Update on Disaster Recovery

1

• Update on Disaster Recovery
• Task Force Efforts

All SDC-based Agencies will have developed,
maintained, and tested plans by June 2009 to
restore and recover their agency critical
business functions/applications in the event of a
disaster. (per DAS Statewide Business Continuity
Planning Policy 107- 001-010 --
http//egov.oregon.gov/DAS/OP/docs/pdf/107001010.p
df )
Contributors CNIC Disaster Recovery
Task Force State Data Center
June 4, 2007
2
Background

• The CNIC CIOs formed a CNIC Disaster Recovery
  Task force to examine and propose DR solutions
  for systems and services managed by the State
  Data Center.
• The Sungard DR service contract was extended
  through October 2007, while requirements for a
  new RFP and service contract can be gathered and
  awarded.

3
Components of the Business Continuity Plan
BCP
Business Continuity Plan Steps
taken to restore alternate business processes in
the event that automated processes or business
infrastructures are unavailable, employing
documented workaround and/or manual procedures
and alternate resources.

- Relocation of Personnel
- Availability of
remote support services
- Contingency office space
-
Process workarounds
DRP
Disaster Recovery Plan Steps
taken to restore specified infrastructure
requirements in support of key Business Functions
such as Information Systems, business equipment
environments, internal and external network
connections, and data structures utilizing
alternate resources for hardware, software, data,
and networks. - Hardwa
re - System Software
- Data and Data Structures -
Applications - Network Connectivity
- Desktop Services - Product
ion Support
4
DR Task Force Objectives

• Complete DR plans for IT infrastructure that
  support the Agency critical business functions.
  
• Track and manage the BCP/DR planning effort by
  the use of a Scorecard which includes the DR
  tasks, milestone dates, and detailed template
  worksheets.
• Assure all IT application and systems information
  is gathered and loaded in the eBRP Agency
  instance tool. Assumption For disaster
  recovery, the SDC is to be given access to each
  Agencys eBRP instance.
• Develop DR operational guidelines, ala a Concept
  of Operations.
  
• Collaborate with the SDC to issue an RFP for
  recovery service contract pricing and selection
  of a recovery vendor.
  
• Issue a disaster recovery service contract that
  
  
• Will provide recovery for SDC-managed critical
  business services.
  
• Can adopt recovery services for other SDC
  customers and/or out-of-scope services.
  

5
DR Task Force Issues and Proposed Mitigation
Action

• All SDC-Based Agencies to validate their Business
  Critical Functions annually!
  
• Action - Agencies to commit and actively
  support resources and time to identify Agencys
  key
  
• Business Critical Functions.
• - CIOs to identify which of these functions
  need to be recovered in the SDC during a
  disaster.
  
• State to hire limited duration DR Expertise
• Action - Using existing SunGard Contract or an
  RFP process, DAS to hire full time DR expertise.
  
• - Assign DR expert to SDC or State
  CIO Office.
  
• State to hire ongoing full time DR
  Program/Project Manager
  
• Action - Assign DR Program/Project Manager to
  SDC or State CIO Office.
  
• Establish Multi-Agency Workgroups to address key
  DR services
  
• Action - Establish recovery teams for Roles
  Responsibilities, Concept of Operations
  Declaration,
  
• network services, etc.
• - Decide what work can be performed prior to
  the introduction of a DR Expert.

6
DR Task Force Issues and Proposed Mitigation Act
ion (contd)

• Combine BCP information in eBRP with Agencys DR
  detailed template file.
  
• Action - For disaster recovery, propose Agencies
  to give SDC access to their eBRP instance.
  
• - No need to create a program for a
  single combined SDC instance of Agencies DR
  requirements.
  
• Expand Disaster Recovery Scorecard Timeline
• Action - Modify timeline to accommodate
  agency-specific time requirements.
  
• - Extend the SunGard contract as
  necessary until new DR Services RFP is ready.
  
• - Ensure Agencies still meet overall
  deadline of June 30, 2009 BCP deadline, per DAS
  
• Policy 107- 001-010.
• Ensure DR resources to complete the DR Scorecard
  and Template.
  
• Action - Agencies have already
  designated the BCP coordinator, but CIOs need to
  ensure they
  
• have dedicated DR
  technical resources to complete the DR Scorecard.

7
DR Task Force Efforts The Scorecard
8
Disaster Recovery Declaration Process(Sample
Only)
DR Declaration Stage
DR Mobilization Stage
DR Action/Recovery Stage
9
BCP and DR Framework Chart
10
Critical Business Functions (ODOT Sample)
SDC-based Service (11 In-Scope)
SDC Out-of-Scope
11
Disaster Recovery Taskforce Update
CNIC Steering Committee