Recovery responsibilities

A disaster recovery policy should state who is responsible for each recovery action, so every task has a clear owner. This is more than saying “IT will deal with it”: the policy names the role that must carry out each action.

Responsibilities should be linked to job roles, such as systems administrator or network technician, rather than named individuals. The responsibility stays in the policy when someone leaves or changes job, and whoever takes over the role can see what they must do. If a policy names one person, it can quickly become out of date and leave a recovery action with no clear owner.

An example of assigned roles

A small online shop selling board games could set out responsibilities like this:

Assigning each task to a specific role makes someone accountable. It also prevents the same action being duplicated by several staff or forgotten because everyone assumes another person is handling it. With vague responsibilities, staff may all try to restore the same database while nobody checks the payment system.