Building a Business Case for Disaster Recovery Planning - State and Local Government

1
Building a Business Case for Disaster Recovery
Planning - State and Local Government
Chris Turnley cturnley_at_ironmountain.com
2
Agenda

• About Iron Mountain Off-Site Data Protection
• Where to Start Building the Case
• Challenges, Components and Resources
• Case Study Iron Mountain
• Summary

3
h

• Servicing gt 28,000 customers
• Approaching 60 vaults in the United States
• 50 million pieces of backup media
• 150 actual disaster recovery events
• 10,000 successful disaster recovery tests
• 7500 successful media library relocations

4
Challenges of Data Protection

• Government Agencies have limited IT
  staffs/budgets
• Servers are getting backed up less frequently
• Recovery sites are unavailable
• DR initiatives often untested/not funded

Source Enterprise Storage Group
5
Whats a Disaster?

• Worst power outage in history
• Terrorist attack
• Employee sabotage
• Hurricanes
• Earthquakes
• Virus Attacks

Client Definition Data loss and Business
disruption
6
Service Impacts of an Outage

• People
• Employees
• Increased Support
• Other expenses

7
Recovery in the Balance

RTO
RPO
Balancing Cost and Recoverability

• Disaster Recoverability has a cost
• Additional Hardware
• Additional Personnel
• Fees for Services

• Recovery Time Objective (RTO) How long can you
  be without the data?

• Recovery Point Objective (RPO) How much data
  loss can you afford?

8
Lessons Learned

• Restricted Air Space
• Clients With a Tested Plan Responded Quicker,
  More Effectively
• Authorized Personnel in a Single Location
• Access to Media for Full Backup
• Knowledge of Other Vendors, Prepared and
  Available
• Location, location, location

9
Business Continuity Components
Mission Critical Data
Property Equipment
People
Business Continuity
Systems
Data
Business IT Processes
10
The Process

• Recognize business continuity components
• Define what you are protecting
• Prioritize business/service functions
• Classify outage types, frequencies duration
• Determine impact of an outage
• Calculate the cost of downtime

11
Impact Analysis

• Core Competencies
• Its what you do
• Its unique in the marketplace
• People depend on you for this
• It could be a product, service, process, or
  methodology

12
The Process

• Recognize business continuity components
• Define what you are protecting
• Prioritize business functions
• Classify outage types, frequencies duration
• Determine impact of an outage
• Calculate the cost of downtime

13
DR Project Charter

• Project Organization
• Sponsor EVP Operations
• Leader Director Operations
• Project Team
• General Managers Operations
• Branch Managers Operations
• Manager IT Systems Development
• Manager IT Network Services

14
Business Continuity Components
15
The Process
?

• Recognize business continuity components
• Define what you are protecting
• Prioritize business functions
• Classify outage types, frequencies duration
• Determine impact of an outage
• Calculate the cost of downtime

16
Critical Systems
17
The Process
?

• Recognize business continuity components
• Define what you are protecting
• Prioritize business functions
• Classify outage types, frequencies duration
• Determine impact of an outage
• Calculate the cost of downtime

?
18
Prioritize Business Functions
high

Cost of Interruption

critical
vital
sensitive
Non-critical
Low
Low
high
Business Tolerance to Interruption
19
The Process
?

• Recognize business continuity components
• Define what you are protecting
• Prioritize business functions
• Classify outage types, frequencies duration
• Determine impact of an outage
• Calculate the cost of downtime

?
?
20
Historical Outage Frequency
2002
2001
21
Historical Outage Duration
70
60
50
40
of Branches Down
30
20
10
0
lt1
1-2
3-4
5-9
10-14
15-23
24-30
31-39
gt40
Time Down (hours)
22
Classifying Outages Infrastructure

• Types of Outages
• Branch
• Regional
• National
• Data Center

23
The Process
?

• Recognize business continuity components
• Define what you are protecting
• Prioritize business functions
• Classify outage types, frequencies duration
• Determine impact of an outage
• Calculate the cost of downtime

?
?
?
24
Impact of an Outage

• What does it the cost for one day of outage?
• 727,729 transactions
• Recording transactions once manually
• Inputting these transactions after the outage
• Cost of recovery team
• Troubleshoot, resolve problem, and manage the
  recovery process
• Branch outage Hundreds per hour
• Data Center outage Tens of thousands per hour

25
The Process
?

• Recognize business continuity components
• Define what you are protecting
• Prioritize business functions
• Classify outage types, frequencies duration
• Determine impact of an outage
• Calculate the cost of downtime

?
?
?
?
26
The Process
?

• Recognize business continuity components
• Define what you are protecting
• Prioritize business functions
• Classify outage types, frequencies duration
• Determine financial impact of an outage
• Calculate the cost of downtime

?
?
?
?
?
27
Building the Business Case

• Recognize business continuity components
• Define what you are protecting
• Prioritize business functions
• Classify outage types, frequencies duration
• Determine financial impact of an outage
• Calculate the cost of downtime

28
Building a Business Case for Disaster Recovery
Planning