Forty per cent of London councils have not tested disaster recovery plans despite their key role in looming general election

Freedom of Information request made by Databarracks finds that despite councils having back-up solutions, they haven't been tested

Two-fifths of London councils have not tested their disaster recovery plans in the past 12 months, despite the fact that they will soon be handling vital electoral data in just a few hours' time.

This is according to Freedom of Information (FOI) requests to 32 London boroughs made by disaster recovery provider Databarracks. It said that the majority of councils responded with details on their business continuity practices, specifically in relation to electoral data.

Peter Groucutt, director of Databarracks, said that 40 per cent was "an alarmingly high number" to have forgone testing, particularly when taking into account that the election is tomorrow.

He said that it was excellent that all councils who did respond to Databarracks had thorough backup and disaster recovery plans in place, but warned that without testing these solutions, they could prove to be useless when called upon.

"We always recommend performing a disaster recovery test at least once a year. At any time in the year councils are under scrutiny to keep sensitive data secure and systems running smoothly. So the run-up to a general election, when the electoral roll is most important, it is vital to ensure your procedures are water-tight," Groucutt said.

In the FOI requests, Databarracks also questioned the councils on their recovery time objectives (RTO) and recovery point objectives (RPO).

The majority of the councils that responded said that their RTO was 24 hours, with some even as long as seven days or in one case up to two weeks. There were also differences in terms of how critical the councils believe the electoral register to be.

"For some it is a ‘priority 1' system, and requires the fastest recovery possible but for others there is no prioritisation, and for some the register is not included on their continuity list or would only be recovered on a ‘best-effort basis'," said Groucutt.

"Imagine if a council thought its RPO was 30 minutes but when it came down to it, it was actually 48 hours? If they haven't tested their DR capabilities, they really have no idea of how they'd cope should disaster strike at the very time that would cause most damage," he added.

Groucutt advised councils to put their backup and disaster recovery policies to the test to ensure they really worked, and acknowledged that there isn't time to test systems before the election.