1. BCP/DRP Consultancy Project- An approach
By D V Ramamohan Global Head of IT Consultancy Practice 3i Infotech Ltd

2. Agenda Overview of BCM- BCP/DRP ?
Approach to Execution of BCP/DRP Assignments
Interaction

3. What is BCM…………..
Business Continuity Management is an holistic management process that identified potential impacts that threaten an organization and provides a framework for building resilience and capability for an effective response that safeguards the interest of its key stakeholders, reputation, brand and value creating activities.
Business continuity means maintaining the uninterrupted availability of all key business resources required to support essential business activities.

4. What is BCP/DRP?
The difference between business continuity and disaster recovery is not a ‚what' but a ‚whose'.
This holistic view of business continuity management differs from what many managers traditionally term Disaster Recovery Planning which has been closely, if not solely, associated with information technology. By changing the focus, the emphasis is placed on the whole business, not just on technology issues alone. This reinforces the concept of continuity of all key processes, extending beyond information technology systems, important though they are in modern business.

5. Threats to Availability Why BCP-DRP….
COMPONENT FAILURE
DATA CORRUPTION
APPLICATION FAILURE
MAINTENANCE
USER ERROR
SITE OUTAGE
Why BCP-DRP….

6. Goals of Disaster Recovery Planning
Disaster scenarios and Recovery Strategies:
“Building on fire / Shambles”
Alternate Site, Hot site vendor, Data vaulting
Facility stands inaccessible
Remote connectivity, tape libraries
Facility accessible, physical failure
Redundant systems, HW Vendor SLA’s
Facilitate & equip operational, logical failure
Standards, Documented procedures, security

7. Why DRP?.....Few statistics Major disasters:
9/11attack, UK bombings, Flooding in Mumbai, Earthquake in Indonesia
Other statistics:
% of Hardware failure
% of Operational error
Cost per hour of downtime? - $ 78000
Average incidents per hour? 9
Hours per incidents? 4.2 hrs
Downtime cost per year? $ 2,970,000
(Research shows 80%)
Source: Contingency Planning Research conducted on 450 fortune 1000 companies

8. Let us execute an DRP assignment…

9. What will be scope of work
Subjects:
IT Systems/Applications/Data
Data Centre/Facilities/Services
People
Technical/Functional:
Disaster Recovery Strategy and Solutions
Disaster Recovery Plan and Procedures
Implementation Guidance to implement proposed solutions
Testing the Plan
Training

10. What will be the deliverables….
Business Impact Study Analysis and Risk Assessment Report
Disaster Recovery Strategy vis-à-vis Scenarios
DR Solution Architecture
DR Team Organization and Roles
Disaster Recovery Plan and Procedures
Setting up Disaster Recovery Site, if need be
Test Plans/ Mock drills reports
Maintenance Plan
Training

11. What should be the Approach……..
Project Management Methodology:
Your own….
Kick off meeting
Execution
Closure meeting
Execution of assignment:
Step one: Key IT Assets identification and RA
Step two: Business impact analysis (BIA)
Step three: Design continuity treatments
Step four: Document the Plans
Step Five: Implement continuity treatments
Step Six: Test and maintain the plan
Step Seven: Training

12. Step one: Key IT Assets identification and RA

13. Asset identification…
Obtain/inventory the key assets
Hardware
System Software
Applications
Data
People
Facilities/Services
Perform Risk Analysis
Qualitative
Quantitative
Judgemental

14. Risk Assessment and Management
Asset Identification
And valuations
Identification of
vulnerabilities
Identification of
threats
Asset Identification
And valuations
Business Riks
Rating/Ranking
Of Risks
Level of
Acceptable Risk

15. Step Two: Business Impact Analysis

16. Business Impact Analysis
Establish the Organization’s Recovery requirements
Requirements defined by Business Units
Identify and Define Critical Business Processes
Identify Systems
Identify Recovery Timeframes and Recovery
objectives for each process
IT Department’s involvement is the enabler for the
Plan

17. Step Three: Design Continue treatments

18. (Recovery Point Objective) (Recovery Time Objective)
Recovery objectives
Wks
Days
Hrs
Mins
Secs
Secs
Mins
Hrs
Days
Wks
Data Loss
(Recovery Point Objective)
Downtime
(Recovery Time Objective)
Mirroring / Replication
Clustering
Backup
Restore from Disk
Vaulting
Restore from Tape

19. Step Four: Document the plans

20. Document Plans Organization of the Teams
Detailed Procedures – Technical & Manual Workarounds
Emergency Response Flow
Emergency Contact Lists
Crash Kits

21. Business Continuity Committee (Management Authorization)
BCP Team Organization
Business Continuity Committee
(Management Authorization)
Execution Teams
BCP Team Leader
BCP Spokesperson
Internal Auditor
Emergency
Action Team
Damage
Asst. &
Salvage Team
Relocation
Team IT
Admin,
Security &
Support Team
Operations

22. Documentation should cover
Risk Management
Environmental Management
Emergency Management
Crisis Management
IT Disaster Recovery
Knowledge Management
Facility Management
Human Management
Supply Chain Management
Security and Privacy
Health and Safety
Communications PR
Enterprise business process, people and technology

23. Step Five: Implement Continue Treatments

24. Step six: Test/Exercise the plans

25. Test/Exercising the Plans
Controlled Test of Procedures
Structured Walkthroughs
Desktop Tests
Simulation Test
Partial Technical Tests
Full Scale Tests
Allows Management to understand:
Inaccuracies
Omissions
Apply Lessons Learned
Revise Procedures & Incorporate into the Plan

26. Step six: Training…

27. Training………. Create Corporate Awareness of Developed Plans
Team needs to be made knowledgeable of their role
Training Primary & Alternates Contacts
Awareness on task handling (JD) for Team
“Management Support is Key for any BCP-DR Activity”

28. Few websites… www.pas56.com Guide for BCM
for BC Guidelines
for BS25999 (Replacement of PAS 56)
for ISO/IEC 24762:2008

29. Interaction