SAPbiz

1
SAPbiz

• Disaster Recovery Update
• Bil Huxley IST Administrative Computing
• 14-September-2005

2
SAPbiz Disaster Recovery Agenda

• Disaster Recovery vs. Business Continuity
• MIT Disaster Priorities Organizational
  Structure
  
• MIT Business Continuity Management Team FARM
  Plans
  
• Recent Disaster Recovery related activities
• SAP Payroll to establish new recovery
  requirements
  
• SAP recovery requirements
• Disaster Recovery exercise proposed for Spring of
  2006
  
• Next Steps

3
Disaster Recovery vs. Business Continuity

• Disaster a sudden calamitous event bringing
  great damage, loss, or destruction broadly a
  sudden or great misfortune or failure
  
• Although instances of computer crime and abuse
  receive extensive media attention, human error is
  estimated to cause greater losses in information
  systems operation. Disasters such as earthquakes,
  floods, and fires are the particular concern of
  disaster recovery planning, which is a part of a
  corporate business continuation plan. A
  contingency scheme is also necessary to cover the
  failure of corporate servers or
  telecommunications networks. Britannica Article Information systems security

4
MIT Disaster Priorities

• Life and Safety will take priority in the event
  of a disaster. This may include the Cambridge
  community or other neighbors as well as students
  and staff housed by MIT.
• MITs Emergency Management Team and Emergency
  Operations Center (http//informit.mit.edu/emergen
  cy/) will coordinate all activities in the event
  of an emergency.
• People and Data are irreplaceable!
• Today there is increased concern for preparedness
  to deal with larger disasters (multiple
  buildings) and to comprehensively assess the
  value of contingency planning for a much broader
  collection of information systems.

5
MIT Business Continuity Management Team FARM
Plans

• Through 2001 MITs Disaster Recovery efforts were
  led by MITs BCMT (http//web.mit.edu/bcmt/) and
  focused on plans to deal with the loss of single
  buildings / offices.
• Functional Area Recovery Management (FARM) Plans
  were published which dealt with about a dozen
  central offices / facilities including the W91
  Data Center (http//web.mit.edu/bcmt/PlanLib.html)
  . On average these plans have been updated about
  every 3 years.
• Data backups and alternate servers at on-campus
  sites were deemed adequate (sufficient risk
  mitigation).

6
MIT Business Continuity Management Team FARM
Plans

• Freshman Admissions
• Student Services Information Technology
• Payroll
• SAP ERP
• Technology Licensing Office
• Comptroller's Accounting Office
• W91-Data Center
• Human Resources
• Student Financial Services
• Libraries
• Facilities
• Financial Planning
• Office of Sponsored Programs

7
Recent Disaster Recovery related activities

• October 2004 SAP E40 Recovery Simulation (Core
  R/3)
  
• Late 2004 SAP ITS Servers upgraded (Linux)
• Early 2005 SAP migrated to new EMC SAN
• May 2005 SAP Integration Test for hardware
  renewal
  
• May 2005 SAP R/3 Servers upgraded (SUN Servers)
• May 2005 SAP WAS/NetWeaver technology installed
• July 2005 SAP ERP FARM Plan updated

8
SAP Payroll - new recovery requirements

• Weekly Non-Exempt Time Entry Payroll run in SAP
  have a window of about 60 hours in a non-Holiday
  week to deliver deposit information to the bank /
  Federal Reserve. In a week with a Monday Holiday
  this window shrinks to about 36 hours.
• Other Payroll processes may also have
  requirements which could be very challenging if a
  48 hour SAP recovery were required at the least
  opportune time.
• IST working with the business offices and senior
  management would like to look at opportunities /
  possibilities for reducing the SAP recovery
  timeline.

9
SAP recovery requirements

• What services / systems are in scope? Can we
  list what services / systems are out of scope?
  
• Integration between various systems create
  concerns for defining interdependencies and
  functional impact if some systems are re-created
  at a later time or not at all (consider ECAT,
  IXOS or automated faxing).
• Integration between systems also raises issues
  for a consistent Point In Time restore lest
  systems be out of sync in a way that impacts the
  functionality or the staff (consider COEUS vs.
  SAP or MITid vs. SAP).

10
Disaster Recovery exercise proposed for Spring of
2006

• Include SAP Payroll implementation
• Include EHS implementation
• Expand functional scope of exercise to include
  SAPwebSS (ITS) services, SAP-Dropbox, Check
  Printing, Departmental Printing and possibly
  other services not included in October 2004
  exercise.
• Include process changes which simplify / expedite
  validation of recovered SAP environment.
  

11
Next Steps

• Over the next couple of months Bil Huxley will be
  in touch with the various business offices and IT
  groups to pursue
  
• Review for update with each business office their
  specific contacts, activities and operational
  highlights in the SAP FARM Team Plan.
  
• Assess priorities for all SAP integration points
  with other systems / services. While the Core
  R/3 are Category 1 for disaster recovery, some
  integrated services may be Category 2 or higher.
• IST, including Admin Computing, R3-Admin, Server
  Operations, and Computing-Help, will investigate
  process and technologies which might allow a
  shorter time line for recovery and which may
  facilitate off campus data backups.