1. Dennis Reid Senior Consultant Elliot Consulting, LLC
IT Recovery
Dennis Reid
Senior Consultant
Elliot Consulting, LLC

2. Agenda Understanding IT Words to Live By
IT’s Role in Business Continuity
Exercising IT Recovery
Partnering with IT

3. IBM (1 MB of memory)
circa 1974

4. Understanding IT Acronese (ak-ruh-neez), noun
A language that is made up almost entirely of acronyms. Spoken predominantly in the Information Technology industry.
“The DB2 DBA has DFDSS JCL that is getting a B37
abend and the IGD202E message is pointing to the
STORCLAS SMS parm”
Information Technology must ensure it takes a business-centric view of the organization. This starts by ensuring that communication in is nontechnical terms that instead put concepts and communications into terms the business can understand.

5. Understanding IT Information Technology is:
Just another department in the organization; as is HR, Accounting, Facilities, Call Center, etc.
A service provider to its internal and external users
Essential to a successful Business Continuity Program
Is a black hole unless the BCP Manager works to make them a partner in the program.
BC/DR is not the sole responsibility of IT
A successful BC program is one where all departments contribute on an equal basis and support the program in such a way to ensure its success
IT is the innovator of the organization. Use them to create success in the processes used to develop, enhance, and maintain the BC program.
IT can contribute its expertise to add efficiencies to any recovery process.
Technology is the cornerstone of the organization. Even temporary workarounds used in the event that technology services are unavailable are just that – temporary. The organization will eventually grind to a halt without technology.

6. Understanding IT Information Technology is NOT:
All knowing when it comes to the applications, systems, or technology services that are important to the business
Aware of or solely responsible for the data you keep on your desktop or laptop
Able to leap tall buildings at a single bound
Defining critical processes require the participation of IT but IT only knows the services it provides, it can’t measure importance on its own.

7. Words to Live By Is it DR or BC?
Third Party Recovery Services Provider
Cold, Warm, or Hot Site
Internally Managed

8. Words to Live By RTO – Recovery Time Objective
RTA – Recovery Time Achievable
RPO – Recovery Point Objective
RPA – Recovery Point Achievable

9. IT’s Role in Business Continuity
Step 1: Project Initiation
Understand IT’s environment and capabilities
IT should have a current:
Network Topology Map (layer 2 & 3)
Hardware Inventory
Software Inventory
Application Inventory

10. IT’s Role in Business Continuity
Step 2: Hazards, Vulnerabilities, Risks
Where are the single points of failure in the technology?
Network – Age of hardware/software,
patching, redundancy, circuit capacity
Servers – Age of hardware/software,
patching, redundancy
Storage – Age of hardware/software,
what is backed up and how frequently?

11. IT’s Role in Business Continuity
Step 2: Hazards, Vulnerabilities, Risks
Where are the single points of failure in IT staffing?

12. IT’s Role in Business Continuity
Step 3: Business Impact Analysis
Collaborate with IT to create an application inventory BEFORE starting any BIA.
Application Inventory:
Name and location(desktop, DC, 3rd Party)
Acronese translation, if required
State if recovered automatically
RTA & RPA (do not include for BIA)
IT MUST participate in each BIA with you

13. IT’s Role in Business Continuity
Step 3a: Business Impact Analysis
IT is required to do their own BIA
Focus on IT’s impact as a department
People
Processes
Qualitative/Quantitative Impacts
What’s important to you may not be important to IT

14. IT’s Role in Business Continuity
Step 4: Mitigation Strategies
Area 1: IT infrastructure
Work with IT to understand options and identify costs for mitigating single points of failure identified in Step 2.

15. IT’s Role in Business Continuity
If you hear “Everything is backed up to the cloud” – be afraid, be very afraid…
Whose Cloud?
What is “the cloud’s” BC plan? (Supplier BC plans…)
What is “the cloud’s” RTO for
restoring your data?

16. IT’s Role in Business Continuity
Area 2: Business Support
Is all critical data being backed up?
What is the appropriate mechanism for backup (based on RTO & RPO)
Remote Access: “Work from Home” What is IT’s solution for user access in times of crisis?
Matching RTO/RPO to RTA/RPA

17. IT’s Role in Business Continuity
Scenario:
$500,000/day of lost revenue if the ABC application is not available within 24 hours after a disruption
IT reports that the RTA for the
application is 48 hours

18. IT’s Role in Business Continuity
The cost to meet the RTO:
Redundant hardware/software: $1.8mm
Add’l network circuits: $10,000/mthly
Vendor maint/support: $25,000 mthly
The gap between RTO & RTA boils down to a financial decision for the business

19. IT’s Role in Business Continuity
Step 5: Crisis Communication
IT has the same responsibilities as all other departments
IT can provide technical expertise to identify, implement, and manage communication and collaboration
tools

20. Application Data Recovery
IT’s Role in Business Continuity
Step 6: IT Recovery
Application
Available
Application Recovery
& Validation
RTO
Application Data Recovery
& Validation
Hardware/Operating System Recovery
Alt. Network Activation
OUTAGE/DECLARATION

21. Exercising IT Recovery
If IT has implemented a failover to backup systems, has this been tested? How?
If system or data recovery must be performed, has this been tested? How?
Are specific, measurable objectives set prior to each IT exercise?
Are the technology resources required
by the most critical business processes
being tested? Does the business participate?

22. Exercising IT Recovery
Are the results documented in detail for each objective?
Are the RTOs/RPOs being met? If not, why not?
What are the mitigation plans for the objectives that were not met, and their deadlines?
When will the failed objectives be
tested again?

23. Partnering with IT
IT must provide an application inventory prior to commencing the BIA phase
A subject matter expert from IT must be part of your BIA team and must be present at all BIA meetings.
Collaborate with IT when setting objectives for all exercises that would include an IT service.

24. Partnering with IT
Involve IT in every step of the BC planning process. They can be instrumental in creating solutions that can:
Enhance preparedness
Mitigate risks
Reduce RTO/RPO
AND
MAKE YOUR JOB EASIER!

25. QUESTIONS?