BCP Coordinators Quarterly Meeting Disaster Recovery Overview

1
BCP Coordinators Quarterly MeetingDisaster
Recovery Overview
Presented by Claudia Light Date 1/26/2009
2
Business Continuity Planning and Disaster
Recovery (DR)
Business Function

• BCP definition Advance arrangements and
  procedures that enable an organization to respond
  to an event in such a manner that critical
  business functions continue with planned levels
  of interruption or essential change.
• DR definition - The technology and
  telecommunications aspect of a business
  continuity plan the advance planning and
  preparations necessary to restore IT
  infrastructure, minimize loss and ensure
  continuity of the critical business functions of
  an organization in the event of disaster or
  unplanned event.
• Both look at What are you going to do if . . .

Business Processes
Supporting applications
Underlying infrastructure hardware and software
3
SDC Role in Disaster Recovery

• Lead research and procurement efforts for
  DR-related services and options
• Work with customer agencies on DR testing
• Perform recovery tasks and operate recovered
  components

4
Successful DR Requires Cooperation

• Participating Agency
• Plans DR based on business needs and priorities
• Acquires DR services for out-of-scope IT
• Funds DR planning, backup recovery
• Prioritizes recovery sequence within agency
• Tests agency DR plans
• Determines scope and declares disaster for
  out-of- scope IT
• Arranges for backups of data and applications
• Keeps vendor informed of changes

• SDC
• Plans internal continuity of service delivery if
  infrastructure must relocate
• Contracts with DR vendor to provide
  infrastructure environment in case of SDC
  disaster
• Determines scope and declares SDC disaster to DR
  vendor
• Coordinates Cross-Agency priority sequencing
• Tests SDC DR plans
• Coordinates movement of people, backup
  resources, and communications connectivity
• Keeps vendor informed of changes

• Disaster Recovery Vendor
• Provides environment for disaster recovery and
  testing (hot sites and portable sites)
• Hosts DR tests
• May provide consulting and operations support as
  contracted

5
SunGard Price List

• ATA signed
• DRP consulting available through price list
• Initial purchase was roll-over of existing
  expenditure level - 26,000/mo
• zSeries processor and peripherals (1200 mip LPAR,
  400 mip IFL, 32 GB memory, OCE printer, firewall,
  etc.)
• Tape library and tape drives
• 8000 GB Mainframe DASD
• 12 x86 servers for infrastructure restoration
• Web redirect services
• Testing capabilities

6
Cost Criteria for Disaster Recovery

• 50 of organizations will spend 4 10 of data
  center budgets for DR. The average for
  government is 7.8
• DR spending categories
• Server capital
• Storage capital
• Storage and Operations Software
• Support staff for DR preparation and planning
• Telecom for backup and recovery
• External services

Source Gartner webinar on Improving Disaster
Recovery Management Maturity by John Morency And
Disaster Recovery Spending Trends by John P.
Morency and Roberta J. Witty, 4/11/08, ID
G00155049
7
Recovery Options
8
What BCP Coordinators need to know

• Who is your DR coordinator?
• Has your agency done DR planning?
• What applications are needed to support critical
  business functions?
• Where are those applications hosted?
• What are the disaster recovery time objective
  (RTO) and recovery point objective (RPO) for each
  of those applications?
• Are the applications and their data backed up
  frequently enough to meet RPO?
• Is the recovery option and grouping of back ups
  for each application reasonable for the RTO?
• Will the agencys budget planning support the
  cost associated with meeting the desired RTO and
  RPO level?

9
Questions?
10
SDC Service Continuity View
SDC partially usable
SDC not usable
SDC can be used
Operational Recovery Restoration of normal
service is part of standard rates
Disaster Recovery additional costs apply
Grey area - Expected time to return equipment to
normal service will determine whether DR is
invoked
Impact to service delivery
Outage Impact
Normal Operations
Severity 4
Severity 3
Severity 2
Severity 1
Disaster
Bug or minor issue where application is still
functioning
Major issue with high impact equipment not
usable
11
Recovery Timeline
MAD
RPO
RTO
Work Recovery
Restoration Time
Work backlog, Workaround procedures
Recover lost transactions, Accomplish backlogged
work
Rebuild business continuity systems
Lost transactions
Business process meeting SLAs
Systems recovered
Last backup or data replication
Disaster event
Business continuity protection restored
Source Building a Business Impact Analysis
The Keystone to Effective Business Continuity
Planning by Richard Jones, v1 7/30/2008, Burton
Group
12
Definitions for Recovery Timeline

• MAD Maximum Allowable Downtime the maximum
  amount of time the business can suffer an
  inoperable business process before significant
  negative consequences are felt. Also called
  Maximum Acceptable Outage (MAO), Maximum
  Allowable Outage (MAO), Maximum Acceptable
  Downtime (MAD), Maximum Tolerable Downtime (MTD),
  Maximum Tolerable Outage (MTO), and Maximum
  Tolerable Period of Disruption (MTPD).
• RPO Recovery Point Objective the amount of IT
  systems data or transaction loss that can be
  tolerated by the business process
• RTO Recovery Time Objective the time IT
  organizations have to recover their systems to an
  agreed upon operational state so that workers may
  then recover the lost time of the outage to bring
  the business process back to acceptable service
  levels.
• Work Recovery The work time required to recover
  the lost transactions of the RPO time plus the
  backlog of work created during the system outage.
  Lost transactions must be recovered manually and
  procedures should be in place to accomplish this
  work.
• Restoration time Time to bring the business
  process back to a state of full business
  continuity protection. Basically this is backing
  up the recovered system and restoring redundancy
  capabilities.

13
Example Complex System
Continuity Group must be able to synchronize
backup data across multiple applications on
multiple platforms
CMS M/F
FS M/F
IIS M/F
DHS
TRACS AIX M/F
ACCESS AIX M/F
FACIS AIX M/F
WebSphere AIX
CICS M/F
Sybase AIX
SDC
Tape
Disk
Gateways
Restore Utilities
Management Tools
OSs
14
Example Stand Alone System
DAS P D
(application checkout)
Print Plan Scheduling System X86 (WPSDCDB001)
SDC
ACRONIS Image and/or TSM backup Win 2003 Server