Disaster Recovery

Core 13 (c) provides:

The organization implements information system(s) (electronic, paper or both) to collect, maintain, and analyze information necessary for organizational management that:
* * *
(c) Includes a disaster recovery plan that;
(i) Is tested at least every two years; and
(ii) Addresses identified areas for improvement; . . ..

Cartoonist Scott Adams, creator of Dilbert, provides a vivid example of what URAC will not accept for this standard.  Click here, and then the "play" arrow over the picture, to view the 23 second clip.

URAC's proposed upgrade to its IT standards includes a second new standard, one devoted exclusively to Business Continuity.  The new standard would read:

The organization implements a business continuity plan for program operations, including information system(s) (electronic and paper) that: (--)
(a) Identifies which systems and processes must be maintained and the effect an outage would have on the organization’s program. (2)
(b) Identifies how business continuity is maintained given various lengths of time information systems are not functioning or accessible; (Wt = 3)
(c) Is tested at least every two years; and (Wt = 3)
(d) Addresses identified areas for improvement. (Wt = 3)

The substantive changes modernize the terminology, with "business continuity"  replacing "disaster recovery."  The new standard would provide greater detail about what the applicant should do to anticipate interruptions in service.  The proposed revision also emphasizes that it applies to both electronic and paper systems, and therefore necessarily will involve people outside of the typical company IT department.

The scoring change is significant, in that there are no mandatory elements in this standard.  While 11 points (the total value of the four elements' weights) is significant, it pales in comparison to the mandatory nature of the current standard.