Disaster Recovery and Business Continuity Gretchen Grey

Agenda What is it? Planning Process Planning Background Ongoing Readiness

What is it?

Three Areas of Focus Emergency Management Business Continuity Disaster Recovery

Emergency Management Crisis management Life / safety Initial response Assessment Alert Authorities

Business Continuity Alternate worksite Business exposure assessment / risk analysis Business interruption / costs Workaround procedures Reciprocal agreements

Return to acceptable operations Restore critical business functions Data / application recovery Salvage / restoration / disposal Replacement / replenish resources Disaster Recovery

University Planning Roles

University EOC – Emergency Operations Center – Command Center – University President

Planning Process

MAIS Planning Process

Iterations

Goals Protect Employees Minimize the effect of an incident Protect Assets Recover IT Readiness – Prepare and Train

Planning Background

Initiation Former Provost Paul Courant and former CFO Robert Kasdin directed MAIS to work with central offices and business owners to develop disaster recovery/business continuity plans for the University's mission-critical business processes and information systems.

Recovery Background ─ MAIS began planning in earnest more than 2 years ago ─ Time to recovery from major systems outage was 30+ days ─ Preparations in place today offer recovery time of 2 – 5 days

MAIS Systems Recovery ─ Large generator for computer room ─ “Hot site” in Philadelphia ─ Files are copied and stored in a secured facility every day

Continued Improvement ─ Shared computer room at Arbor Lakes ─ Shorten recovery times ─ Reduce costs by eliminating hot site contract

Business Continuity Background ─ Identified critical business processes such as admissions, payroll and purchasing ─ Developed a framework for central offices

Continuity Background ─ Procedures to ‘work around’ systems outage and other contingencies ─ Store emergency supplies and equipment

Continuity Goals Manage crises with central coordination Consistent and accurate internal and external communications Cover key roles And to impart confidence in all stakeholders

Ongoing Readiness

Recovery Test Overview ─ Execute tests at least annually ─ Testing time is limited/precious ─ Set specific goals and objectives ─ Define tasks hour-by-hour tasks ─ All necessary resources are in place

Recovery Test Overview ─ Two 48-hour tests every year ─ Deploy teams to Philadelphia ─ Every test is a success

Continuity Exercises –Table top discussion –Scripted and simulates time passing as realistic as possible –Cross divisional dependencies and touch points –Eventually, introduce unexpected situations

Planning Do’s –Store in a safe and easily accessible location - Don’t leave it at work –Home address, phone, … treat all contents as confidential –Authorized and essential personnel –Call-in number for status and instructions

Raising Awareness in U-M Units ─ Enterprise-wide readiness ─ Not just technology ─ Top-down support ─ Policies / standards

Success Factors –Tests / exercises are valued –Clear directions for every level –Integrated planning with day-to-day operations –Continuous internal awareness

Focus ─ Ask yourself everyday “If I knew for certain that something catastrophic will happen tomorrow, what will I want with me? What will I wish I had done to prepare?”

Web Site See the University’s Emergency Preparedness Web Site