Like all CIOs, Darryl Lemecha worries about viruses and hackers, data centre problems and technology meltdowns. But what separates his worried mind from many others is a detailed incident response plan that will guide him, his IT staff and his organization through whatever problems may arise.
"The more you get that down on paper, the better you're going to be in a real crisis," says Lemecha, CIO and senior vice-president of shared services for ChoicePoint Inc., a data aggregator based in Atlanta.
An incident response plan takes its place beside business continuity and disaster recovery plans as a key corporate document that helps guarantee companies will survive whatever glitch, emergency or calamity comes their way.
"A lot of companies have that mentality, 'We have some really good people in our organization, things are running well, the chances of something happening are small, and if something does happen, we'll be able to deal with it.' But in the event of a real crisis, people won't know what to do," says George McBride, director of IT risk consulting with Aon Consulting Worldwide in Chicago.
The typical response to trouble - the deer caught in the headlights - is exactly why companies need such a plan, McBride says. And while a business continuity plan aims to preserve operations in the face of adversity and a disaster recovery plan details what to do in case of a disaster, McBride says an incident response plan is broader, laying out how to respond to scenarios as diverse as data security breaches and network crashes.
Given their breadth and specificity, these documents are usually lengthy and in need of regular upkeep. They will vary from company to company and even among departments within the same corporation, but here are five points that all IT-specific plans should contain.
1. A sense of what can happen
You can't possibly anticipate what will happen in a crisis or during the aftermath - that's the nature of the beast. But that doesn't mean you can't plan for one, says Ian I. Mitroff, a senior investigator at the Center for Catastrophic Risk Management at University of California, Berkeley, and the author of Crisis Leadership: Planning for the Unthinkable.
Well-prepared companies pick potential incidents representative of the various crises that could occur and then devise strategies to handle them, Mitroff explains.
2. A well-chosen team
CIOs need to name names, says Janice Malaszenko, an IT executive who has held the CIO position at several Fortune 1,000 companies. They need to identify which departments have roles to play when something happens.
Think broadly, she says, lining up people from the human resources, public relations, legal and purchasing departments, to pitch in during an incident. Go outside the company, too, and identify the key suppliers and service groups most likely to play a part during a crisis. "Identify secondary or backup people, too, in case [the first-tier] people are unavailable," she adds.
3. A communication plan
Bridge lines, conference call numbers and Intranet sites will be crucial for getting team members together when they're trying to fix problems that might have them working in diverse geographical locations, Malaszenko says.
The plan should also include the individual contact information for team members that goes well beyond office e-mail addresses and phone extensions, she says. The document needs to contain home phone numbers and e-mails along with mobile phone numbers.
Finally, Malaszenko adds, the plan needs to say which team member owns communications, so when the time comes, there's no delay in getting everyone talking.
Continued: A list of who does what (and when)
Related content:
Security on her mind: Interview with Julie Spallin, manager CCIRC Centre
Frontiers of risk
Six steps keep disaster recovery real
icon.
