1. Building a Business Case for Disaster Recovery Planning - State and Local Government Chris Turnley cturnley@ironmountain.com

2. Agenda About Iron Mountain Off-Site Data Protection Where to Start: Building the Case Challenges, Components and Resources Case Study: Iron Mountain Summary

3. h Servicing > 28,000 customers Approaching 60 vaults in the United States 50+ million pieces of backup media 150+ actual disaster recovery events 10,000+ successful disaster recovery tests 7500+ successful media library relocations

4. Challenges of Data Protection Government Agencies have limited IT staffs/budgets Servers are getting backed up less frequently Recovery sites are unavailable DR initiatives often untested/not funded *Source: Enterprise Storage Group

5. What’s a Disaster? Worst power outage in history Terrorist attack Employee sabotage Hurricanes Earthquakes Virus Attacks Client Definition: Data loss and Business disruption

6. Service Impacts of an Outage People Employees Increased Support Other expenses

7. Recovery in the Balance Balancing Cost and Recoverabilit y RTO RPO $ Disaster Recoverability has a cost:  Additional Hardware  Additional Personnel  Fees for Services  Recovery Time Objective (RTO): How long can you be without the data?  Recovery Point Objective (RPO): How much data loss can you afford?

8. “Lessons Learned” Restricted “Air Space” Clients With a Tested Plan Responded Quicker, More Effectively Authorized Personnel in a Single Location Access to Media for Full Backup Knowledge of Other Vendors, Prepared and Available Location, location, location

9. Business Continuity Components Mission Critical Data Property & Equipment Data People Systems Business Continuity Business & IT Processes

10. The Process Recognize business continuity components Define what you are protecting Prioritize business/service functions Classify outage types, frequencies & duration Determine impact of an outage Calculate the cost of downtime

11. Impact Analysis Core Competencies –It’s what you do –It’s unique in the marketplace –People depend on you for this –It could be a product, service, process, or methodology

12. The Process Recognize business continuity components Define what you are protecting Prioritize business functions Classify outage types, frequencies & duration Determine impact of an outage Calculate the cost of downtime

13. DR Project Charter Project Organization –Sponsor: EVP Operations –Leader: Director Operations –Project Team: General Managers Operations Branch Managers Operations Manager IT Systems Development Manager IT Network Services

14. Business Continuity Components Mission Critical Data Property & Equipment Data People Systems  Service level agreements  Systems involved  Disaster scenarios  Equipment infrastructure  Recovery procedures  Disaster drill calendar Business & IT Processes

15. Recognize business continuity components Define what you are protecting Prioritize business functions Classify outage types, frequencies & duration Determine impact of an outage Calculate the cost of downtime The Process

16. Critical Systems Customer Facing Apps Customer Facing Apps Email Vault Management Vault Management

17. Recognize business continuity components Define what you are protecting Prioritize business functions Classify outage types, frequencies & duration Determine impact of an outage Calculate the cost of downtime The Process

18. Prioritize Business Functions criticalvitalsensitiveNon-critical Cost of Interruption Business Tolerance to Interruption Low high Lowhigh $$$$ $

19. Recognize business continuity components Define what you are protecting Prioritize business functions Classify outage types, frequencies & duration Determine impact of an outage Calculate the cost of downtime The Process

20. Historical Outage Frequency 200 1 2002

21. 0 10 20 30 40 50 60 70 <11-23-45-910-1415-2324-3031-39>40 Time Down (hours) # of Branches Down Historical Outage Duration

22. Classifying Outages: Infrastructure Branch Data Center Types of Outages: Branch Regional National Data Center Types of Outages: Branch Regional National Data Center

23. Recognize business continuity components Define what you are protecting Prioritize business functions Classify outage types, frequencies & duration Determine impact of an outage Calculate the cost of downtime The Process

24. What does it the cost for one day of outage? –727,729 transactions Recording transactions once manually Inputting these transactions after the outage –Cost of recovery team Troubleshoot, resolve problem, and manage the recovery process Branch outage – Hundreds per hour Data Center outage – Tens of thousands per hour Impact of an Outage

25. Recognize business continuity components Define what you are protecting Prioritize business functions Classify outage types, frequencies & duration Determine impact of an outage Calculate the cost of downtime The Process

26. Recognize business continuity components Define what you are protecting Prioritize business functions Classify outage types, frequencies & duration Determine financial impact of an outage Calculate the cost of downtime The Process

27. Building the Business Case Recognize business continuity components Define what you are protecting Prioritize business functions Classify outage types, frequencies & duration Determine financial impact of an outage Calculate the cost of downtime

28. Building a Business Case for Disaster Recovery Planning