Information is often referred to as the lifeblood of modern business. It is among the most critical assets of any organisation, whether public or private sector.
“It is important to plan the protection of records and information – just as you plan to protect other assets, such as staff, property and financial resources,” says Sonya Sherman of Ignition.
“A good records management programme incorporates a disaster plan to minimise risks to vital records and critical information systems. It includes procedures for recovery to ensure business continuity.”
Vital records provide information essential for business continuity, meeting responsibilities during and after a disaster, reducing down-time losses and enabling organisations to quickly resume normal operations.
Building a business continuity and disaster recovery plan
Using an existing hurricane plan as your starting point, adding steps to protect vital records and critical information systems shouldn’t be too difficult.
It should clearly identify vital records, document the anticipated risks, and detail the mitigation/recovery strategies.
“Ensure all staff are aware of their responsibilities for maintaining records – particularly storing vital records in locations that are subject to backup strategies,” says Sherman.
“Build this plan into the overarching records management program or information governance framework.”
She notes that in general, good records management minimises the proliferation and duplication of information, reducing the risks of accidental loss, deletion or inaccessibility.
Simple steps can have a big payout
Sherman says a good first step is to identify the information and systems that are most critical to the functioning of the organisation. This way, resources can be appropriately allocated to protection and recovery activities according to the level of importance to the business.
“For businesses, these include records which establish your legal and financial position, and those that document the rights and entitlements of your investors, staff and customers,” says Sherman.
“Remember to include those records that help you operate during and after a disaster, such as plans, procedures and key contact details. Duplicates, reference materials, information that can be easily reconstructed or obtained from another source, should not be considered among your vital records.”
She notes it’s worth determining which records require the highest level of protection you can provide.
“Backup and recovery processes take time and cost money,” she says.
“You do not want to waste resources by protecting massive amounts of low-value information.”
Ensure vital records are easy to recognise
“For both physical and electronic records, this could involve listing them, keeping them in separate storage or using ‘flags’ – like coloured folders and labels or metadata fields that mark the records as vital,” says Sherman. This enables vital records to be prioritised for backup, relocation or recovery in the event of a disaster.
The third step is putting protection strategies in place.
“Specific techniques will vary, depending on the format of the records and the expected hazards as described below,” said Ms Sherman.
“Most importantly: formalise your plan and keep it up to date; assign responsibilities; practice, practice, practice your procedures!”
Assess the risks – what are the possible scenarios for disaster. remembering they could be natural or man-made, deliberate or accidental, what is the likelihood of each scenario and what would be the impact of each scenario?
Choose appropriate strategies for backup and recovery
“Remember that vital records may be electronic or hard-copy, they may be stored outside the corporate network or office premises,” she says.
“Suitable strategies will depend on the format, medium and location of the information, its level of relative importance and the applicable regulatory requirements that govern retention, accessibility and confidentiality of the information.”
Consider a retention policy, which regulates the disposal of information and helps keep the volume of records to a manageable level. Liability insurers are increasingly considering retention policies and discovery-preparedness in their underwriting decisions. Poorly managed records could affect the cost or availability of insurance coverage.
Storage conditions should take account of security requirements and also the length of time records need to be retained for legal and business purposes.
“This will allow you to undertake a cost-benefit analysis of on-site/off-site/online/offline storage, and select suitable storage media to enable ongoing maintenance of the records for that period of time,” she said.
“Regular and systematic disposal of records is one of the most effective ways to reduce the likelihood of a man-made disaster,” continued Ms Sherman.
“Fewer records are easier to store, manage and protect.”