Presented by Information Technology Advisory Group (ITAG) @ItagInfo.com Disaster Recovery/ Business Continuation Workshop

Presented byPresented by

Information Technology Advisory Information Technology Advisory Group (ITAG)Group (ITAG)

[email protected]@ItagInfo.com

Disaster Recovery/ Disaster Recovery/ Business Continuation Business Continuation

WorkshopWorkshop

About ITAGAbout ITAG

• Technical services firm designed to help our clients improve their competitiveness and profitability through the use of technology in business.

• Not a reseller of any software or hardware products.

Session Format Session Format

• DefinitionDefinition

• Stages of a Disaster Stages of a Disaster

• ConsiderationsConsiderations

• Plan MethodologyPlan Methodology

• Plan ComponentsPlan Components

DefinitionDefinition

Business Continuation Business Continuation Plan Plan

• Ability to ensure the restoration of Ability to ensure the restoration of your business activities to normal your business activities to normal operations as quickly as possible operations as quickly as possible after a disruption or disaster.after a disruption or disaster.

• Specific to your organizationSpecific to your organization

• In accordance with Corporate CultureIn accordance with Corporate Culture

Types of Disaster Types of Disaster

• Blizzards / Winter Blizzards / Winter StormsStorms

• Computer Failure / Computer Failure / Computer Viruses / Computer Viruses / Telephone SystemTelephone System

• EarthquakesEarthquakes

• Environmental Environmental HazardsHazards

• FloodingFlooding

• TerrorismTerrorism

• Power OutagePower Outage

• Transportation Transportation DisruptionsDisruptions

• FireFire

• Hurricane / TornadoHurricane / Tornado

Stages of a DisasterStages of a Disaster

Stages of a Disaster Stages of a Disaster

• RecognizeRecognize

• RespondRespond

• RecoverRecover

• RestoreRestore


• RecognizeRecognize– protect human lifeprotect human life

– determine/assess nature of disaster or determine/assess nature of disaster or eventevent

– notify management/authoritiesnotify management/authorities

– inform employeesinform employees


• RespondRespond– activate emergency response teamactivate emergency response team

– employee relocation proceduresemployee relocation procedures

– customers/partners/suppliers notifiedcustomers/partners/suppliers notified

– coordinate with fire, police, etc.coordinate with fire, police, etc.

– media notifiedmedia notified

– decision to activate business continuation decision to activate business continuation planplan


• RecoverRecover– achieve your MARC (Minimum achieve your MARC (Minimum

Acceptable Recovery Configuration)Acceptable Recovery Configuration)

– short/long term interim processingshort/long term interim processing

– employee/operational logisticsemployee/operational logistics

– review events, begin documentationreview events, begin documentation


• RestoreRestore– priorities set and maintainedpriorities set and maintained

– maintain flexibilitymaintain flexibility

– restore power, security, environmentals, etc.restore power, security, environmentals, etc.

– restore/replace hardware/softwarerestore/replace hardware/software

– cleanup and reconstructcleanup and reconstruct

– business operations return to normalbusiness operations return to normal

ConsiderationsConsiderations

Considerations Considerations • WhyWhy

• WhenWhen

• PeoplePeople

• External External RelationshipsRelationships

• InsuranceInsurance

• Data, Information & Data, Information & KnowledgeKnowledge

• TechnologiesTechnologies

• Legal ImplicationsLegal Implications

• CostsCosts

• SecuritySecurity

• Common DisastersCommon Disasters

Considerations Considerations

• WhyWhy– What do you stand to loseWhat do you stand to lose

• RevenueRevenue

• Customers / MembersCustomers / Members

• Market Share Market Share

• Competitive EdgeCompetitive Edge

– Industry statistics indicate that 43% of Industry statistics indicate that 43% of companies never reopen after a disaster has companies never reopen after a disaster has struck.struck.


• WhyWhy– What do you stand to gainWhat do you stand to gain

• Continuity of BusinessContinuity of Business

• Ability to improve business processesAbility to improve business processes

• Customer Satisfaction / ConfidenceCustomer Satisfaction / Confidence


• When should you begin developing When should you begin developing a plana plan– Now Now

• Don’t wait for a disaster to hit Don’t wait for a disaster to hit


• PeoplePeople– Call TreeCall Tree

• StaffStaff– Identify special skills of staffIdentify special skills of staff

• Members/Customers/Partners/SuppliersMembers/Customers/Partners/Suppliers

• Emergency ServicesEmergency Services– FireFire– PolicePolice

– Establish policy for employees to report inEstablish policy for employees to report in


• People (Employee Support)People (Employee Support)– Cash AdvancesCash Advances

– Salary ContinuationSalary Continuation

– Flexible / Reduced HoursFlexible / Reduced Hours

– Crisis CounselingCrisis Counseling

– Day CareDay Care


• External RelationshipsExternal Relationships– BankBank

– Offsite Storage / FacilityOffsite Storage / Facility

– Technology Solution ProvidersTechnology Solution Providers

– Telecommunication SupplierTelecommunication Supplier

– Key SuppliersKey Suppliers

– PrinterPrinter


• InsuranceInsurance

– Property ValueProperty Value

– CoverageCoverage• Loss of incomeLoss of income

• Power outagePower outage

– DeductibleDeductible

– Requirements for reporting a lossRequirements for reporting a loss

– Vital RecordsVital Records


• Data, Information & KnowledgeData, Information & Knowledge– DataData

• Raw facts and figures Raw facts and figures – key data profilekey data profile

– InformationInformation• Process of combing data to become Process of combing data to become

meaningfulmeaningful– standard operating proceduresstandard operating procedures

– KnowledgeKnowledge• Process of using information to make Process of using information to make

decisionsdecisions– Knowledge MapKnowledge Map

DB

Data

Information

Knowledge

Collect

Categorize

Summarize

Analyze

Formulate

Informed BusinessDecision


• TechnologiesTechnologies– InfrastructureInfrastructure

– Communications (voice/data)Communications (voice/data)

– InternetInternet


• Infrastructure TechnologiesInfrastructure Technologies

– RedundancyRedundancy• Plug-n-Play Hardware/Traffic RoutingPlug-n-Play Hardware/Traffic Routing

– Wireless NetworkingWireless Networking

– Data BackupData Backup

– Backup PowerBackup Power

– Management ToolsManagement Tools• inventory, security, configurationinventory, security, configuration


• Communication TechnologiesCommunication Technologies– VoiceVoice

• PBXPBX

• Cell PhonesCell Phones

– DataData• VPNVPN

• WAN ReplicationWAN Replication

• FaxFax

• PDAPDA

Considerations Considerations • Internet TechnologiesInternet Technologies

– EmailEmail

– Instant Messaging (IM)Instant Messaging (IM)

– Internet PhoneInternet Phone

– ASPASP

– Server HostingServer Hosting

– Online Data StorageOnline Data Storage

– E-commerceE-commerce

– Online DirectionsOnline Directions


• LegalLegal– Contractual obligations such asContractual obligations such as

• Publishing (advertising, circulation, etc.)Publishing (advertising, circulation, etc.)

• IRS or other Government Mandates IRS or other Government Mandates (PAC reporting, etc.)(PAC reporting, etc.)

• Customer ContractsCustomer Contracts


• CostsCosts– Plan DevelopmentPlan Development

• External consultantExternal consultant

• Internal resourcesInternal resources

• Software (if desired)Software (if desired)

– Offsite StorageOffsite Storage• TapeTape

• Critical Documents and FormsCritical Documents and Forms


• CostsCosts– Ongoing Plan MaintenanceOngoing Plan Maintenance

• TestingTesting

• Software Maintenance (if desired)Software Maintenance (if desired)

– Contingency Alternative FeesContingency Alternative Fees• TechnologyTechnology

• FacilityFacility

• Telecommunications (voice/data)Telecommunications (voice/data)


• SecuritySecurity– Secure critical file cabinetsSecure critical file cabinets

– Locking desksLocking desks

– Closing windows / doorsClosing windows / doors

• Most common disastersMost common disasters– Vulnerability/probability analysisVulnerability/probability analysis

Plan MethodologyPlan Methodology

Plan Methodology Plan Methodology

• Project InitiationProject Initiation

• Conduct Impact AnalysisConduct Impact Analysis

• Identify Continuity AlternativesIdentify Continuity Alternatives

• Review Internal Policies & ProceduresReview Internal Policies & Procedures

• Develop PlanDevelop Plan


• TestingTesting

• Incorporate Plan into Day-to-Day Incorporate Plan into Day-to-Day OperationsOperations

• TrainingTraining

• Plan MaintenancePlan Maintenance


• Project InitiationProject Initiation– Develop Project TeamDevelop Project Team

• Requires Project Team LeaderRequires Project Team Leader

• Cross-departmental participationCross-departmental participation– Allocate necessary resourcesAllocate necessary resources

– Obtain senior level buyoffObtain senior level buyoff

– Establish plan timetable and budgetEstablish plan timetable and budget

– Communicate mission Communicate mission


• Determine Vulnerability AnalysisDetermine Vulnerability Analysis

• Conduct Impact AnalysisConduct Impact Analysis– According to the Index for Disaster According to the Index for Disaster

Readiness 75% of companies surveyed do Readiness 75% of companies surveyed do not understand the financial impact not understand the financial impact associated with every key function in their associated with every key function in their organization.organization.

– Establish rating scaleEstablish rating scale

Sample of Sample of InterdependenciesInterdependencies

Membership

Meetings/ Education

FMS

PAC

AMSCommittee

Management

Products

Exhibits

HR

Business Processes Data Repositories

Personnel Tracking

FinancialReporting

UserData

Source


• Business Process / Function Checklist Business Process / Function Checklist geared towards Associationsgeared towards Associations– Dues ProcessingDues Processing

– Meeting/Education RegistrationMeeting/Education Registration

– Exhibition ManagementExhibition Management

– Product Fulfillment / Inventory TrackingProduct Fulfillment / Inventory Tracking

– Lobbying / GrassrootsLobbying / Grassroots


• Business Process / Function Business Process / Function Checklist geared towards Checklist geared towards AssociationsAssociations– PACPAC

– Regulatory Tracking Regulatory Tracking

– Committee ManagementCommittee Management

– Chapter RelationsChapter Relations


• Standard Business Process / Function Standard Business Process / Function ChecklistChecklist– PayrollPayroll

– Cash ReceiptsCash Receipts

– Accounts PayableAccounts Payable

– Financial ManagementFinancial Management

– Human ResourceHuman Resource


• Standard Business Process / Standard Business Process / Function ChecklistFunction Checklist– Communications / Public RelationsCommunications / Public Relations

– Marketing / SalesMarketing / Sales

– PurchasingPurchasing

– ITIT


• Continuity AlternativesContinuity Alternatives– Do nothing or suspend business processDo nothing or suspend business process

– Perform business processes manuallyPerform business processes manually

– Reciprocal agreementsReciprocal agreements

– Purchase warm/hot sitePurchase warm/hot site

– Use service bureauUse service bureau

– Utilize Internet technologies, where Utilize Internet technologies, where applicableapplicable


• Identify Continuity Alternatives for Identify Continuity Alternatives for each business processeach business process

• Establish Minimum Acceptable Establish Minimum Acceptable Recovery Configuration (MARC)Recovery Configuration (MARC)


• Review Internal Policies & ProceduresReview Internal Policies & Procedures– EvacuationEvacuation

• Floor monitorsFloor monitors

• Transportation for community-wide Transportation for community-wide evacuationevacuation

• Procedures to assist people with disabilitiesProcedures to assist people with disabilities

– FireFire


• Review Internal Policies & Review Internal Policies & ProceduresProcedures– SecuritySecurity

– InsuranceInsurance

– Employee ManualEmployee Manual


• Develop PlanDevelop Plan

– Reporting StructureReporting Structure

– Establish Emergency Response TeamsEstablish Emergency Response Teams

– Communication StrategyCommunication Strategy• InternalInternal

• ExternalExternal

– Business Process Restoration GuidelinesBusiness Process Restoration Guidelines

– Readiness TimelineReadiness Timeline


• Incorporate Plan into Day-to-Day Incorporate Plan into Day-to-Day OperationsOperations– AccountingAccounting

– PersonnelPersonnel

– TechnologyTechnology

– Internal CommunicationsInternal Communications

– Operating ProceduresOperating Procedures


• TrainingTraining– Employee OrientationEmployee Orientation

– Periodic Educational WorkshopsPeriodic Educational Workshops


• TestingTesting– Planned and UnplannedPlanned and Unplanned

• Table Top ExercisesTable Top Exercises

• Walk Through DrillWalk Through Drill

• Functional DrillFunctional Drill– Business Process specificBusiness Process specific

• Evacuation DrillEvacuation Drill

• Full Scale ExerciseFull Scale Exercise


• Plan MaintenancePlan Maintenance

– OngoingOngoing• Involve all levels of managementInvolve all levels of management

– Schedule Schedule • Periodic plan review and updatesPeriodic plan review and updates

– Review ConsiderationsReview Considerations• Does Plan reflect lessons learned from testingDoes Plan reflect lessons learned from testing

• Does Plan reflect changes in Business ProcessDoes Plan reflect changes in Business Process

• Does Plan include updated Call TreeDoes Plan include updated Call Tree


• Plan MaintenancePlan Maintenance– Utilize unscheduled events to initiate Utilize unscheduled events to initiate

plan review and updatesplan review and updates• Technology UpgradesTechnology Upgrades

• Business Process ModificationsBusiness Process Modifications

• Personnel ChangesPersonnel Changes

• Facility ChangesFacility Changes

Plan ComponentsPlan Components


• Reporting StructureReporting Structure

• Emergency Response TeamsEmergency Response Teams

• Personnel Listing Personnel Listing

• Call TreeCall Tree

• Building / Floor BlueprintsBuilding / Floor Blueprints


• Polices & ProceduresPolices & Procedures

• Business Process Restoration Business Process Restoration GuidelinesGuidelines

• Existing TechnologiesExisting Technologies


• Reporting StructureReporting Structure

• Emergency Response TeamsEmergency Response Teams– Administrative TeamAdministrative Team

• Acts as command post for all disaster Acts as command post for all disaster activities. Makes major decisions. activities. Makes major decisions. Facilitates all information and provides Facilitates all information and provides direction. direction.


• Emergency Response TeamsEmergency Response Teams– Disaster Assessment/Restoration TeamDisaster Assessment/Restoration Team

• Evaluates extent of damage, determines Evaluates extent of damage, determines length of time facility will be unavailable, length of time facility will be unavailable, determines continuity alternative most determines continuity alternative most viable to situation.viable to situation.

– Communications TeamCommunications Team• Responsible for contacting all staff, press, Responsible for contacting all staff, press,

members, customers, etc.members, customers, etc.


• Emergency Response TeamsEmergency Response Teams– Operations/Support Services TeamOperations/Support Services Team

• Establishes facilities, desks, office supplies. Establishes facilities, desks, office supplies. Also can be used to secure lodging and Also can be used to secure lodging and transportation for staff as necessarytransportation for staff as necessary

– IT TeamIT Team• Manages technology (data and voice) Manages technology (data and voice)

reconstruction, computer usage and reconstruction, computer usage and coordinates alternative computing services.coordinates alternative computing services.


• Personnel Listing Personnel Listing – home address, phone, alternative home address, phone, alternative

contactcontact

• Call Tree Call Tree

• Building / Floor BlueprintsBuilding / Floor Blueprints

• Policies & ProceduresPolicies & Procedures


• Business Processes Restoration Business Processes Restoration GuidelinesGuidelines– Impact Analysis QuestionnaireImpact Analysis Questionnaire

– Business Process Contingency AlternativesBusiness Process Contingency Alternatives

• Existing TechnologiesExisting Technologies– Hardware Platform / Operating SystemHardware Platform / Operating System

– Software (with version releases/patches)Software (with version releases/patches)

Wrap UpWrap Up

• Questions & AnswersQuestions & Answers

• Thank YouThank You

Presented byPresented by

Information Technology Advisory Information Technology Advisory Group (ITAG)Group (ITAG)

[email protected]@ItagInfo.com

Disaster Recovery/ Disaster Recovery/ Business Continuation Business Continuation

WorkshopWorkshopTHE END