Recovery site

1 - Do we need another recovery site?

Considering that there is a chance that another disruptive scenario can hit your organization at any moment (e.g., fire, flood, storm, etc.), and now, because Covid 19, you will not have recovery space available to fulfill your needs in case of a new disruptive event, then you should consider another recovery site if you still want to achieve continuity objectives defined pre-Covid 19.

The alternative would be to adjust continuity objectives according to your current operational capacity and situation (e.g., if your initial continuity objective was to work with 50% capacity during disruption, maybe now a possible objective would be only 25%, due to social distancing requirements).

Just for a mindset adjustment, you should keep thinking of your recovery site as a recovery site, not as a daily office, since it is being used like that only because you are in a disruptive scenario, i.e., social distancing required due to Covid 19.

2 - If we do, how do I convince management?

The direct answer is that you need to perform an assessment of your current allocation of continuity resources to identify what you can still use in case of a new disruption hits you (e.g., it is possible to allocate more people in the recovery site, up to the limit defined by social restrictions?).

With this information in hand, you can go to management and present it to them, making clear what can be achieved in terms of business continuity under the current situation and allocation of resources, so they can make an informed decision between adjusting continuity objectives to feasible ones or allocating more resources for a new recovery site.

 This article will provide you a further explanation about business continuity objectives:

• Setting the business continuity objectives in ISO 22301 https://advisera.com/27001academy/blog/2014/02/17/setting-the-business-continuity-objectives-in-iso-22301/