166 5.4 Notification and Reporting in Disaster Recovery Phase
Activity completion
Activity resources
The plan should also include a critical path for the recovery process. The
plan will need to be updated regularly during the disaster recovery process,
and this is an important part of the DRT leader’s duties. A critical path, in
its simplest form, is the shortest time in which a particular group of tasks
may be accomplished. Each task on the critical path must be completed on
schedule if the entire project or group of tasks is to be finished on schedule.
5.4 Notification and Reporting in Disaster
Recovery Phase
Maintaining good levels of communication is one of the most important
elements of the disaster recovery phase. It is important that any information
released is both accurate and timely. It is necessary to keep various groups
informed, including the DRT, the business recovery team, the senior and
middle management, families of affected employees, media, and other key
members of staff. In the event of any emergency, the organizations DRT
should be notified as soon as possible. This notification should also be made
to upper management and key employees. In certain situations, it is war-
ranted to establish a team to handle notification of employees’ families or
next-of-kin (in worst-case scenarios). A specific person should be designated
to handle media during the disaster recovery phase, and another person
should be assigned the task of maintaining an event log during the disaster
recovery phase. Finally, when the danger has passed, a Disaster Recovery
Phase Report must be completed.
5.4.1 Mobilizing the Disaster Recovery Team
One of the tasks during the early stages of the emergency is to notify the
DRT that an emergency has occurred. This notification would normally be
in a preagreed format. Normally, the notification will request that the mem-
bers of the DRT assemble at the site of the problem and will include suffi-
cient information to enable the request to be communicated effectively.
The BCP team leader or deputy should initially be alerted, and that person
will be responsible for notifying the rest of the DRT, who are required to
attend the site of the emergency. A succession of alternates should be pro-
vided in case the leader or deputy is unavailable or incapacitated. This sec-
tion of the BCP should contain a list of persons to contact, including
5.4 Notification and Reporting in Disaster Recovery Phase 167
Chapter 5
contact information, time and date of contact, who made the contact, mes-
sages left with, instructions issued, response, and subsequent time of arrival
on site.
5.4.2 Notification to Management and Key Employees
During the disaster recovery phase, the management and key employees
should be kept informed of key developments affecting the overall business
process and, in particular, the impact on their own areas of responsibility. If,
for example, the emergency affects the main buildings in which the busi-
ness is conducted, and the emergency has occurred outside normal business
hours, it may be necessary to instruct the employees to remain at home
until further instructions can be issued. Key employees and certain mem-
bers of management may, on the other hand, be needed to attend the emer-
gency site or the Command Center at an early stage in the process to
consider how to minimize the impact of the emergency on their areas of
responsibility. The BCP team leader, deputy, or nominated alternate is
responsible for undertaking this notification activity. This section of the
BCP should contain a list of management and key employees who should
be contacted in an emergency situation. It should contain each persons
name, normal and emergency contact information, and a brief description
regarding the area of responsibility.
5.4.3 Handling Notification of Personnel Families
If the emergency event has resulted in a situation that would cause concern
to an employees immediate family, such as the hospitalization of injured
persons, it will be necessary to notify immediate family members urgently.
This type of communication needs to be handled with sensitivity and care,
so as not to increase the level of distress to the persons being notified. This
type of work would normally be handled by a trained manager or a member
of senior management. The need to deal sensitively with employee situa-
tions is one of the reasons why it may be beneficial to include executive
management from the HR department of your organization in the disaster
recovery team. This section of the BCP will contain the names and emer-
gency contact details of the persons nominated to undertake this particular
type of notification. In the event of serious injury or even death of an
employee, it would be beneficial if the person notifying had access to coun-
seling service contact numbers, in order to be able to offer this type of sup-
port and advice.

Get Business Continuity and Disaster Recovery for InfoSec Managers now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.