Not Just an “IT Thing”

One misconception is that disaster recovery planning is a computer function or “something that the IT department does.” It must go beyond just information technology. Yes, effective disaster recovery includes ensuring that a device firm’s nerve center—usually the computer system—is functional. It must, however, transcend an IT-only fixation.

At a medical device firm, one person may oversee risk management or have title of risk manager. The scale of most medical device firms does not allow the luxury of having a full-time risk manager. Regardless of the title of the person tasked with this role, however, disasters present a crucible. Disaster recovery should not depend just on the risk manager but rather on many people. There should be interchangeability so that executing the plan does not depend on one person, i.e. the risk manager. Redundancy is a sound risk management attribute for medical device firms. So is a multidisciplinary approach.