Disaster Recovery Planning

Transcription

1 Disaster Recovery Planning This is a brief guide, with a suggested table of contents, to help you get started with putting together your Disaster Recovery Plan (DRP) Pensar can assist you in completing your DRP from a technology perspective and provide input on other elements of the plan. For more information, please contact: Hiten Patel or Mark Williams [email protected] All Rights Reserved, 2013, Pensar

2 Table of Contents Information Technology Statement of Intent Policy Statement Objectives Key Personnel Contact Info Disaster Recovery Plan Calling Tree Notification Calling Tree External Contacts External Contacts Calling Tree 1 Plan Overview 1.1 Plan Updating 1.2 Plan Documentation Storage 1.3 Backup Strategy 1.4 Risk Management 2 Emergency Response 2.1 Alert, escalation and plan invocation Plan Triggering Events Assembly Points Activation of Emergency Response Team 2.2 Disaster Recovery Team 2.3 Emergency Alert, Escalation and DRP Activation Emergency Alert DR Procedures for Management Contact with Employees Backup Staff Updates Alternate Recovery Facilities / Hot Site Personnel and Family Notification 3 Media 3.1 Media Contact 3.2 Media Strategies 3.3 Media Team 3.4 Rules for Dealing with Media 4 Insurance 5 Financial and Legal Issues 5.1 Financial Assessment 5.2 Financial Requirements 5.3 Legal Actions 6 DRP Testing 2

3 Table of Contents (continued) Appendix A Technology Disaster Recovery Plan Templates Disaster Recovery Plan for < > Disaster Recovery Plan for <Data> Disaster Recovery Plan for Local Area Network (LAN) Disaster Recovery Plan for Wide Area Network (WAN) Disaster Recovery Plan for Remote Connectivity Disaster Recovery Plan for Voice Communications Appendix B Suggested Forms Damage Assessment Form Management of DR Activities Form Disaster Recovery Event Recording Form Disaster Recovery Activity Report Form Mobilizing the Disaster Recovery Team Form Mobilizing the Business Recovery Team Form Monitoring Business Recovery Task Progress Form Preparing the Business Recovery Report Form Communications Form Returning Recovered Business Operations to Business Unit Leadership Business Process/Function Recovery Completion Form 3

4 Information Technology Statement of Intent This document outlines our policies and procedures for technology disaster recovery, as well as our process-level plans for recovering critical technology platforms and the telecommunications infrastructure. Policy Statement The company shall develop a comprehensive IT disaster recovery plan. A formal risk assessment shall be undertaken to determine the requirements for the disaster recovery plan. The disaster recovery plan should cover all essential and critical infrastructure elements, systems and networks, in accordance with key business activities. The disaster recovery plan should be periodically tested in a simulated environment to ensure that it can be implemented in emergency situations and that the management and staff understand how it is to be executed. All staff must be made aware of the disaster recovery plan and their own respective roles. The disaster recovery plan is to be kept up to date to take into account changing circumstances. Objectives The principal objective is to develop, test and document a well-structured and easily understood plan which will help the company recover as quickly and effectively as possible from an unforeseen disaster or emergency which interrupts information systems and business operations. Key Personnel Contact Info Disaster Recovery Plan Calling Tree Notification Calling Tree External Contacts (for example) Contact Person Contact Number/ Building Management Gas/Electricity/Water Telephone Insurance External Contacts Calling Tree 4

5 1 Plan Overview 1.1 Plan Updating (What the update process is, schedule, frequency, etc) 1.2 Plan Documentation Storage (Where copies of this plan will be stored) 1.3 Backup Strategy (How the plan will be backed up) 1.4 Risk Management (Risk log / register) Potential Disaster Flood Fire Act of terrorism Act of sabotage Electrical power failure Loss of communications network services Probability Rating Impact Rating Brief Description Of Potential Consequences & Remedial Actions Probability: 1 = Very High, 5 = Very Low Impact: 1 = Total destruction, 5 = Minor annoyance 2 Emergency Response 2.1 Alert, escalation and plan invocation Plan Triggering Events (List of key trigger issues at headquarters) Assembly Points (Identification of different evacuation points) Activation of Emergency Response Team 2.2 Disaster Recovery Team 2.3 Emergency Alert, Escalation and DRP Activation (Ensures that communications can be quickly established) Emergency Alert (The Emergency Response Team (ERT) is responsible for activating the DRP) DR Procedures for Management (Hard copy of the names and contact numbers of employees) 5

6 2.3.3 Contact with Employees (Managers will serve as the focal points for their departments) Backup Staff (The designated backup staff member will perform notification duties) Updates (Pensar will provide updates on work resumption) Alternate Recovery Facilities / Hot Site (If necessary, the hot site at our offices will be activated) Personnel and Family Notification (In case of hospitalization of injured persons) 3 Media 3.1 Media Contact (Assigned staff will coordinate with the media) 3.2 Media Strategies (Avoid adverse publicity and be ready to answer questions) 3.3 Media Team (Designated team members) 3.4 Rules for Dealing with Media (Only the media team is permitted direct contact with the media) 4 Insurance (Policies regarding errors and omissions, directors & officers liability, general liability, and business interruption insurance) 5 Financial and Legal Issues 5.1 Financial Assessment (Initial assessment of the impact of the incident on the financial affairs of the company) 5.2 Financial Requirements (i.e. cash flow position, upcoming payments for taxes, temporary borrowing capacity, etc) 5.3 Legal Actions (The possibility of claims by or against the company for regulatory violations, etc) 6 DRP Testing (Disaster recovery plan tests are an essential part of the plan development process. In a DRP Test no one passes or fails; everyone who participates learns from the exercises what needs to be improved, and how improvements can be implemented) 6

7 Appendix A Technology Disaster Recovery Plan Disaster Recovery Plan for Disaster Recovery Plan for Data Disaster Recovery Plan for Local Area Network (LAN) Disaster Recovery Plan for Wide Area Network (WAN) Disaster Recovery Plan for Remote Connectivity Disaster Recovery Plan for Voice Communications Appendix B Suggested Forms Damage Assessment Form Management of DR Activities Form Disaster Recovery Event Recording Form Disaster Recovery Activity Report Form Mobilizing the Disaster Recovery Team Form Mobilizing the Business Recovery Team Form Monitoring Business Recovery Task Progress Form Preparing the Business Recovery Report Form Communications Form Returning Recovered Business Operations to Business Unit Leadership Business Process/Function Recovery Completion Form 7