is perhaps a misnomer. This book encompasses the whole of business continuity planning, a broader field addressing the maintenance, and if necessary, resumption of business processes for an enterprise, prioritized by the criticality of the processes. This is distinct from earlier conceptions of disaster recovery, which focused on the IT function (restoring the data center). For simplicity, within this review, I will use “disaster recovery planning” in the broader meaning adopted by Toigo for his text.
Toigo’s previous editions of this book have been widely regarded as among the strongest in the field; this third edition, subtitled , is no exception. Not surprisingly, Toigo uses the tragedy of the World Trade Center collapse as an illustration for some of his points, yet he also uses the triumph of some of the businesses and individuals affected to demonstrate the efficacy of proper planning and training, as seen in their rapid resumption of business in the wake of the disaster. Some of their neighbors, lacking similar discipline, were not so fortunate.
As in previous works, Toigo addresses the need for disaster recovery planning, and addresses the basics of risk analysis and classification, the critical first step for any disaster recovery planning initiative. He devotes a chapter to some of the well-established physical security measures that play a role in preventing or mitigating disasters, including fire detection and suppression, and techniques to ensure the availability of clean electrical power.
He then focuses on the data-centric nature of today’s business, and discusses how planners can identify critical data, and protect it in accordance with its use and criticality. He addresses both centralized system recovery (the traditional mainframe environment), and the more fluid, yet increasingly important recovery of distributed systems and networks. Mainframe adherents frequently downplay this area, but it is clear that these systems are playing increasingly critical roles in many businesses today, and thus must be addressed by the planner, in spite of any disinclination.
Toigo also addresses the softer sides of disaster recovery planning, including the recovery of end-user functionality and the problems of emergency decision making. The first, end-user functionality, includes not just issues of notification and transportation, but also psychological issues, which can impair a business just as much as a network outage if not properly addressed. Planning for the second, emergency decision making, must acknowledge the reality that people don’t make decisions as effectively when fighting fires. Failing to recognize the crisis-mode context in which disaster recovery plans will be executed will diminish their effectiveness. Toigo helps to illustrate some of the areas of concern, and suggests ways to mitigate the inherent risks.
In conclusion, it should be recognized that this book is not a quick read. It is long, and it is comprehensive. Those with only a casual interest in the field would do well to seek an alternate introduction. However, those tasked with disaster recovery planning or business continuity planning in their organizations should consider this text an essential read.
