Disaster Recovery Planning Barry Navarre Charter Business

Introduction Every business and organization can experience a serious incident which can prevent it from continuing normal operations. This can happen any day at any time. The potential causes are many and varied: tornado, power failure, computer malfunction, accident, human error... the list is endless.

Disaster Recovery Plan A disaster recovery plan is a comprehensive approach for handling a variety of adverse conditions. It should specify in detail the processes to handle any event. The DRP must then be maintained, tested and audited to ensure that it remains appropriate to the needs of the organization.

Understand the Plan The Disaster Recovery Plan is the most important item in your armory. It is what you will turn to if there is indeed a disaster or other serious incident. Hopefully, you will never have to use it, but if you do, it can be the difference between the loss of your organization and its survival. It is therefore absolutely critical that it is workable - that it is of sufficient quality to guide you through the crisis. Create a plan that fits the organization.

Process Flow

Pre-study - Risk Assessment What happens when systems fail? How do we function during the event? (normally, limited or not at all) What can we do to protect ourselves? How can we safeguard our data? How quickly can we recover? What is the potential impact? What are the underlying risks?

Management Awareness It is good practice for the organization's Board or Governing Body to demonstrate a clear commitment to establishing and maintaining an effective disaster recovery planning process. All management and staff should be informed that a disaster recovery plan is required in order to ensure that essential functions of the organization are able to continue in the event of serious adverse circumstances.

Planning Having obtained the full backing of the organization, the person or team developing the plan needs to prepare carefully. A good start is to create a list of all necessary documents and information. Where this includes documents containing sensitive information, care must be taken to ensure that confidentiality is not compromised.

Getting Started Information Gathering Organization chart Existing plan (if available) Staff emergency contact information Asset inventories Inventories of information assets Copies of maintenance agreements / service level agreements Service provider(s) contact information Off-site storage procedures (if any) Operations and Administrative procedures

Prioritization Rank operational functions in order of importance to the overall organization. Each item should include a brief description of the business processes and main dependencies on systems, communications, personnel, and information / data.

Network and Application Priorities Mission Critical: Network or application outage that would cause an extreme disruption to the business, cause major legal or financial ramifications, or threaten the health and safety of a person. The targeted system or data requires significant effort to restore, or the restoration process is disruptive to the business or other systems. Important: Network or application outage that would cause a moderate disruption to the business, cause minor legal or financial ramifications, or provide problems with access to other systems. The targeted system or data requires a moderate effort to restore, or the restoration process is disruptive to the system. Minor: Network or application outage that would cause a minor disruption to the business. The targeted systems or network can be easily restored.

Strategy A good disaster recovery plan is more than a binder of information. It is a system of processes put in place to react automatically to any given condition in a prescribed manner. The document merely specifies the steps of each process.

Major Sections of DRP Plan Introduction Business Impact Analysis DRP Organizational Responsibilities pre and post disaster - DRP checklist Backup Strategy for Data Centers, Departmental File Servers, Wireless Network servers, Data at Outsourced Sites, Desktops (In office and "at home"), Laptops and PDA's.

Backup Strategy Power stabilization Surge Protectors Uninterruptible Power Supply (UPS) Back-up Generators Data protection Clear back-up strategy Off-site storage/collocation Hardware Spares Network resiliency Redundant Reliable

Major Sections of DRP con’t. Recovery Strategy including approach, escalation plan process and decision points Disaster Recovery Procedures in a check list format Plan Administration Process Technical Appendix including definition of necessary phone numbers and contact points Job Description for Disaster Recovery Manager and entire disaster recovery team. Work Plan

Verification Performing a regular review and audit of your disaster recovery plan is nothing short of due diligence. It is essential for your to help ensure that you are able to withstand and recover from a major incident. As obvious as this is, it is a fact that many organizations rarely if ever perform such a review. This is not a good short cut to take!

Management Approval Review disaster recovery plan verification results with senior management. Make changes or recommendations as necessary. Review DRP at pre-determined intervals to ensure the plan is still effective.

Implementation Determine how the plan should be implemented? Identify the critical staff members, and their roles. Procure equipment and/or services. Negotiate service agreements with vendors.

Storage Solutions Tape Vaulting Service Disk to Disk (SAN, NAS etc.)

Tape Pros Simple Implementation Inexpensive Widely used Little training required Cons Slow to reload Manually implemented Physical medium susceptible to damage, loss and/or theft in transit to offsite location

Vaulting Service Pros Data stored off-site Easy to implement Provides data integrity Data encryption available Cons Backup and recovery speeds limited to the speed and reliability of your Internet connection Manual recovery process

Typical Vaulting Service

Disk to Disk Pros Provides data integrity Data encryption available Quick recovery Data distribution? Cons Data distribution? Dependent upon network speed and reliability Initial implementation

Disk to Disk

Disk to Disk – with Fiber

Disk to Disk – single location

Hybrid Solution

Higher Education Grants Information Technology Experiences for Students and Teachers Distance Learning and Telemedicine Loans and Grants Information Technology and Infrastructure Systems Alliances for Broadening Participation in STEM (ABP) Partnerships for Innovation (PFI) Networking Technology and Systems Rural Broadband Access Loans and Loan Guarantees Program Modeling and Simulation for Information Systems Research

Conclusion Questions ?????????