DRPWorld Class Operations - Impact Workshop

Info-Tech Research Group, Inc. Is a global leader in providing IT research and advice.Info-Tech’s products and services combine actionable insight and relevant advice with

ready-to-use tools and templates that cover the full spectrum of IT concerns.© 1997-2012 Info-Tech Research Group Inc.

Beyond Practical Research – Workshops Get You To Results

Workshops: Leverage Best-Practices Research and Get to Action

• Unlike other Research firms, we believe it’s important to help our members implement improvements.

• An onsite 40-hour workshop, which allows you to make systematic improvements to your core processes.

• Workshops are designed to help focus attention, create alignment, and ensure best practices are put to work at your organization.

• Our workshops help you get to immediate impact and results and are tailored to your situation and needs.

Workshops: Focused on You Implementing Improvements

• The goal of each Capability Optimization Workshop is to create tangible benefits

and clear improvements as a direct result of the workshop.

• Specific deliverables, goals, metrics, and outcomes are established for

each workshop.

• Successful workshops will leverage our years of analyst experience and

written research to provide an engaging experience which focuses

on implementing, and getting to measurable results.

• Each workshop begins by diagnosing the current state, and then

focuses on designing high impact improvements based on

best-practices research.

• Three and six month follow-up will occur to ensure benefit realization.

ITRG Workshops provide the best-practices and implementation support necessary to help an IT leader build a World Class IT Operation.

Capability Optimization

Workshop

Diagnose Current

State

Right-Sizing

Process

Process Design

Measuring Benefits

Implementation Support

Common DRP challenges include:

Misalignment with business needs, leading to higher costs or under-provisioning.Focusing on major disasters, and lacking an appropriate response to less-obvious disasters.Lack of testing, and therefore lack of confidence in the plan.No analysis of what’s required to improve recovery times.

Outcome of this workshop:

DR requirements grounded in a business impact analysis. Incident response procedures for minor to major events. Gap analysis derived from step-by-step DR walkthrough. DR technology and process improvement roadmap.

DRP

Close the gap between your DR capabilities and service continuity requirements.

This workshop is broken into 5 days to develop a plan to meet DR and service continuity objectives

Name Goal List of deliverables

Module 1 Assess the current state

Identify mission critical applications and current DR challenges.

• Prioritized list of critical applications.• Critical applications and dependencies

identified.• Current DR strategies and challenges.

Module 2 Determine recovery time requirements

Determine the cost of downtime & corresponding RTOs/RPOs.

• Strategy for conducting a BIA.• Estimated costs of downtime.• Recovery objectives (RPOs/RTOs).

Module 3 Close the technology gap

Prioritize technology investments required to meet RPOs/RTOs.

• Risk/impact analysis.• DR capability gap analysis.• DR technology roadmap.

Module 4 Close the process gap Modify processes to minimize risk and reduce downtime.

• Incident response plan.• Escalation timeline from event to DR.• Process gap analysis.

Module 5 Validate technology and process changes

Use tabletop testing to validate planned technology and process changes.

• DR technology and process validation.• BCP considerations.• Action items and scheduled follow-up.

1.0 Assess the current state

1.1 Identify mission critical business activities and applications

Define criteria for “Mission Critical”

Identify mission critical business activities

Identify the applications that support those business activities

1.2 Identify dependencies

Identify the infrastructure and secondary applications that support critical applications

Repeat for a tier two (“Silver”) application

1.3 Identify current DR capabilities and challenges

Understand high availability vs. fast failover vs. restore from backups

Identify current recovery strategies for specific systems

Identify DR challenges for specific systems

2.0 Determine recovery time requirements

2.1 Understand BIA goals and benefits

BIA impact on appropriate recovery objectives and DR spending

What goes into a BIA

Develop a strategy for how to include the executive team in the BIA process

2.2 Estimate the business impact of downtime

Determine availability requirements

Estimate costs of downtime (e.g. lost sales, reduced customer confidence, etc.)

Compare the BIA for Gold vs. Silver systems, andre-assess criticality

Identify legal/compliance or health/safety impact

2.3 Define RPOs and RTOs based on business impact

Understand best practices (e.g. RPO/RTO tiers as a general guideline)

Prioritize dependencies that impact data and define RPOs accordingly

Compare Gold vs. Silver RPOs and RTOs; are they appropriate?

Prioritize dependencies based on importance, and define RTOs accordingly

3.0 Close the technology gap

3.1 Identify risks of failure in your infrastructure

Assess risks-of-failure (e.g. identify single points of failure)

Estimate impact of failure (e.g. risk of data loss, or affecting other systems)

Create a risk/impact chart to identify priority risks

3.2 Use tabletop planning to identify current DR gaps

Review tabletop planning – what is it, and how is it done

Walk through a DR scenario

Perform a gap analysis between current and desired RPOs/RTOs

3.3 Create a DR technology roadmap

Define criteria for prioritizing technology investments

Prioritize investments to meet DR gaps and address risk areas

Create an implementation timeline (e.g. a three year plan)

4.2 Align service management guidelines with DR requirements

4.0 Close the process gap

Create an Emergency Response Team (ERT)

Create a step-by-step plan from assessment to recovery

Define criteria and a procedure for restoring normal operations

4.1 Create an incident response plan that closes your DR gaps

Bridge the gap between service management and DR

Update severity definitions and escalation rules to meet DR timeline requirements

4.3 Identify other process gaps that impact service continuity

Minimize risks of downtime by formalizing IT processes

Create a plan to address process gaps

Use diagrams and checklists to make SOPs more usable and easier to maintain

Create a formal DRP using Info-Tech’s DRP template (takeaway exercise)

5.0 Validate technology and process changes

5.1 Use tabletop testing to validate DR changes

Walk through the updated incident response plan for a different DR scenario

Assess the impact of planned process and technology changes

5.2 Lay the foundation for business continuity planning

Revise the incident response plan as well as planned technology and process changes as needed

5.3 Workshop wrap-up

Workshop re-cap and feedback

Assign prioritized action items for process and technology changes

Understand the differences between DRP and BCP

Review existing business continuity capabilities

Identify business continuity risks beyond IT (e.g. suppliers, people, documentation, etc.)

Schedule follow-up calls with Info-Tech to review progress and answer questions

Related tools and documents

This workshop includes the following tools and templates, in addition to this presentation, to enable you to plan technology and process changes to meet your DR requirements:

Business Impact Analysis (BIA) Tool

DR Planning and Monitoring Tool

DR Technology Investments Prioritization Tool

Severity Definitions and Escalation Rules Template

DRP Workbook

• Determine application/system criticality, the business impact of downtime, and corresponding recovery point and recovery time objectives.

• Document your incident response plan and to monitor the status of each task if the plan is invoked.

• Score technology requirements to help you prioritize what should be done first and create a timeline for implementing changes.

• Review example of severity definitions that include disaster scenarios and escalation times based on system criticality and DR requirements.

• Consolidate all workshop activities into one workbook.

DRP Workshop Key Outputs

Five Key Outputs to be produced during the Workshop:

1

2

3

4Business Impact Analysis (BIA) Tool

• Use this tool to determine application/system criticality, the business impact of downtime, and corresponding recovery point and recovery time objectives.

DR Planning and Monitoring Tool• Use this tool to document your incident response plan

and to monitor the status of each task if the plan is invoked.

DR Technology Investments Prioritization Tool• Use this tool to score technology requirements to help

you prioritize what should be done first and create a timeline for implementing changes.

Severity Definitions and Escalation Rules Template• Use this template as an example of severity

definitions that include disaster scenarios and escalation times based on system criticality and DR requirements.

DRP Workbook• A collection of the input forms used in this workshop

for whiteboard exercises.5

DRP Workshop:Built on World Class Research, Experience, and Standards

Research Process

• Team with over 30 years experience.• Over 2,800 hours of research.• Based on primary and in-field research.

Tools & Templates

• 150 page Research Report• 15 in-depth activities and exercises

• Business Impact Analysis (BIA) Tool• DR Planning and Monitoring Tool• DR Technology Investments Prioritization

Tool• Severity Definitions and Escalation Rules

Template• DRP Workbook• More...

COBIT 5

• Grounded in open international standards.