Disaster Recovery and Business Continuity

1
Disaster Recovery and Business Continuity

• 10 20 Questions

2
Recovery/Continuity Planning

• Ability to continue operations in case of
  disruption and survive in case of disaster
• Prioritize critical business operations to
  protect
• Consider entire organization, NOT just IS
• Staff, configuration of facilities, telephones,
  networks to maintain critical business functions
  in short, medium and long term

3
Disaster Events

• Potential for significantly interrupting normal
  business processing
• Cause entire facility inoperative for lengthy
  period, usually gt 1 day
• Recover operational status requires alternate
  processing facility
• Restore software and data from off-site

4
Disaster Events

• Earthquakes
• Floods
• Tornadoes
• Server thunderstorms
• Fire
• Loss of power, telecommunications capability,
  natural gas supply

5
Components of an Effective Business Continuity
Plan
6
Key Decision-Making Personnel

• Notification directory of key decision-making IS
  and end user personnel
• Prioritized list of contacts
• Contacts of equipment and software vendors
• Contacts of personnel at recovery facilities
• Contacts of insurance company agents
• Contacts of contract personnel services

7
Backup of Required Supplies

• Detailed up-to-date hardcopy procedures for
  contract personnel to use
• Provide special forms such as check stock,
  invoice forms and order forms at off-site
  location

8
Organization and Assignment of Responsibilities

• Emergency action team
• 1st response team
• Orderly evacuate personnel
• Damage assessment team
• Assess extent of damage and time required to
  recover operations
• Staff skilled in use of testing equipment,
  knowledgeable about systems and networks
• Identify possible causes, impact on damage and
  predictable downtime

9
Organization and Assignment of Responsibilities

• Emergency management team
• Coordinate activities of other recovery teams and
  make key decisions
• Determine activation of continuity plan
• Disaster overseers
• Retrieve critical and vital data from off-site
  storage
• Install and test systems software and
  applications at recovery site
• Operate from recovery site

10
Organization and Assignment of Responsibilities

• Off-site storage team
• Obtain, package and ship media and record to
  recovery facilities
• Software team
• Load, and test operation system software
• Applications team
• Restore application programs

11
Organization and Assignment of Responsibilities

• Security team
• Continually monitor security and communication
  links
• Emergency operations team
• Shift operators and supervisors who manage system
  operations
• Network recovery team
• Reroute voice and data traffic to recovery site

12
Organization and Assignment of Responsibilities

• Transportation team
• Transport employees to distant recovery site
• User hardware team
• Coordinate delivery and installation of user
  terminals, printers, photocopiers, etc
• Data preparation and records team
• Oversee contract data-entry personnel

13
Organization and Assignment of Responsibilities

• Administrative support team
• Provide clerical support
• Supplies team
• Contact vendors and coordinate logistics for
  on-going supply of necessary office supplies
• Salvage team
• Make more detailed assessment of damage
  determine reconstruction or relocation
• Relocation team

14
System Risk Ranking
15
Recovery Alternatives

• Hot sites
• Fully configured and ready to operate within
  several hours
• Equipment MUST be compatible with primary
  installation
• ONLY additional needs staff, programs, data
  files and documentation
• High cost subscribed service high activation
  cost
• Limited time period, NOT for long-term use, up to
  several weeks

16
Recovery Alternatives

• Warm sites
• Partially configured with network connections,
  selected peripheral equipment but WITHOUT main
  computer
• Assume main computer can be obtained easily
• Cold sites
• ONLY basic environment (electricity, air
  conditioners, flooring, etc.)
• Ready to receive equipment but have NO components
• Activation may take several weeks

17
Recovery Alternatives

• Reciprocal agreements
• 2 or more organizations with similar equipment
• Promise to provide computer time to each other
  when there is an emergency
• Advantages
• Low cost
• Could be ONLY option
• Disadvantages
• NOT enforceable
• Differences in configuration after time

18
Contract with Hot, Warm or Cold Site

• Configuration
• Disaster
• Speed of availability
• Subscribers per site / area
• Priority

• Insurance
• Usage period
• Warranties
• Audit
• Testing
• reliability

19
Off-Site Library Controls

• Maintain inventory of contents, control access to
  and rotate media
• Physical access
• Fire tolerant
• Record kept for files moving in and out
• Record of contents, versions and location

20
Auditing Disaster Recovery and Business
Continuity
21
Review Business Continuity Plan

• Obtain current copy of plan
• Sample distributed copies to verify that they are
  current
• Determine if all critical applications identified
• Determine hot site has correct versions of all
  equipment
• Review contact lists if correct and complete
• Interview emergency personnel to see if they
  understand assigned responsibilities

22
Evaluate Prior Test Results

• Check if historical results kept
• Thoroughness of prior tests
• Corrections incorporated into plan
• Determine problem trends

23
Evaluate Off-Site Storage

• Ensure presence, synchronization and currency of
  critical media and documentation
• Perform detailed inventory review
• Test for correct dataset names
• Volume serial nos.
• Account periods

24
Evaluate Security at Off Site Facility

• Ability to allow ONLY authorized personnel to
  access
• Facility
• Raised flooring
• Humidity controls
• Temperature controls
• Specialized circuitry
• UPS
• Water detection devices
• Smoke detectors
• Fire extinguishing system
• Current inspection and calibration tags

25
Review Alternative Processing Contract

• Obtain a copy of contract and check to ensure
  reliability
• Get everything in writing
• Contract is clearly written and understandable
• Insurance coverage covers all expenses
• Ensure tests can be performed at hot site
  regularly
• Other subscribers do NOT eat up all processing
  time

26
Review Insurance Coverage

• Reflect actual cost
• Media damage
• Business interruption
• Equipment replacement

27
END

• Questions?