Rawpixel.com - stock.adobe.com
A good disaster recovery initiative needs enough funding. An organized and detailed budget is critical to obtaining that.
To help DR teams get the funding they need to create a robust DR initiative, we've included with this article a free downloadable disaster recovery budget template. DR teams can modify this template to suit their unique needs. The template also includes business continuity and resilience expenses that can get operations back up quickly and mitigate future crises.
Even though the rise in remote work, natural disasters and ransomware attacks in recent years has increased the urgency for a comprehensive IT disaster recovery budget, many business leaders are still reluctant to invest in a strategy and program because they don't see an immediate threat or return on investment. You can use this template to help advocate for a DR plan.
As part of the efforts to obtain senior management approval for a DR program, a draft budget will often help smooth the way to approval, along with evidence of proper due diligence and justification. Budget preparation can be time-consuming, but with the right tools -- including this template -- the budgeting process for business continuity and disaster recovery (BCDR) and resilience programs can be less intimidating.
Use the following tips and included template to dig into the specifics and justify the budget that your disaster recovery team needs.
Begin the DR budget process by identifying large expense items, such as off-site storage facilities, salaries, rent, utilities, network resources, managed services, specialized applications, hardware and software maintenance, travel, and outside consulting. Use past-year data and available trending information to help project spending in a new year.
For most small expense categories, past-year trends will be enough to determine what to budget for the next year.
If a new program is in development, DR teams should work with departments including IT and human resources to get estimates of likely expenses and expense categories. Prepare assumptions, especially for major expense items, and review these assumptions once the budget has been completed. Use the included template to help further pinpoint likely expense categories.
Funding a DR plan
Senior management's commitment to DR and related activities needs to extend beyond simply agreeing to a BCDR policy and initial funding. Management must support development of the company infrastructure that strengthens the policy, ongoing maintenance of the overall program, program staffing, and ongoing provision of resources, including financial and technological resources.
DR budgets must account for both immediate and long-term expenses, which might change over time. Ongoing review and assessment of a program by internal DR teams and business continuity audits are essential for continued management support and funding. Be prepared to justify the need for continued support and be clear about how needs might change.
When preparing a budget, start with an estimate of how much the DR budget is as a percentage of another budget, such as IT. Often, DR and related activities are approximately 0.1% of a company's overall budget and 1% to 3% of an IT department's budget. The COVID-19 pandemic forced organizations to take a harder look at their disaster preparations and the costs of not investing enough in a DR program.
Traditionally, expensive preparations for events that might never occur were difficult to justify. The ongoing COVID-19 experience has supported the case that DR plans help companies survive over the long term.
Budget assumptions and considerations
If DR is not budgeted as a separate entity or department, it can be part of other departments -- most frequently IT. Other departments that might own the DR budget and related initiatives include risk management, facilities management, operations, emergency management, administration, finance/accounting and strategic planning.
When developing a DR department budget, several assumptions and considerations need to be addressed. Teams can address these by asking the following questions:
- Do BCDR plans and related activities exist?
- Are disaster plans in place for IT and business functions?
- Which departments or divisions have business continuity plans?
- Does management support DR activities?
- Is the department currently conducting business impact analyses and risk assessments?
- Is the department currently developing or implementing plans that meet the organization's needs?
- Does an emergency operations center exist?
- Has senior management approved the DR plan and related policies and procedures?
- Does an incident response or crisis management plan exist?
- Has the board or senior management completed an enterprise risk assessment?
Budget line items
The table below provides examples of typical DR and related activity budget line items. We've divided some of the items below into different categories, including staff, special systems and training. Consider grouping various items under specific areas that suit your organization's structure. The downloadable template included with this article provides additional detail and more line items.
|Budget category||Budget item||January||February||March|
|DR staff||Salaries (full-time)|
|Program office||Resources for remote working|
|Office space (headquarters)|
|Office space (remote)|
|Security and antivirus|
|Emergency operations center|
|Special systems and tech||Data backup and recovery|
|Managed services (DRaaS)|
|Hot site/cold site|
|BCDR management||Risk assessments|
|Business impact analyses|
|Education and training||BCDR program training/education|
|Staff attendance at conferences|
Importance of budgeting
The budget process exists to accomplish several key activities. These activities will come into play during the justification process to management.
Common goals of the disaster recovery budget process include the following:
- Develop and implement DR and related plans that facilitate the timely recovery of critical business functions and IT facilities following a major disruption or disaster.
- Develop policies, procedures and compliance activities to address all DR and security requirements.
- Develop, document, exercise and maintain plans to ensure the survival and resilience of the business by minimizing the negative impact of business and technology disruptions.
- Identify and assess potential risks to the enterprise and its operations, technology infrastructure, business processes and people.
- Identify and assess potential vulnerabilities to the enterprise and its operations, technology infrastructure, business processes and people.
- Design and deploy cost-effective emergency response activities, such as remote working, that can quickly recover business and technology operations.
- Develop and deploy training and awareness programs so that all employees are fully aware of their responsibilities and commitments.
- Establish and maintain liaison with external parties including customers, vendors, insurers, emergency first responders, regulators and financial institutions.
- Ensure any external recovery facilities are secure and that systems are prepared for emergency activation.
- Develop a capability to optimize media relations to minimize adverse publicity and negative business implications.