Ne-htcia.org

! Rating: This presentation has been rated ! Stir in ¼ of required DR Budget! Produce one (1) DR Plan for Audit ! Add a dash of Management ambivalence! Place DR Plan on shelf for 1 to 2 years ! Your most important asset is a trained staff.
! Information is required, but without people, ! For information purposes only, the following are the steps which would be followed for a formal BCPeffort: - Developing Business Continuity Strategies - Developing and Implementing Business Continuity Plans - Maintaining and Exercising Business Continuity Plans - Public Relations and Crisis Coordination • Pro-active planning to ensure the continued successful • Activities planned and prepared to respond to a significant interruption of business operations.
! A Disaster is any event which adversely effects your capability to support theBusiness needs of your customers.
! This can range from a three hour isolation from the internet to the loss of the WorldTrade Center.
! CEO: Require Planning; Approve Budget! Business Unit Heads: Define Requirements to support customers; Build BCP into Budgets ! Business Operations: Determine viable alternatives ! Support Operations: Define how and where ! Data Content Owners: Specify backup frequency and ! Desktop Computer Users: Schedule backups ! Training and information is available from - http://www.drii.org/ (Dis. Rec. Inst. Int.) - http://www.drj.com/ (Dis. Rec. Journal) ! Planning the response to an internal event will cover most of the external events also.
- Inability to deliver Product to customers - Inability to identify or contact customers ! Communication is the key to successfully building, maintaining and using a BC Plan.
! Internal communications are critical.
- Emergency Notification Network (Corporate) - Business Unit/Department contact lists - Supervisor contact lists, both direct report and ! Use more than one method of accessing contact lists (paper, PDA, laptop, website, etc.) and staff contact(cell phone, pager, PDA, web, home phone, etc.).
- Crisis Command Center (Corporate response) - Local Control Center (Local response) - Customer contact capability (Business Unit) - Vendor communication/redirection (Procurement) - Corporate resource response (Infrastructure Support) - Employee notification (Alternate work location) ! Suggestion: One web accessible directory.
! Business Units should include worldwide contacts within their unit (vertical reportingchain).
between Business Units (horizontal, lateral,outsource vendor personnel, etc.).
! The contact numbers must be kept current and maintained as confidential information.
processing requires quick notification ofmultiple groups.
- IT Processing, to evaluate what needs to be - Real Estate, if an alternate location is needed - Data Content Owners, to validate information ! Notification should follow a tested plan.
sufficient resources forBusiness Continuity andDaily Operations.
The Wall Street Journal, Monday, January 29, 2001
"Trial by Fire" by Almar Latour
In March, 2000, a lightning strike at a Philips N.V. semiconductor plant
in New Mexico drastically impacted two companies, 4000 miles away.
Nokia and Ericsson both used the chips produced in their hand-held
phones. Nokia scrambled and met production requirements with no
revenue loss. Ericsson could not respond as effectively. Their
estimated revenue losses from the fire were $400 million. Ericsson
posted a $1.68 billion loss for their mobile phone division last year.
The net effect of the lightning strike: Nokia's hand-held phone share
of the world market is now 30%, up from 27% last year. Ericsson's
share has fallen to 9% from last year's 12%.
Specifics:
Total Sales: $27.7 B
Employees: 60,000
Ericsson:
Total Sales: $28.5 B
Employees: 100,000
! A vital record is defined as one that is essential for preserving, continuing or reconstructing theoperations of the organization and protecting therights of the organization, it's employees, it'scustomers and it's stockholders.
! Vital records must be duplicated and moved to a geographically diverse safe offsite location, one thatis secure from any probable common catastropheoccurring at the location where the original record isstored.
The Recovery Point Objective (RPO) is defined by the Data Content Owner of an IT application. It is the point intime that the application must be restored to.
The Recovery Time Objective (RTO) is defined by the Data Content Owner of an IT application. It is the time fromdisaster declaration to the restoration of the application.
The following are used by the Data Content Owners in How long an outage can the business tolerate before it is injeopardy of going out of business? How much data can the business afford to lose? What type of regulations affect how quickly critical businessdata must be restored? ! Due to the integration of IT resources, the loss of even one application can have adrastic effect on business capabilities.
! Identifying application dependencies, and the impact on customers, will define therestoration requirements for eachapplication.
! Retention schedule adherence ensures other copies are available if a problem occursduring data restoration.
! IT BCP should be based on the requirements of critical application(s) hosted on aprocessor. The application availabilityrequirements will define the processorreplacement time frame. These timerequirements translate into the alternateprocessing location infrastructure availabilityrequirements.
! With adequate funding available, this is the beginning of an effective IT BC Plan.
! Data storage requirements are moving to high availability in multitiered, distributedand complex environments, some withmultiterabytes of information.
! Mirror imaging, virtual vaulting, on-line backups and outsourcing to a securelymanaged offsite facility are options, buteach have IT expertise requirements andbudget impacts.
! The proof of how well your BC plan meets your business needs is in your test results.
! Testing can be costly, but worthwhile.
! Note: A great test can have many things go ! IT testing can be incorporated into Business ! Virtual, or table top, testing of overall Business Continuity Plans can identify areasof weakness across multiple levels of thebusiness and support departments.
- Outside assistance is available, if desired - Checklists developed can ensure weak areas are ! Retention schedules are approved by your legal department for a reason. Everythingwithin your company is available for legaldiscovery.
! Key personnel may need to work in diverse ! Re-Insurance costs are skyrocketing.
! Outsource contracts, 3rd party vendors, service contracts: Is BCP required and performed toyour specifications and satisfaction? ! Do your vendors have tested BC Plans?! If you have the capability, have you offered BCP assistance to your largest customers? Dothey need it? ! Does your infrastructure hide a threat? Transformers with PCB's, insulation withasbestos, etc.
perform and maintain an inventory ofequipment, software, access ports and IPaddresses. (Keep a copy offsite) ! Affordable training for internal staff can balanced against the potential inability tosupport your customers.
! Once a plan has been developed, you may find other uses for the information gathered.
- The identification of equipment installed can be used as a strategic tool for contract negotiations,etc.
- Insurance or Re-insurance premiums may be - Documentation of each business location and the function(s) performed there may be useful indeveloping alternate recovery strategies.
Bell Labs Innovations
Dwight C. Sawin
600 Mountain AvenueMurray Hill, NJ 07974-0636 Business Continuity Manager
Telephone: 908-582-5793dcsawin@lucent.com

Source: http://www.ne-htcia.org/docs/bcp.pdf