Disaster Recovery Peter McCartney

1
Disaster Recovery Planning
Business Impact Analysis(BIA)
2
Business Impact Analysis
The process of analyzing all core business
functions and establishing an optimized timetable
for recovery.

• Maps data flow
• Identify maximum tolerance for downtime.
• Identify interdependencies.
• Determine the recovery priorities of the
  organization.

• Provides baseline for
• Justification for costs associated with recovery.
• Developing recovery strategies.
• Developing Support Level Agreements

3
Business Impact Analysis
End-User Questionnaire Highlights

• Department Overview
• Workflow Interdependencies
• Computer Resources
• Application Impact Analysis

4
Department Overview

• Department Overview
• Workflow Interdependencies
• Computer Resources
• Application Impact Analysis

• Identify department, location, and at least two
  representatives from each department.
• Develop a comprehensive list of applications used
  in the department.
• Describe the business function(s) of the
  department.
• Gather information about the departments daily
  business hours, revenues generated, transaction
  volume, and any peak or high demand periods.

5
Workflow Interdependencies

• Department Overview
• Workflow Interdependencies
• Computer Resources
• Application Impact Analysis

• Identify the departments and organizations that
  send work to the department.
• Determine what routes or channels of
  communication are used to send that incoming work
  and estimate the percentage that comes via each
  route or channel.
• Gather the same information in 1 and 2 for work
  sent by the department.

6
Computer Resources

• Department Overview
• Workflow Interdependencies
• Computer Resources
• Application Impact Analysis

• Gather information on the computing equipment in
  the department and how it is used.
• Begin exploring the reliance that the department
  has on the computing equipment, e.g., What data
  entry backlog would there be if it was
  unavailable for one day?

7
Application Impact Analysis

• Department Overview
• Workflow Interdependencies
• Computer Resources
• Application Impact Analysis

• Basic description of each application, including
  what it does, what business functions it
  supports, if it handles PHI, and who the
  department contacts are for the application.
• Estimate the level of departmental business
  interruption associated with the application
  being unavailable through various time
  thresholds.
• Estimate the associated data entry backlog that
  would result and how many staff hours it would
  take to eliminate the backlog.

8
Application Impact Analysis

• Department Overview
• Workflow Interdependencies
• Computer Resources
• Application Impact Analysis

• Evaluate the downtime procedures associated with
  the application, asking questions like have the
  procedures been used before?, how did they work,
  and how long can the department function using
  them?
• Evaluate any regulatory, legal, financial,
  customer service, and public image problems that
  could arise as a direct or indirect result of the
  application being unavailable through various
  time thresholds.

9
Business Impact Analysis
Other Questionnaires and Interviews

• Executive and Administrative Staff
• IS Staff supporting
• Major Clinical Applications
• Interfaces
• Network Configuration
• Hardware/Servers
• Facility Operations

10
Gundersen Lutheran Inventory

• Initial Y2K inventory had 700 items
• Updates for current environment resulted in 170
  applications
• Interviews identified 122 server based
  applications and their associated runtime
  environments
• Analysis identified 64 applications as mission
  critical

11
Application and System Criticality

• Critical - Applications or resources impacting
  patient care. (No downtime is acceptable).
• Essential - Applications or resources with
  patient health information, patient care data,
  billing, payroll and physical security.
  (Limited downtime).
• Necessary - Department-level applications and
  systems. (Some downtime is acceptable).
• Desirable - Applications and resources that can
  tolerate a significant loss of availability.
  (Recover when normal operations is established).

12
(No Transcript)
13
Top 10 Components

• DataWarehaus
• Clinical Workstation
• Softlab
• SMS
• PP / Cycare
• Lawson
• Wellsoft
• Orsos
• Pharmacy
• Internet/Intranet/Email

14
Critical Component Analysis
Critical
Recovery Time Objective
Essential
Necessary
Desirable
15
Risks and RecommendationsCurrent Strengths

• Knowledgeable staff.
• Limited backup and restore strategies for most IT
  components are in place.
• Telecom and pager systems meet current business
  needs.
• Establishment of a second (backup) ISP is nearly
  complete so as to ensure Internet availability.
• The Data Warehouse is housed on a high
  availability system.
• IS is upgrading to a Netware release that
  enhances server security and availability.

16
Risks and Recommendations Current Opportunities

• Migrate appropriate desktop-based applications to
  a server environment.
• Assess and consolidate server environment.
• Cluster servers to improve availability.
• Expand the use of proactive monitoring of
  applications, systems and interfaces.
• Implement standardized backup and recovery
  procedures across all systems.

17
Risks and Recommendations Current Weaknesses

• The Data Warehouse is the greatest risk area
  across Gundersen Lutherans IT environment due to
  no offsite redundant environment.
• Interface availability and related data
  integrity.
• Critical applications have no offsite redundancy
  and limited internal failover capability.
• Need to build business continuance and disaster
  recovery into the life cycle of every IT
  component.

18
Business Impact Analysis Project Moving Forward
Next Steps

• Business Impact Analysis - Phase 2 Objectives
• Complete the comprehensive IT component audit.
• Provide detailed input for determination of
  service level objectives.
• Complete strategies for decreasing risk related
  to critical applications and IT components.
• Additional Issues
• Identify critical desktop applications and local
  databases.
• Include critical standalone systems in the BIA.
• Consolidate the IS BC/DR plan with departmental
  plans.