2 cissp ® Official Study Guide Eighth Edition

 Remote Journaling 
With
remote journaling
, data transfers are performed in a more expeditious manner. Data 
transfers still occur in a bulk transfer mode, but they occur on a more frequent basis, usually
once every hour and sometimes more frequently. Unlike electronic vaulting scenarios, 
where entire database backup fi les are transferred, remote journaling setups transfer copies 
of the database transaction logs containing the transactions that occurred since the previous 
bulk transfer. 
Remote journaling is similar to electronic vaulting in that transaction logs transferred 
to the remote site are not applied to a live database server but are maintained in a backup 
device. When a disaster is declared, technicians retrieve the appropriate transaction 
logs and apply them to the production database, bringing the database up to the current 
production state.
 Remote Mirroring 
Remote mirroring
is the most advanced database backup solution. Not surprisingly, it’s 
also the most expensive! Remote mirroring goes beyond the technology used by remote 

---

Recovery Plan Development 
827
journaling and electronic vaulting; with remote mirroring, a live database server is main-
tained at the backup site. The remote server receives copies of the database modifications at 
the same time they are applied to the production server at the primary site. Therefore, the 
mirrored server is ready to take over an operational role at a moment’s notice.
Remote mirroring is a popular database backup strategy for organizations seeking to 
implement a hot site. However, when weighing the feasibility of a remote mirroring solution, 
be sure to take into account the infrastructure and personnel costs required to support 
the mirrored server as well as the processing overhead that will be added to each database 
transaction on the mirrored server.
Recovery Plan Development
Once you’ve established your business unit priorities and have a good idea of the appropri-
ate alternative recovery sites for your organization, it’s time to put pen to paper and begin 
drafting a true disaster recovery plan. Don’t expect to sit down and write the full plan in 
one sitting. It’s likely that the DRP team will go through many draft documents before 
reaching a final written document that satisfies the operational needs of critical business 
units and falls within the resource, time, and expense constraints of the disaster recovery 
budget and available personnel.
In the following sections, we explore some important items to include in your disaster 
recovery plan. Depending on the size of your organization and the number of people involved 
in the DRP effort, it may be a good idea to maintain multiple types of plan documents, 
intended for different audiences. The following list includes various types of documents 
worth considering:
■
Executive summary providing a high-level overview of the plan
■
Department-specific plans
■
Technical guides for IT personnel responsible for implementing and maintaining 
critical backup systems
■
Checklists for individuals on the disaster recovery team
■
Full copies of the plan for critical disaster recovery team members
Using custom-tailored documents becomes especially important when a disaster occurs 
or is imminent. Personnel who need to refresh themselves on the disaster recovery proce-
dures that affect various parts of the organization will be able to refer to their department-
specific plans. Critical disaster recovery team members will have checklists to help guide 
their actions amid the chaotic atmosphere of a disaster. IT personnel will have technical 
guides helping them get the alternate sites up and running. Finally, managers and public 
relations personnel will have a simple document that walks them through a high-level view 
of the coordinated symphony that is an active disaster recovery effort without requiring 
interpretation from team members busy with tasks directly related to that effort.

---

828
Chapter 18 
■
Disaster Recovery Planning
Visit the Professional Practices library at
https://drii.org/resources/
professionalpractices/EN
to examine a collection of documents that 
explain how to work through and document your planning processes for 
BCP and disaster recovery. Other good standard documents in this area 
includes the BCI Good Practices Guideline ( 
https://www.thebci.org/
training-qualifications/good-practice-guidelines.html
 ), ISO 27001 
( 
https://www.iso.org/isoiec-27001-information-security.html
 ), and 
NIST SP 800-34 ( 
https://csrc.nist.gov/publications/sp
 ).