General discussion


What steps should you take in the first hours of a disaster?

By debate ·
What do you think administrators should focus on first in the early hours of a disaster? Does your organization's disaster recovery plan have a chronological component that describes actions to take in the first hours? Share your comments about areas to focus on in the first hours of a disaster, as discussed in the Dec. 14 Disaster Recovery newsletter.

If you haven't subscribed to our free Disaster Recovery newsletter, sign up today! Click this link to subscribe automatically:

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Comments

Collapse -

It would depend on the disaster.

by zlitocook In reply to What steps should you tak ...

Was the computer room flooded or had a fire closed the building? We keep all back ups off site and in a valt, so if one building can not be used we use the second. Which is eight miles away to keep the bank going. If the disaster is as large as eight miles well we are out of the picture.

Collapse -

AD with Exchange 2003 ?

by hboogz In reply to What steps should you tak ...

I'd like to hear what other net admins have in place or would put into place in the event of a disaster running AD and Exchange 2003. Would You have a DR site that would identical servers joined into the ad domain and exchange organization and make daily work transparent ? Or would you replicate traffic to these dormant boxes and in the event of a disaster dcpromo one box while mount the exchange databases on the other ? The latter doesn't seem so streamlined.. Looking for some feedback.


Collapse -


by FluxIt In reply to What steps should you tak ...

Standard Investigation Response:
1. Secure a disaster backup of the system state for investigation/forensic purposes. Gather logs. Should have an independent machine online monitoring critical server performance.
2. Isolate the network from the internet and other networks.
3. Gather 'eyewitness' accounts if necessary.
4. Close in on the issues from broad to narrow.
5. Begin fix.
6. Stablize then bring other networks and the internet online as necessary.
7. Monitor

Practical Response/Mission-Employment Critical:
1. Rush around identify the problem.
2. Begin corrective action immediately.
3. Declare success at the earliest possible moment.
4. Turn out the lights and go home.

Collapse -

As someone said - it depends

by dafe2 In reply to What steps should you tak ...

Frankly I enjoyed MrMiami response :-)

But a few years back "Melissa" hit two of our clients........One considered this a disaster, the other an "inconvenience"

The first is a large network with 4000 users at nine sites - They shut down all mail for two days internally & two WEEKS for external. (And yes, since that time many other SOP's have been implemented)

The other, much smaller, shut down for about a day, cleaned up & moved on....

Big, "Natural" disasters in our area un-common, (Tornados, earthquakes and the like), however in many cases, most of the places I see have operating procedures in place that walk key players through the assesment & execution of their DR Plans.........each is different - Some are large ennough to have warm site, others just need to know where to get their backup tapes & who to call for new gear. (Even what to do if the phones are down.)

The common theme is each has a standard operating procedure "Binder" in case of an "event". One copy is on-site and one copy is kept in the homes of "key individuals" that can execute a DR Recovery.

Collapse -

High level response depends

by wrlang In reply to What steps should you tak ...

There are some steps that are pretty consistent up to the point of declaration.
In the first hour:
1. Staff/visitor safety assurance
2. Command center activation
3. Internal event/incident alert
4. External contacts alert
5. Assessment of disaster
6. Decision to declare
7. It depends on a declaration and the event type

Related Discussions

Related Forums