Business Continuity Plans- Technology. Preparation Instructions. Inventory and Assessment. System Backup Procedures

Transcription

1 Business Continuity Plans- Technology Preparation Instructions Lutheran Community Services Northwest has operational offices in almost 30 separate locations throughout the states of Washington, Oregon, and Idaho. To help insure that vital services can continue to be provided to our clients in the event of disasters or other potential operational interuptions, business continuity plans are being developed for each of these offices. This document describes the basic approach to these plans with respect to the information technology used at each location. In this context, information technology refers to the computer systems and related data management. This document does not cover manual, hard copy systems of records maintenance nor does it address such issues as general telecommunications. There are three basic components that should be addressed in our Business Continuity Plans ( Plans ): 1) a technology inventory and assessment, 2) clear definition of system backup procdures, and 3) definition of disaster recover provisions. Inventory and Assessment A careful inventory and assessment of technology resources is the first crucial step in developing a Business Continuity Plan for technology. This assessment defines what the Plan will eventually cover and which technology resources need to be protected. The inventory does not need to be a detailed inventory but needs to carefully identify key systems and services. This inventory should include those systems that are necessary for an office to provide services, that contain current or recent client and service data, that are required for contractual purposes, or that provide vital links or information. In assessing the systems installed at any office, it is helpful to think in terms of three different classes of systems: 1) those that are mission critical and need to be recovered in less than 24 hours, 2) those that could be off-line for several days but need to be recovered within 7 to 10 days, and 3) those that could be off-line for more than 10 days without seriously impairing the office's basic operations. As part of this inventory and assessment, the required hardware and basic operating software should be identified plus any other software required to make the system operational. This should include identification of major accounts and user ids. Installation media, serial numbers, key codes, etc. should be identified and collected. This assessment should be updated as programs, services, hardware, and software are changed in each office. The Plan should include a written summary of this assessment. System Backup Procedures Based on the inventory and assessment, procedures can then be designed to provide backup of both data and the hardware needed to access and use the data. With respect to hardware, those hardware components are most crucial to the office's continuing operation should include provisions for clean and steady power, regular maintenance and cleaning, and, ideally, redundancy or replication. Backup of software applications should include provisions for the safe and secure storage of installation media, preservation of source code, and preservation of installation and configuration Business Continuity Plans- Technology March,

2 instructions. The data stores used by essential software should be covered by backup procedures that address the questions of backup frequency, methodology, media, testing, and off-site storage. The Plan should include a comprehensive description of these backup procedures. Disaster Recovery Provisions With a clear inventory of key systems and a good set of backup procedures in place, the final element of the Business Continuity Plan is the identification of provisions for recovering from a disaster. These provisions should cover not only emergency operations in response to major disasters (e.g., fires, floods, acts of war) but also more minor ones such as the failure of a single server or the loss of Internet connectivity. There are three main stages that may be involved in recovering from a disaster: 1) restoration of basic hardware and infrastructure systems, 2) restoration and rebuilding of operating and other software systems, and 3) restoration of data or documents. Descriptions of the provisions for all three of these stages should be included in the Business Continuity Plan. Recovery will not always require the use of all three stages (e.g., in some circumstances it may only be necessary to restore data). Thus provisions for each stage should be designed to operate independently of the other stages. With respect to hardware, provisions should be made in the Plan for the replacement of vital hardware components. Replacement could occur through the reallocation or redeployment of other hardware (e.g., to replace a vital server you might take a file/print server offline and reconfigure it), through the use of backup or secondary equipment (e.g., a non-production or test server that can be quickly redeployed into a production role), or through arrangements and agreements with other offices or organizations (e.g., the Tacoma office can move technology operations to Burien). The second stage involves the restoration and rebuilding of the basic operating and software systems. Recovery provisions for this stage should include identification of all necessary software and the safe storage of installation media and instructions. The third stage is the restoration of data or documents. This stage is effectively a component of the System Backup Procedures but provides another check to insure that provisions are made for the installation of necessary backup/restoration software and retrieval of backup media and documents. Business Continuity Plans- Technology March,

3 Business Continuity Plan Office: Person(s) Preparing: Date Prepared: (NOTE: Attached supplemental pages as necessary.) I. Inventory/Assessment A. Overview of Basic Technology Operations. Briefly describe server(s), operating systems, connectivity means, environment, etc. B. Mission Critical Systems. Describe which machines (computers, printers, routers), software, data, etc. are most vital to this office and would need to be recovered immediately in case of a disaster or interuption of service. Include number of users that would require immediate access. C. Other Systems. Describe other systems that are not mission critical but would need to be restored as soon as possible. Include machines required beyond those for mission critical systems, how many additional users, software, data, etc. Business Continuity Plan 1

4 II. System Backup Procedures A. Hardware Backup. Describe any provisions you've made for hardware backup or redundancy. Include battery backup systems used, hardware maintenance provisions, and available hardware replacements. B. Software Backup. Describe methods used for software backup. Address the issues of frequency of backups, methods used for backup, media used, software applications used, and any provisions for off-site storage. Include a description of tests that have been conducted on the backup systems to insure their integrity. Business Continuity Plan 2

5 III. Disaster Recovery Provisions A. Hardware and Basic System Restoration. Describe provisions made in your office for the recovery or replacement of key hardware components (as listed earlier in section I.B. Of this document). Describe provisions for restoration of essential software, including operating systems, on this hardware. Include a description of any agreements with other offices, organizations, or businesses. B. Restoration of Other Software. Describe your plans and provisions for the installation and restoration of application software crucial to the continuing operation of your office. Include a description of installation media required and its location, location of instructions for software installation and configuration, and potential sources of expertise or assistance. C. Data Restoration. Describe provisions for data restoration. This is basically an extension of section II of this document (System Backup Procedures) but focuses on the use or restoration of data and information included in the office's routine backup procedure. Business Continuity Plan 3