Risk assessment and disaster recovery plan go hand in hand. An effective disaster recovery plan starts with identifying potential threats and vulnerabilities in your infrastructure, and findings ways to proactively reduce them. Risk assessment is not a one-time process, and should be continually analyzed if you’re running a consistently changing infrastructure. In this article, we’ll cover the importance of risk assessment on disaster recovery planning, and provide a step by step guide to guide you through your own risk assessment. 

 

How does a risk assessment affect my organization’s planning? 

 

Assessment of risks is important for two types of business planning: disaster recovery and business continuity. If you aren’t familiar, here’s a quick rundown of what these two plans look like:

• Disaster recovery plan: This document contains step by step instructions for what to do  should an incident occur. It should clearly define what actionable items are needed to resolve the problem quickly, effectively, and simply. The point of the document is to create a process that allows for resuming critical operations quickly and eliminating as much down time as possible. 
• Business continuity plan: This is similar to a disaster recovery plan, however it’s a bit more proactive. This document outlines ways in which you can prevent an attack before it happens. The idea is to make sure the organization’s employees and assets are protected and able to continue operating should a disaster occur. 

 

How do I perform a risk assessment? 

 

To start, it’s important to understand what a risk assessment entails. This document should contain a description of all potential risks to the organization, whether they’re natural or man-made, and the probability of those situations occurring. It should also include potential damage each incident might cause, how much time and effort will be required to mitigate the effects, what preventative measures you can take to reduce future disasters, and instructions on how to reduce the severity of the incident. 

 

Step 1: List the assets. 

 

Assets can be quite broad, and include everything from servers, customer information, websites and applications, etc. Meet with your executive team or send out a survey to your employees to get some feedback on what assets should be listed. Specific risks and threats should be outlined for each department.

 

Step 2: Identify the risks. 

 

After you have your assets listed, you can determine how each risk will affect them and why. In general, risks can occur in four ways: natural disasters, system failure, accidental error, and malicious attacks. Using this categorical umbrella will help you compartmentalize each of the specific risks into buckets. 

 

Step 3: Find the vulnerabilities. 

 

Now that you’ve identified your assets and risks, it’s time to dig deeper. Oftentimes, your own infrastructure contains weaknesses that could be exploited. Do you have the right systems in place to protect your organization? Are your employees well trained to recognize a cyber security attack as it’s taking place? Is your data secured?

 

Step 4: Think about the consequences. 

 

Should an attack occur, you’ll want to have an idea of all the ways your organization could be impacted. What financial impact might an attack have on your organization? Other consequences might include data loss, IT damage due to downtime, reputational damage, and legal issues. 

 

Step 5: Prioritize the risks. 

 

This is a difficult one, as every risk has its consequences. To help you prioritize, ask yourself two questions: how likely is this to happen, and which risks hold the most consequences. 

 

Step 6: Document your results. 

 

Each of these steps above should be placed into a document. After the document is finished, use it to create a company-wide policy. This policy will act as a guide for your entire organization as you’ll be able to optimize your efforts based on the given information.

 

While we encourage every organization to perform a risk assessment for disaster recovery, most don’t have the time and resources to do so. That’s where we come in! Thinline Technologies provides disaster recovery and business continuity services, and we’d love to help set your organization up for success. Contact us today for your cyber security and IT needs!