In light of all the damage caused by Katrina and Rita, my company has started to think about putting together a disaster recovery plan. What should we consider putting in the plan?
Via the Internet

I will give you a thumbnail sketch of what you need to consider because the question you ask is not one that can be answered in just a few paragraphs.  You have two options - you can do it yourself or bring in a vendor that can help drive the process.  The most important thing to remember, as anyone who is involved in Emergency Management can tell you, is that the process you will go through to develop your disaster recovery plan won't be a one-time effort.  You will need to periodically review the plan you have and, most importantly, you will have to test the plan.  Finding out there is one or more problems with your plan when you have to implement it is the wrong time to find out.

Whether you roll your own plan or have a company help you, here are a few things that should be considered. First there are the servers/systems you need to run the daily part of the business. Whether you have equipment shipped in and set something up from scratch; restore back-up tapes to get things running; or have a permanent site up and running all the time where everything is mirrored to another location, you will need to decide how much you need to have up and running as quickly as possible with the minimum amount of downtime.

Since it is possible that not everyone may be able to get to the disaster recovery site and may even be in different cities, remote access to the services will need to be factored in.  Whether you use a conventional or SSL-based VPN, that will be governed in part by what resources you need remote access to and what type of security needs to be in place in terms of encryption and authentication.  A good thing to encourage  is occasionally testing the remote access services on your production network, so that if and when remote access is truly needed, getting access will be second nature.  Also important is having established, written remote access procedures with each computer and employee who will need it.

If your company doesn't currently have a toll-free number as a part of your normal business operations, think about getting one, at least for emergencies. One nice thing about 800 numbers is that most carriers can work with you on redirecting that phone number to another where calls can be delivered. This allows your calls to be answered almost anywhere.  Another option to consider is using one of the voice-over-IP vendors, such as Vonage, where all you have to do is plug their network appliance into an Internet connection and you have phone service, no matter where you are.