Disaster Recovery Planning (DRP)

1. Disaster Recovery Planning (DRP) • DRP: The definition of business processes, their infrastructure supports and tolerances to interruptions, and formulation of strategies for reducing the likelihood of interruption or its consequences. • Component steps of DRP: • Define the process • Identify what supports the process and its tolerance to interruptions • Determine and implement strategies that would reduce the likelihood and cosequences of interruptions.

2. Disaster Recovery Planning (DRP) • Assessing potential losses: Disaster Impact Analysis • What disasters the firm is likely to face? • What is the probability of each type of disaster? • What is the impact of the disaster on the firm?

3. Disaster Recovery Planning (DRP) • Value-based recovery planning • Definition of criticality and criteria to determine criticality • Identification of critical business processes and their supports • Identification of the role of information systems resources in the critical process • Determination of process owners and process customers • Determination of the amount of time the business can survive without the process post-disaster • Identify interdependencies between the process and the rest of the business processes and systems • To find critical processes, consider attributes such as importance, key users, tolerance to outage, waiting time between cycles, possibility of data recovery.

4. Disaster Recovery Planning (DRP) • Disaster recovery strategies • How do we recover a system given its priority? • Address the question by system components. • Data (e.g., designate off-site storage) • Processing (e.g., backup and store offsite current copies of the software) • Network and communication (e.g., backup and store offsite a copy the current network configuration) • Dependencies with other systems (e.g., identify how these processes will be interfaced post-disaster)

6. DRP: Recovery Locations • Recovery location: A site(s) where processes and systems will be recovered post-disaster. • Hot sites: Near-perfect replicas of the operations. • Cold sites: Just the infrastructure (computer operations room, platform for installing hardware, power and communication lines, cabling, etc.). • Warm sites: More than just a cold site, but not quite as ready as a hot site. For example, it may include commonly used computers and operating system. • Reciprocal agreements: Sharing of similar resources by those in the same or similar computing enviornments. • Colocations: Recovery is planned using availability of computing resources at the firm’s many locations.

7. DRP: Teams • Purpose of forming teams is to ensure that recovery tasks are accomplished in an orderly and responsible manner. • The number and nature of teams could vary across organizations. • However, each team should include knowledge and skills necessary to perform its assigned tasks. • Recovery teams can be organized by recovery phases. • Flexibility in assignments is necessary, for an actual disaster may need adjustments to the team. Non-availability of some team members when disaster strikes is also likely.

8. DRP: Disaster Readiness • Meaning of readiness: Having the assurance that if and when a disaster strikes, the firm has a high likelihood of recovering from the disaster. Testing of the plan is crucial to get this assurance. Disaster readiness practices include: • Walkthroughs: Having a plan preparer walk though others to show how the plan leads from point A to point B. • Rehearsals: An “as-if” exercise to simulate a disaster’s impact and have people responsible recreate recovery of “lost” processes and systems. • Compliance (Live) testing: Actual test of recovery with a simulated disaster.

9. Business Continuity Planning (BCP) • BCP: The totality of plans made to recover the business operations following a disaster. • Recovery of all operations is involved, not just information assets. • Methods and strategies adopted for BCP are comparable to, and often overlap with, those used in DRP.

10. Business Continuity Planning (BCP) • Business impact analysis is an exercise in risk assessment. • Identify vulnerabilities of the firm. • Assess the business impact • Focus on a particular disaster and determine processes that might be affected, and/or • Analyze all business processes to assess probable business impact in the event that a disaster strikes. • Initiate a planning process to develop methods and strategies to mitigate risk. • Business recovery • Approaches and methods for business recovery are similar to those discussed in disaster recovery planning.

11. Assurance Considerations • Any assurance that BCP/DRP will be effective requires an examination of such plans from three angles: • Method: Review the method followed in the development of the plan. A sound planning process make possible a plan that is complete and reliable. • Content: Should have been collected from “right” participants, and the instruments and methods used to collect data must be valid. The plan should be current. • Testing: Critical components of the plan should be tested, results should be documented, and corrective action, where necessary, should follow.