1. IT Disaster Recovery CAUBO 2008 Information Systems and Technology

2. IST Academic Computing and Networking Administrative Systems Telecommunications Classroom Support/Production Systems Bannatyne campus 165 staff $16M budget Many locations but single computer room

3. Disaster Recovery is the process, policies and procedures of restoring operations critical to the resumption of business, including regaining access to data (records, hardware, software, etc.), communications (on campus, internet, CANARIE, etc.), workspace, and other business processes after a natural or human-induced disaster. Most large companies spend between 2% and 4% of their IT budget on disaster recovery planning; this is intended to avoid larger losses. Of companies that had a major loss of computerized data, 43% never reopen, 51% close within two years, and only 6% will survive long-term. Hoffer, Jim. "Backing Up Business - Industry Trend or Event." Health Management Technology, Jan 2001 What critical systems and data to bring back while rebuilding DR is not business as usual What critical systems and data to bring back while rebuilding DR is not business as usual

4. IST Assumptions Dealing only with centrally supported IT infrastructure and services Based on the draconian scenario of a total loss of the computer room Lesser disasters could make use of parts of the overall plan The priorities are set according to University priorities - in the event of a disaster we will remain open and continue to teach

5. IST Four phases 1.Criticality assessment 2. Recoverability assessment 3. Recovery scenarios 4. IT Recovery Plan

6. IST Criticality Assessment The purpose of this activity is to Validate the critical functions / processes Confirm the business recovery requirements for the critical business processes including Recovery Time and Recovery Point Objectives (RTO, RPO) Confirm the critical Information Technology resource requirements such as hardware, software, network and procedures that are required to support the critical business processes.

7. IST Criticality Assessment The University of Manitoba identified ten business units to participate in the criticality assessment Academic Support Advancement Finance Human Resources Library Services Research Student Services Telephony Web Services Network Services

8. IST RTO The recovery time objective (RTO) is the duration of time and a service level within which a business process must be restored after a disaster in order to avoid unacceptable consequences associated with a break in continuity. RPO Recovery point objective (RPO) (RPO) describes the amount of data lost measured in time. Example: If the last available good copy of data upon an outage was from 18 hours ago, then the RPO would be 18 hours.

9. IST Impact analysis Financial Company Assets Employee/Faculty, Customers Legal & Regulatory Corp. Image, Public Image Students Competitive Position

10. 10

11. 11

14. IST Notes RTO has to include the time to recover the core network, application and database servers and data as well as testing the recovered system A triage or reality check is necessary - most business units will overestimate RTO RTO estimates must be in the context of the business unit but also in the context of University priorities We discovered that the critical applications are not the administrative systems - they are the web space, portal and learning management system

15. IST Recoverability Assessment The objective of this activity is to identify gaps between the capability and the recovery requirements identified by the business as part of the criticality analysis.

16. IST Recoverability Assessment Template driven Each group in IST reviewed their server infrastructure Classified into core, required for disaster recovery and other 1.Application support 2.Desktop 3.Backups 4.Bannatyne campus 5.Database 6.Email 7.Facilities 8.Linux 9.Unix 10.Network 11.Novell 12.Storage 13.Telecommunications 14.Web services 15.Windows Colour coding; orange for core; yellow required for DR

18. IST Recovery Scenarios

20. IST On campus hot site Duplicating critical infrastructure Servers, storage, redundant cabling Network core switches Telecommunication facilities $3M to $4M

21. IST Contracted site Duplicating critical infrastructure smaller level Servers, storage, commercial networking Not including telecommunication facilities $500K per year plus usage, staffing, travel, network charges

22. IST Trailer Duplicating critical infrastructure smaller level Servers, storage Not including telecommunication facilities $200K per year plus usage, hitching post

23. IST Drop ship Annual fee for guaranteed delivery of critical equipment within 24-48 hours Cost depends on how much equipment and what kind

24. IST Technology Recovery Plan

25. IST

28. Sample

29. IST Sample