DRP World Class Operations - Impact Workshop Info-Tech Research Group, Inc. Is a global leader in providing IT research and advice. Info-Tech’s products and services combine actionable insight and relevant advice with ready-to-use tools and templates that cover the full spectrum of IT concerns. © Info-Tech Research Group Inc.

Beyond Practical Research – Workshops Get You To Results Workshops: Leverage Best-Practices Research and Get to Action Unlike other Research firms, we believe it’s important to help our members implement improvements. An onsite 40-hour workshop, which allows you to make systematic improvements to your core processes. Workshops are designed to help focus attention, create alignment, and ensure best practices are put to work at your organization. Our workshops help you get to immediate impact and results and are tailored to your situation and needs. Workshops: Focused on You Implementing Improvements The goal of each Capability Optimization Workshop is to create tangible benefits and clear improvements as a direct result of the workshop. Specific deliverables, goals, metrics, and outcomes are established for each workshop. Successful workshops will leverage our years of analyst experience and written research to provide an engaging experience which focuses on implementing, and getting to measurable results. Each workshop begins by diagnosing the current state, and then focuses on designing high impact improvements based on best-practices research. Three and six month follow-up will occur to ensure benefit realization. ITRG Workshops provide the best-practices and implementation support necessary to help an IT leader build a World Class IT Operation. Capability Optimization Workshop Diagnose Current State Right- Sizing Process Process Design Measuring Benefits Implementation Support

Common DRP challenges include: Misalignment with business needs, leading to higher costs or under-provisioning. Focusing on major disasters, and lacking an appropriate response to less-obvious disasters. Lack of testing, and therefore lack of confidence in the plan. No analysis of what’s required to improve recovery times. Outcome of this workshop: DR requirements grounded in a business impact analysis. Incident response procedures for minor to major events. Gap analysis derived from step-by-step DR walkthrough. DR technology and process improvement roadmap. DRP Close the gap between your DR capabilities and service continuity requirements.

This workshop is broken into 5 days to develop a plan to meet DR and service continuity objectives NameGoalList of deliverables Module 1Assess the current state Identify mission critical applications and current DR challenges. Prioritized list of critical applications. Critical applications and dependencies identified. Current DR strategies and challenges. Module 2Determine recovery time requirements Determine the cost of downtime & corresponding RTOs/RPOs. Strategy for conducting a BIA. Estimated costs of downtime. Recovery objectives (RPOs/RTOs). Module 3Close the technology gap Prioritize technology investments required to meet RPOs/RTOs. Risk/impact analysis. DR capability gap analysis. DR technology roadmap. Module 4Close the process gapModify processes to minimize risk and reduce downtime. Incident response plan. Escalation timeline from event to DR. Process gap analysis. Module 5Validate technology and process changes Use tabletop testing to validate planned technology and process changes. DR technology and process validation. BCP considerations. Action items and scheduled follow-up.

1.0 Assess the current state 1.1 Identify mission critical business activities and applications Define criteria for “Mission Critical” Identify mission critical business activities Identify the applications that support those business activities 1.2 Identify dependencies Identify the infrastructure and secondary applications that support critical applications Repeat for a tier two (“Silver”) application 1.3 Identify current DR capabilities and challenges Understand high availability vs. fast failover vs. restore from backups Identify current recovery strategies for specific systems Identify DR challenges for specific systems

2.0 Determine recovery time requirements 2.1 Understand BIA goals and benefits BIA impact on appropriate recovery objectives and DR spending What goes into a BIA Develop a strategy for how to include the executive team in the BIA process 2.2 Estimate the business impact of downtime Determine availability requirements Estimate costs of downtime (e.g. lost sales, reduced customer confidence, etc.) Compare the BIA for Gold vs. Silver systems, and re-assess criticality Identify legal/compliance or health/safety impact 2.3 Define RPOs and RTOs based on business impact Understand best practices (e.g. RPO/RTO tiers as a general guideline) Prioritize dependencies that impact data and define RPOs accordingly Compare Gold vs. Silver RPOs and RTOs; are they appropriate? Prioritize dependencies based on importance, and define RTOs accordingly

3.0 Close the technology gap 3.1 Identify risks of failure in your infrastructure Assess risks-of-failure (e.g. identify single points of failure) Estimate impact of failure (e.g. risk of data loss, or affecting other systems) Create a risk/impact chart to identify priority risks 3.2 Use tabletop planning to identify current DR gaps Review tabletop planning – what is it, and how is it done Walk through a DR scenario Perform a gap analysis between current and desired RPOs/RTOs 3.3 Create a DR technology roadmap Define criteria for prioritizing technology investments Prioritize investments to meet DR gaps and address risk areas Create an implementation timeline (e.g. a three year plan)

4.2 Align service management guidelines with DR requirements 4.0 Close the process gap Create an Emergency Response Team (ERT) Create a step-by-step plan from assessment to recovery Define criteria and a procedure for restoring normal operations 4.1 Create an incident response plan that closes your DR gaps Bridge the gap between service management and DR Update severity definitions and escalation rules to meet DR timeline requirements 4.3 Identify other process gaps that impact service continuity Minimize risks of downtime by formalizing IT processes Create a plan to address process gaps Use diagrams and checklists to make SOPs more usable and easier to maintain Create a formal DRP using Info- Tech’s DRP template (takeaway exercise)

5.0 Validate technology and process changes 5.1 Use tabletop testing to validate DR changes Walk through the updated incident response plan for a different DR scenario Assess the impact of planned process and technology changes 5.2 Lay the foundation for business continuity planning Revise the incident response plan as well as planned technology and process changes as needed 5.3 Workshop wrap-up Workshop re-cap and feedback Assign prioritized action items for process and technology changes Understand the differences between DRP and BCP Review existing business continuity capabilities Identify business continuity risks beyond IT (e.g. suppliers, people, documentation, etc.) Schedule follow-up calls with Info-Tech to review progress and answer questions

Related tools and documents This workshop includes the following tools and templates, in addition to this presentation, to enable you to plan technology and process changes to meet your DR requirements: Business Impact Analysis (BIA) Tool DR Planning and Monitoring Tool DR Technology Investments Prioritization Tool Severity Definitions and Escalation Rules Template DRP Workbook Determine application/system criticality, the business impact of downtime, and corresponding recovery point and recovery time objectives. Document your incident response plan and to monitor the status of each task if the plan is invoked. Score technology requirements to help you prioritize what should be done first and create a timeline for implementing changes. Review example of severity definitions that include disaster scenarios and escalation times based on system criticality and DR requirements. Consolidate all workshop activities into one workbook.

DRP Workshop Key Outputs Five Key Outputs to be produced during the Workshop: Business Impact Analysis (BIA) Tool Use this tool to determine application/system criticality, the business impact of downtime, and corresponding recovery point and recovery time objectives. DR Planning and Monitoring Tool Use this tool to document your incident response plan and to monitor the status of each task if the plan is invoked. DR Technology Investments Prioritization Tool Use this tool to score technology requirements to help you prioritize what should be done first and create a timeline for implementing changes. Severity Definitions and Escalation Rules Template Use this template as an example of severity definitions that include disaster scenarios and escalation times based on system criticality and DR requirements. DRP Workbook A collection of the input forms used in this workshop for whiteboard exercises. 5

DRP Workshop: Built on World Class Research, Experience, and Standards Research Process Team with over 30 years experience. Over 2,800 hours of research. Based on primary and in-field research. Tools & Templates 150 page Research Report 15 in-depth activities and exercises Business Impact Analysis (BIA) Tool DR Planning and Monitoring Tool DR Technology Investments Prioritization Tool Severity Definitions and Escalation Rules Template DRP Workbook More... COBIT 5 Grounded in open international standards.