CISSP: Disaster recovery processes and plans

Disaster recovery is a critical component of business resilience, ensuring organizations can restore operations after disruptive events. With the April 2024 CISSP exam update, disaster recovery and business continuity remain essential topics within both the Security Operations (Domain 7) and Security and Risk Management (Domain 1) domains. The best organizations prepare through comprehensive recovery plans that help them face the consequences when disasters strike. 

This article will explore what one needs to know about disaster recovery plan development for the CISSP certification exam and what is in a disaster recovery plan. But before that, let’s overview what a recovery plan should have. 

For more CISSP exam tips, get our free CISSP exam tips and tricks ebook, or watch our free one-hour CISSP exam tips course with an instructor whose students have a 95% pass rate. 

Earn your CISSP, guaranteed!

Get live, expert CISSP training from anywhere. Enroll now to claim your Exam Pass Guarantee!

Get Pricing

What is a recovery plan, and what does it contain?

Recovery plans, also known as business recovery plans (BRPs), business continuity plans or business contingency plans (BCPs), are the plans a business uses to maintain or bring back to normal a function or functions lost due to an unscheduled event. Every business unit or department, as well as the business as a whole, should have its own recovery plan, but all the plans should be coordinated. For instance, the IT department refers to the BRP plan first to reactivate its operations and activate the IT continuity plan. Similarly, the BRP gives information to other severely affected departments so that they can activate their own recovery plans. 

In general, a recovery plan should include but is not limited to, the organizational unit and its scope and the link of the plan to other plans, roles and responsibilities, thoroughly for contact persons in crises, incident assessment procedures, emergency room contact person, invocation and escalation information, business continuity action plan, recovery profile for each endangered activity, logistics information (equipment, maps and directions), communication matrix and recovery completion procedure. 

As a part of the BRP, the disaster recovery plan (DRP) is a specific recovery plan that is concerned particularly with damaged or lost software, data and/or hardware on the one hand and overcoming the consequences of that on the other hand. It aims to minimize, as much as possible, potential functional damages caused by a disaster. 

Disaster recovery plan development

The DRP development is the first phase of the disaster recovery management cycle after the project initiation and risk impact assessment.  

It is an ongoing process of planning, developing, testing and implementing procedures and processes to ensure that the organization can quickly restart its basic activity after an unplanned interruption due to a disaster. It has the same components as any recovery plan but particularly emphasizes the IT department, personnel, equipment, facilities and function. 

Disaster recovery plan components 

The DRP has many particularities and areas to focus on and that the CISSP-certified professional should be aware of: 

Emergency response

The emergency response consists of the first actions undertaken immediately after the disaster. 

Nothing is more important than human life in such circumstances. That is why the first measures are to ensure personnel safety by providing first aid and looking for personnel; that should be followed by ensuring everyone’s evacuation with the appropriate procedures, avoiding any risk to personnel and supplying the necessary basic needs such as food, water, blankets, etc. 

After securing human life comes securing business assets. This includes not only infrastructure but also important logistics, such as vehicles and equipment, particularly IT equipment because of its cost and its necessity for business functions. At this stage, damage can be assessed by external engineers. 

Then comes the emergency notification, which is the responsibility of the response team that will keep the personnel calm and the management updated. Objectivity is the rule to keep in mind. 

Personnel and communications

Having the right person in the right place when a disaster occurs is crucial for the business to respond fast and effectively and minimize damages in its workflow. Identifying the right person implies knowing the characteristics of the company’s workers; for instance, it is better to select a person living relatively close to the workplace. A skilled, experienced volunteer would also be more useful in an emergency situation. 

The DRP should be very comprehensive in describing the hierarchy of key personnel involved in disaster management in each department and for the business as a whole, describing in detail the responsibilities of each person and how and when he/she can be contacted with any available phone number. The communication channels, which should be diversified by using radios and satellite phones, for instance, they should be different from the ones usually used, just in case there is a service interruption. All personnel should be aware of the plan and prepared for any unplanned event that may happen. 

In addition to training (through simulations, for instance), good preparation relies on a well-informed DRP. For that, it may include contact information for any potential stakeholders who may be helpful or should be contacted in a disastrous situation. A hardware provider can supply urgent IT needs, a customer whose data security is threatened can be informed about that, and so forth. 

It is also important to decide which person should be contacted if the supposed emergency contact person does not respond to the emergency call. It is important, consequently, to identify other team members to contact prior to the event of a disaster. 

Assessment

Compared to the emergency response assessment, this step has the same principle except that it is more complete and detailed. It involves internal experts but also external ones, such as civil engineers to ensure that the building is safe. 

The traditional way to assess damages qualitatively is by using questionnaires that need to elicit information from top management as well as end users, whether on their own, by an interviewer or in a debriefing meeting. This method makes it possible to categorize damages as being low, medium, high or even critical. The quantitative assessment allows the determination of a monetary value for losses and builds on the risk analysis performed before the disaster. 

Backups/offsite storage

Data backup is the regular process through which business data is saved in hard copies (using tapes, CDs, etc.) or through cloud computing so that if a disaster occurs and information is lost, it can be restored from what has been backed up. 

For security reasons, businesses generally store the saved data in offsite rooms when they safeguard data through hard copies. For more security, businesses are advised to use more than one offsite storage, but cloud computing is even more secure since it is virtual, ensures the integrity of the data and does not require an additional, distant location. Consequently, it is less costly, because it eliminates costs related to the offsite storage (additional personnel and equipment, transport, maintenance, integrity checks, etc.) and also the potential costs of data loss below the recovery point objective (RPO), which are caused by data integrity loss. Moreover, the cloud can more easily fulfill the business needs of RPO and recovery time objective (RTO), although the smaller they are, the more costly they would be. 

If the offsite storage will serve as the IT operations emergency location following a disaster, it should be well equipped with suitable ventilation and power supply. 

External communications

The business stakeholders should be notified about the state of the organization and the consequences that the unplanned event had on its operations. Any business’s official communication channel can be used: the official website, social networks, media, phone, etc. 

Utilities

Utilities such as electricity, water and gas often become unavailable in a disaster situation, and this inaccessibility should be managed by taking measures such as activating the generator to restore electric power, closing the building if it is on fire and water is not available or if the wastewater system does not work anymore. 

Logistics/supplies

The emergency team should think of providing the necessary logistics for personnel safety and comfort. They can be categorized as follows: 

• Vital human needs: food, water, blankets, camp beds and sanitation 
• Important technical equipment: tools and spare parts, waste bins, extinguishers, sprinklers, fire/smoke alarms 
• Information and communications: radios, satellite phones and contact person information 

The DRP should contain any information related to the logistics and their supply, whether they are available constantly in the business infrastructure, such as fire alarms, or they need to be available quickly in an emergency situation, with potential suppliers’ information for emergency care, food and so forth. It is also important to specify quantities when possible; knowing how many camp beds are available will help forecast the needs in the case of mass recruitment, for instance, and update the DRP. 

Recovery vs. restoration

Recovery is an umbrella term covering all of the processes that help a business return to normal after a disaster. At the same time, restoration focuses specifically on repairing and/or replacing equipment, utilities and business facilities. Restoration follows the assessment and prioritization of what needs to be restored first, based on the importance of general business functions and IT operations. 

Key takeaways for CISSP disaster recovery planning 

Developing a comprehensive DRP and ensuring all personnel understand it is essential for business resilience and maturity. A well-structured DRP helps organizations reduce risks and maintain their market position by addressing key components: 

• Emergency response prioritizing human life and safety 
• Clear personnel roles and robust communication channels 
• Thorough damage assessment procedures 
• Secure backup and storage strategies 
• Stakeholder communication plans 
• Utilities and infrastructure management 
• Detailed logistics and supply chain planning 
• Recovery and restoration procedures 

Earn your CISSP, guaranteed!

Get live, expert CISSP training from anywhere. Enroll now to claim your Exam Pass Guarantee!

Get Pricing

To deepen your understanding of disaster recovery and other CISSP domains, consider exploring our CISSP training hub, which offers comprehensive study resources and practice materials. 

Ready to start your CISSP certification journey? Download our CISSP exam tips ebook for expert guidance on exam preparation, or explore our cybersecurity certification roadmap to plan your career advancement. For insights into the career opportunities and salary potential that come with CISSP certification, check out our comprehensive cybersecurity salary guide. 

Effective disaster recovery helps build organizational resilience and protect critical business operations. Our CISSP Boot Camp can help you master these concepts and prepare for success in your certification journey.