BCP DR Planning

Business Continuity Planning and
Disaster Recovery Planning
Corporate risks could cause an organization to

suffer
• Inability to maintain critical customer services
• Damage to market share, reputation or brand
• Failure to protect the company assets including intellectual
properties and personnel
• Business control failure
• Failure to meet legal or regulatory requirements
1
Business Continuity Planning
… a “disaster”
is an event, often unexpected, that seriously

disrupts your usual operations or processes
and can have long term impact on your
normal way of life or that of your
organization.
2
Security Management, Sec Business
Architecture & Models, Laws, Disaster Continuity &
Ethics, Physical Sec Controls,, Disaster
Access Control, OpSec, Apdev
Recovery
Sec, TNI Sec, Cryptography
… it is:
• a process to minimize the impact of a major
disruption to normal operations
• a process to enable restoration of critical
assets
• a process to restore normalcy as soon as
possible after a crisis.
… it is not just:
• recovery of information technology resources
3
… and it is the phase of crisis management

that follows the immediate actions taken to
protect life and property and contain the
event
… it begins when the situation has been
stabilized.

Incident Management
All types of incidents should be categorized

• Negligible
• Minor
• Major
• Crisis
4
Business Impact Analysis
• Critical step in developing the business continuity

plan
• Three main questions to consider during BIA phase:
1. What are the different business processes?
2. What are the critical information resources related to an
organization’s critical business processes?
3. What is the critical recovery time period for information
resources in which business processing must be resumed
before significant or unacceptable losses are suffered?
Recovery Point Objective and Recovery

Time Objective
• Recovery Point Objective (RPO)

– Based on acceptable data loss
– Indicates earliest point in time in which it is acceptable
to recover the data
• Recovery Time Objective (RTO)
– Based on acceptable downtime
– Indicates earliest point in time at which the business
operations must resume after a disaster
5
Recovery Point Objective and
Recovery Time Objective
• When is it a Crisis?
Minutes Hours Days Weeks
Continuity Continuum
6
7
Alarm Notification to First Responders
Data center fire
Restoration of Critical Processing
8
Activate the Emergency Operations Center
IT decision to move to a backup facility
9
Assemble IT recovery team at appropriate sites
Obtain backup tapes from off-premises storage
10
Acquire and install backup hardware

and network connections
Restore Operating System and Network
11
Reload database and other data
Restore Critical Applications
12
Begin Critical Processing -

This is your Recovery Time Objective (RTO)

High Level Look at a Recovery Effort
Lost Data
Vital Records Resume Move to Return

Restore Technology Capability Business Alternate Home
Notifications Site
Restore Communications
(If necessary)
Restore Business Functions Data Synchronization
Data Recovery Objective
Recovery Time Objective
Source: Gerald Isaacson 2005
13
Recovery Strategies
• A recovery strategy is a combination of

preventive, detective and corrective measures
• The selection of a recovery strategy would
depend upon:
– The criticality of the business process and the
applications supporting the processes
– Cost
– Time required to recover
– Security
14
Recovery Strategies
Recovery strategies based on the risk level

identified for recovery would include
developing:
• Hot sites
• Warm sites
• Cold sites
• Duplicate information processing facilities
• Mobile sites
• Reciprocal arrangements with other organizations
Recovery Strategies
Types of offsite backup facilities

• Hot sites - Fully equipped facility
• Warm sites - Partially equipped but lacking
processing power
• Cold sites - Basic environment
• Duplicate (redundant) information processing facility
• Mobile sites
• Reciprocal agreement
– Contract with hot, warm or cold site
– Procuring alternative hardware facilities
15
Recovery Strategies
Types of offsite backup facilities

• Hot sites - Fully equipped facility
• Warm sites - Partially equipped but lacking processing
power
• Cold sites - Basic environment
• Duplicate (redundant) information processing
facility
• Mobile sites
• Reciprocal agreement
– Contract with hot, warm or cold site
– Procuring alternative hardware facilities
Recovery Alternatives
(continued)
Provisions for use of third-party sites should

cover:
• Configurations
• Disaster
• Speed of availability
• Subscribers per site and area
• Preference
• Insurance
• Audit
• Reliability
16
(continued)
Procuring alternative hardware facilities

• Vendor or third-party
• Off-the-shelf
• Credit agreement or emergency credit cards
Provisions for use of third-party sites should

cover:
• Configurations
• Disaster
• Speed of availability
• Subscribers per site and area
• Preference
• Insurance
• Audit
• Reliability
17
Development of Business
Continuity and Disaster
Recovery Plans
Factors to consider when developing the plans
• Pre-disaster readiness
• Evacuation procedures
• Circumstances under which a disaster should be declared
• Identification of plan responsibilities
• Identification of contract information
• Recovery option explanations
• Identification of resources for recovery and continued
operation of the organization
• Application of the constitution phase
Organization and Assignment of

Responsibilities
The emergency management team coordinates the

activities of all other recovery teams. This team oversees:
• Retrieving critical and vital data from offsite storage
• Installing and testing systems software and applications at the
systems recovery
• Identifying, purchasing, and installing hardware at the system
recovery site
• Operating from the system recovery site
• Rerouting network communications traffic
18
Organization and Assignment
of Responsibilities (continued)
The emergency management team coordinates the

activities of all other recovery teams. This team oversees:
• Reestablishing the user/system network
• Transporting users to the recovery facility
• Reconstructing databases
• Supplying necessary office goods, i.e., special forms, check stock,
paper
• Arranging and paying for employee relocation expenses at the
recovery facility
• Coordinating systems use and employee work schedules
Other Issues in
Plan Development
• Management and user involvement is vital to

the success of BCP
– Essential to the identification of critical systems,
recovery times and resources
– Involvement from support services, business
operations and information processing support
• Entire organization needs to be considered
for BCP
19
Components of a Business
Continuity Plan
A business continuity plan may consist of more
than one plan document
• Continuity of operations plan (COOP)
• Disaster recovery plan (DRP)
• Business resumption plan
• Continuity of support plan / IT contingency plan
• Crisis communications plan
• Incident response plan
• Transportation plan
• Occupant emergency plan (OEP)
Components of a
Business Continuity Plan
(continued)
Components of the plan
• Key decision-making personnel
• Backup of required supplies
• Telecommunication networks disaster recovery methods
• Redundant array of inexpensive disks (RAID)
• Insurance
20

BCP DR Planning

Uploaded by

Copyright:

Available Formats

BCP DR Planning

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

BCP DR Planning

Uploaded by

Copyright:

Available Formats

Business Continuity Planning and

Disaster Recovery Planning

Corporate risks could cause an organization to

is an event, often unexpected, that seriously

Business Continuity Planning

Business Continuity Planning

… and it is the phase of crisis management

Business Continuity Planning

All types of incidents should be categorized

• Critical step in developing the business continuity

Recovery Point Objective and Recovery

• Recovery Point Objective (RPO)

Business Continuity Planning

Minutes Hours Days Weeks

Minutes Hours Days Weeks

Business Continuity Planning

Minutes Hours Days Weeks

Minutes Hours Days Weeks

Business Continuity Planning

Alarm Notification to First Responders

Data center fire

Restoration of Critical Processing

Activate the Emergency Operations Center

Restoration of Critical Processing

Business Continuity Planning

IT decision to move to a backup facility

Restoration of Critical Processing

Assemble IT recovery team at appropriate sites

Restoration of Critical Processing

Business Continuity Planning

Obtain backup tapes from off-premises storage

Restoration of Critical Processing

Acquire and install backup hardware

Restoration of Critical Processing

Business Continuity Planning

Restore Operating System and Network

Restoration of Critical Processing

Reload database and other data

Restoration of Critical Processing

Business Continuity Planning

Restore Critical Applications

Restoration of Critical Processing

Begin Critical Processing -

Restoration of Critical Processing

Business Continuity Planning

Vital Records Resume Move to Return

Recovery Time Objective

Source: Gerald Isaacson 2005

• A recovery strategy is a combination of

Recovery strategies based on the risk level

Types of offsite backup facilities

Types of offsite backup facilities

Provisions for use of third-party sites should

Procuring alternative hardware facilities

Provisions for use of third-party sites should

Organization and Assignment of

The emergency management team coordinates the

The emergency management team coordinates the

• Management and user involvement is vital to