TheyDo has a structured disaster recovery plan that establishes procedures to recover service operations from a disruption resulting from a disaster. The types of disasters contemplated by this plan include natural disasters, political disturbances, man-man disasters, external human threats, and internal malicious activities.
Critical systems and services
From a disaster recovery perspective, TheyDo defines two categories of systems:
Non-critical systems
These are all systems not considered critical by the definition below. These systems, while they may affect the performance and overall security of critical systems, do not prevent critical systems from functioning and being accessed appropriately. Non-critical systems are restored at a lower priority than critical systems.
Critical systems
These systems host application servers and database servers or are required for the functioning of systems that host application servers and database servers. These systems, if unavailable, affect the integrity of data and must be restored, or have a process begun to restore them, immediately upon becoming unavailable.
Testing and rehearsal
TheyDo performs coordinated testing and rehearsals of the disaster recovery plan annually. This includes a retrospective and tabletop reenactment in order to identify lessons learned and improvements to playbooks and operating procedures.
