Disaster Recovery Planning Using A Building Blocks Approach Presented by the CDE Information Security Office

Risk Management Planning  Purpose: Business Continuity –Multiple Plans Different purposes Overlapping areas, subjects, and business groups –Confusion, loss of focus, complicated, information security risks

Types of Risk Management Plans for All State Entities Emergency Response Plan Pandemic Flu Contingency Plan Crisis Communications Plan Continuity of Government Plans (COG) Continuity of Operations Plan (COOP) Disaster Recovery Plan (formerly ORP) Business Resumption Plan Incident Response Plan

Definition – Contingency Plan Contingency means - something dependent on a possible future event; something incidental to something else. Incidental means - occurring or likely to occur as an unpredictable or minor accompaniment.

Three Phases of Event Life Safety Event Response Business Resumption

Putting the Phases and the Plans Together

How to Develop the Plans? Challenges  Duplicate Information  Similar Components  Establishing Boundaries for Responsibility  Maintenance Difficulties  Security of Information – Access and Use  Coordination

DR Plan Building Blocks Essential Department Functions DRP Communications Component – Internal versus External DRP Response Component DRP Resources IT Recovery Component

Using Building Blocks (Legos) to piece it all together

Authoritative Plans by Function Life Safety – ERP Essential State Government Functions – COG Essential Department Functions – COOP IT Recovery Functions – DRP Business Recovery Functions – BRP Communications Functions – CCP

Plans in Action –Scenario Crisis Communications Plan – handles all external communications and the information flow within the agency ERP – Life safety COOP – Establishes essential functions – independent of IT DRP – restores IT BRP – complete business functionality

Incident Management The process used to coordinate the interaction of all of the plans.

Questions?