Disaster Recovery Planning

Transcription

1

2 Disaster Recovery Planning Presented by Matt Stolk Associate Director Northwest Regional Data Center Florida State University FAEDS 2015

3 Why are we here? Over the last couple of years, business continuity has become more of a priority for many organizations. Understanding the needs and requirements for building a successful DR plan are just some of the struggles on the road to implementation. Major challenges in developing this plan center on the identification and classification of applications and data, developing business requirements, determining the infrastructure and software needs, as well as weighing cost against these requirements. This session will go over NWRDC s experiences in building their DR plan and touch on lessons learned from doing this as well as working with our customers in building their plans.

4 Why are we really here?

5 So what do we need to plan for?

6 What does a DR Plan Consist of? According to National Institute for Standards and Technology (NIST) Special Publication , Contingency Planning for Information Technology Systems, the following summarizes the ideal structure for an IT disaster recovery plan: Develop the contingency planning policy statement. A formal policy provides the authority and guidance necessary to develop an effective contingency plan. Conduct the business impact analysis (BIA). The business impact analysis helps to identify and prioritize critical IT systems and components Identify preventive controls. These are measures that reduce the effects of system disruptions and can increase system availability and reduce contingency life cycle costs. Develop recovery strategies. Thorough recovery strategies ensure that the system can be recovered quickly and effectively following a disruption. Develop an IT contingency plan. The contingency plan should contain detailed guidance and procedures for restoring a damaged system. Plan testing, training and exercising. Testing the plan identifies planning gaps, whereas training prepares recovery personnel for plan activation; both activities improve plan effectiveness and overall agency preparedness. DR Plan maintenance. The plan should be a living document that is updated regularly to remain current with system enhancements.

7 DR Policy Statement Develop the contingency planning policy statement. A formal policy provides the authority and guidance necessary to develop an effective contingency plan. Example XXXX shall maintain a Disaster Recovery Plan that establishes procedures for business resumption in the event of an emergency. This plan shall be reviewed yearly and updated as necessary. A copy will be located HERE. XXX will conduct annual disaster recovery tests, at a minimum, to ensure services recoverability.

8 Business Impact Analysis Conduct the Business Impact Analysis (BIA). The business impact analysis helps to identify and prioritize critical IT systems and components. Information needed from Business Units and Application Owners. Completed by both IT and the Business Units Identifies requirements for Recover Time Objective (RTO) as well as perceived impacts to the organization as a whole Identifies System and Application POCs

9 Identify Preventative Controls Identify preventive controls. These are measures that reduce the effects of system disruptions and can increase system availability and reduce contingency life cycle costs. OK, so what does this mean? Examples: Server Clustering GEO Replication Offsite backups Backup Replication Hot/Warm/Cold DR Site Cloud

10 Develop Recovery Strategies Develop recovery strategies. Thorough recovery strategies ensure that the system can be recovered quickly and effectively following a disruption. How will things be recovered How will we meet the RTO defined in the BIA Will feed into the DR Runbook

11 Develop IT Contingency Plan Develop an IT contingency plan. The contingency plan should contain detailed guidance and procedures for restoring a damaged system. This is the DR Runbook Should have detailed instructions on how to recover Should be written in a way that anyone with access could run through the recovery

12 Test the Plan Plan testing, training and exercising. Testing the plan identifies planning gaps, whereas training prepares recovery personnel for plan activation; both activities improve plan effectiveness and overall agency preparedness. If everything goes as planned you are not testing hard enough Depending on the situation the runbook may be modified or not completely followed Be sure to discuss outcome of the test Improve the plan, post testing is the best time to make changes

13 Review and Update the Plan Plan maintenance. The plan should be a living document that is updated regularly to remain current with system enhancements. Be sure to keep track of revisions Summary of changes is sometime helpful Ensure that staff and vendor contacts information is current Verify inventories, machine names, backup inventories

14 Resources to Assist FEMA Business Continuity Planning Suite Includes: Disaster Recovery Plan Generator for IT Recovery Business Impact Analysis (BIA) Forms Test Tools (Scenarios) Training Plan Maintenance Walk through

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45 After completing the wizard in the tool, you can browse to the MS Word version of the file you created. It is stored in the directory listed below: InstallDirectory \Business_Continuity_Planning_Suite\Business_Continuity_Planning_Suite\media \Disaster_Recovery_Plan_Extract\temp.doc

46 What s Next? Actionable Items: Next Week Application and Server Inventories Identify key staff resources for planning Next 1 to 6 Months Meet with Business Process Owners (BPO) Get buy in! Determine the requirements and options Budget Next Year Implement Test! Test! Test! Update, Improve, Maintain

47 Resources FEMA Business Continuity Planning Suite NIST rev1_errata-nov pdf Gartner Northwest Regional Data Center Matt Stolk (850)