NR 5 & NR 6

BY CAR (<2.08M)

Enter either from Orchard Road or Nutmeg Road Carpark Entrance

Warm Site Policies

As the warm site is co-shared by two clinics, there are several rules and regulations which must be adhered to when utilizing the premise. These rules were set to ensure that every equipments and facility used are accountable for.

• Employees must park their cars in the designated parking lots, ensuring that the emergency/fire exits, loading and unloading bays are clear from vehicles.
• All personnel who enter and exit the warm-site will have to sign-in and sign-out in the sign-in / sign-out book respectively.
• Any other staff apart from disaster recovery team entering the premise must be approved in advance by disaster recovery coordinator.
• Every equipments and facility must be counted for before returning to primary site.
• Review restoration process with the warm-site coordinator and ensure all the correct tapes have arrived before proceeding with the recovery.
• Ensure that all database stored in the IT systems are treated as confidential data and must be properly disposed / deleted, before returning to primary site.

Roles and Responsibilities at Warm-Site

Every member in the disaster recovery team has different roles to play and responsibilities to shoulder. The following table shows the roles and responsibilities of each member.

Retrieval of Backup Tapes from Offsite Storage

As Edrissa had always kept a complete set of off-site backup tapes in a secured cabinet at warm site, it minimized the duration spent on database server recovery. The backup tapes consist of the following information which is vital to business resumption.

Conclusion

A well documented disaster recovery plan becomes useless when the disaster recovery team makes no effort into putting those policies and procedures into actions. The preparation phase of the disaster recovery plan should not be neglected. It determines the survivability of the St. Paul Medical Services if a disaster was to strike.

If only every organization in the Twin Towers in USA put emphasis into developing Disaster Recovery Plan and taking actions by having frequent drills conducted, many more lives could have been saved.

According to report, the South Tower took 56 minutes while the North Tower took 102 minutes to collapse. During this period of time, if disaster recovery plan were activated and properly managed, the people will feel less petrified and more organized during the evacuation; this in turn will save many lives. Instead of what was being reported, people jumping out of the windows and other shocking acts in order to “evacuate” from the building.

Disaster Recovery Plan – Restoration Phase

Introduction

In the final phrase of the disaster recovery plan of St. Paul Medical Service is the restoration phrase. This is necessary as St. Paul Medical Service will carry out the necessary operations which are needed to rebuild and reestablish its business operation at its original location at 23 Grange Road. In this phrase it begins with the damage assessment of the 23 Grange Road site.

“The restoration phrase formally begins once all assessment of the damage has been accomplished and the rebuilding of the primary site commences.” (Whitman & Mattord, 2007).

The are various goals for the restoration phrase:

• Repair all the damage to the 23 Grange Road site.
• Repair or replaced the damage of destroyed equipments, office supplies or material.
• Coordinate the relocation from the Lucky Plaza Site (Temporary) to the 23 Grange Road Site (Primary).
• Restoring normal business operation at the 23 Grange Road Site. This usually begins with the critical functions and then follows with the secondary operations.
• Stand down the Disaster Recovery Teams and the conducting of after-action review.

Assumption

After the arson that took place at St. Paul Medical Service on 15 March 2010, the medical practice was so badly damage that it is impossible to carry on business. However 1 week later, after the fire department and the police concluded with their investigation of the arson. St. Paul Medical Service, located at 23 Grange Road, was being release back for business restoration.

In additional, this initial damage assessment is also required to be done so as to facilitate the insurance claiming process. This also acts as a list so as to determine what the necessary equipments are needed to be able to resume business operations at the 23 Grange Road location.

Repair or Replacement

There are 2 possibilities for St. Paul Medical Service in the restoration phrase. Either it can reestablish business operations at its original site at 23 Grange Road or establishing its business operations at a new permanent site. The restoration team will be responsible for the rebuilding and restoration activities. The team can also consider operating from a command center which is accessible to the primary site so as to be able to manage the rebuilding tasks and oversee the progress of the plan. There are also a few procedures at this phrase.

Initial Damage Assessment

The first step in the business restoration process is to conduct an initial damage assessment of St. Paul Medical Service. Dr. Ray together with his disaster recovery team will go back to St. Paul Medical Service to conduct an Initial Damage Assessment of the site. This process is done so as to facilitate St. Paul Medical Service to move back to its original business location. The follow was note down in the Initial Damage Assessment:

Reestablishing Business at Primary Site (23 Grange Road)

Due to the initial damage assessment and the assumptions made, St. Paul Medical Service is able to rebuild and repair the damaged facilities at the primary site. This they will carry out renovations and replacements works on the 23 Grange Road site. This includes:

• Paints works on the walls to cover the burnt marks.
• Replacement of the furniture that was damage or burnt.
• Replacement of photocopying equipments.
• Replacement of filing systems, office supplies.
• Replacement of the Air-Conditioners, Communication Devices that was damaged.
• Repair or replacement of the various IT equipments such as network server, computers, routers, switches, mouse, keyboard).

“Most offices just don’t realize exactly how much “stuff” they need to run their operation” (Whitman & Mattord, 2007).

Extra care also needs to be taken to determine what do the insurances cover and what the insurances don’t cover. In additional it is also important to examine the service contracts so as to determine if the damage or destruction to the leased equipments is being covered by the various service provider.

Outcome: The 23 Grange Road site has been rebuilt renovated which includes infrastructure upgrades and modification to allow for resumption of normal business and IT operations.

Disaster Restoration Plan Contact List

Relocation from Temporary Site (Lucky Plaza)

After the disaster, St. Paul Medical Service was being relocation to its temporary site at Lucky Plaza. Therefore the movement back to its original primary business operation site signals the beginning of the end for most of the Disaster Recovery Team members of St. Paul Medical Service. Before all the staffs are being relocated back to the primary site at 23 Grange Road to resume their normal daily routines, this transition must be carefully planned and coordinated. This is even truer if St. Paul Medical Service had been operating out of the temporary site for a long period of time. However St. Paul Medical Service is only operating at the temporary site at Lucky Plaza for 10 days. Thus the administrative work at the office has generates a huge amount of paperwork, thus the relocation of which can get inevitably messy. The data systems of St. Paul Medical Service was also being relocated to the temporary site at Lucky Plaza after the disaster occur, thus careful planning also need to be ensure as the damage of the computing equipments and systems can happens during the transit period. The data-management practices are even more important before and after relocation. This is because in some instances, it could be an advantage to have a movement coordinator to plan and coordinates the relocation of personnel, equipments, and data from the alternate to the primary location. In St. Paul Medical Service case, the coordinator will be Dr. Ray. There are various procedures that Dr. Ray has to follow when transiting all the IT operation and services back to the primary site at 23 Grange Road. The procedures are:

Business Resumption at Primary Site (23 Grange Road)

If St. Paul Medical Service is not able to reestablish it critical business functions at the primary site at 23 Grange Road, there would be a need for them to have a business continuity plan. However in this case, St. Paul Medical Service is able to reestablish and resume it normal daily business operation at the 23 Grange Road primary site. There are a number of secondary operations and functions that were suspended while it is relocation to the temporary site at Lucky Plaza. There are daily operations that will help to stabilize the organization and keep it running smoothly, productivity and efficiently. The various business functions include:

Standing down and After-Action Review (AAR)

“Standing down represents the deactivation of the disaster recovery team, releasing the individuals back to their normal duties.” (Whitman & Mattord, 2007)

In most situations, the staffs of St. Paul Medical Service would have focused exclusively on their disaster recovery roles until they were released. That meaning that the staffs at St. Paul Medical Service might have worked extra duty, handling both their disaster recovery jobs as well as focusing on their normal business duties to ensure that nothing suffered as a result of their absence.

Next come the last formal activity St. Paul Medical Service will perform before declaring the disaster is officially over, which is the after-action review (AAR). The after-action review (AAR) will provide the management of St. Paul Medical Service to enable them to obtain the various input and feedbacks from representative from the Disaster Recovery Team as well as the Disaster Restoration Team. This can be done by the various team leaders first obtaining the inputs and feedback from their team members in their group, which concern the specifics of the disaster that had occur and the suitability of the disaster recovery plan. All the information is then compiled and combined with the disaster logs which are maintained by a designated member during the disaster. The logs captured and document can be used in future training tool for future members of the team. It could also be used as a legal recording of the events that occur during the disaster. It is very important to capture and record down as much organizational knowledge as possible with regards to the disaster as it help to train future Disaster Recovery Team. In additional, team members of the current Disaster Recovery Team could also leave St. Paul Medical Service for other organization, so it is vital to record down their experiences and knowledge on the disaster.

Finally the last step is the creation and documentation of the final official report. All the information can come from the outcomes of the after-action review (AAR) as well as the reports of the team leaders and its members. This report is important because it can act as legal documents which are required by the insurance company, legal department to be use as a record of what actually happened so as to ensure that there was no negligence by St. Paul Medical Service. After which, all the staffs of St. Paul Medical Service can resume their normal daily business operations.

Conclusion

In the restoration phase, this phrase seeks to repair and replace all damages relating the primary site; replacing the damaged or destroyed contents of the primary site. In additional, there is also a need for coordinating the relocation of temporary site to the primary site as this will ensure the protection of computing equipments and systems can happens during the transit period. Next is the restoration of critical business functions at the primary site which consist of recovery of the IT systems from backup as well as backing up the latest version at the restored primary site. The secondary operation can consist of employee benefits, employee training program which are not so important in the initial stage of the restoration, but is necessary for the good of business process in the long run. Finally is the standing down of disaster recovery as well as the conducting of after-action review (AAR) which St. Paul Medical Service can learnt from this disaster.

References

• Dolewski. R (2008) System i, Disaster Recovery Planning.
• Erbschloe, M (2003). Guide to Disaster Recovery. Massachusetts, Boston.
• Jon. T & Margaret. T (2000) Disaster Recovery Planning, Strategies for Protecting Critical Information Assets.
• Renteria. H (2002). Clinic Disaster Plan Guidance
• Snedaker. S (2007). Business Continuity & Disaster Recovery for IT Professionals
• Whitman. M & Mattord. H (2007) Principle of Incident Response and Disaster Recovery
• Garry Kranz (2007). Disaster recovery: Strategies for rapid restoration. Retrieved 2010, March 20 from http://searchcio.techtarget.com.au/tips/21657-Disaster-recovery-Strategies-for-rapid-restoration
• Getting Here (2010). Retrieved 2010, March 22 from Lucky Plaza site: http://www.luckyplaza.com.sg/page.php?lvl1=43&pageid=43
• IDS-Emergency Management – White Paper (n.d). Retrieved 2010, March 19 from idsemergencymanagement.com site: http://www.idsemergencymanagement.com/Common/Paper/Paper_141/Disaster%20Notification1.htm
• Info-Tech Research Group (2010). Disaster Recovery Primary Site Restoration: Home Sweet Home. Retrieved 2010, March fro http://www.information-management.com/news/disaster-planning-primary-site-restoration-10017143-1.html?pg=1
• Managing Computer Room Disaster with “First Alert” Procedures and “4Ci” (2008, Dec 1). Retrieved 2010, March 19 from informIT site: http://www.informit.com/articles/article.aspx?p=1309286
• Wold, G. (1997). Disaster Recovery planning process. Retrieved 2010, March 19 from drj site: http://www.drj.com/new2dr/w2_003.htm