Company X IT Disaster Recovery Plan (BCP0005)

Size: px

Start display at page:

Download "Company X IT Disaster Recovery Plan (BCP0005)"

Thomas Mitchell
7 years ago
Views:

1 Company X IT Disaster Recovery Plan (BCP0005) 1 of 48

2 Document version control Version Date Author(s) Summary of changes Document approvals Approving body Roles Version Document distribution Referenced documents Title Location Version Document Review History Reviewed By Title Date 2 of 48

3 Table of Contents 1. INTRODUCTION Policy Statement Scope of this Plan Document Disaster Scenarios Conceptual Recovery Time Line Assumptions Invoking the Plan Explanation of Terms ROLES AND RESPONSIBILITIES Overview IT Emergency Recovery Team Damage Assessment Team Technical Recovery Team Media Liaison Team Logistical Support Team Vendors/Service Providers Special Equipment/Vital Documentation ACTION PLAN Action Plan Overview Primary Action Procedure Continuation Action Procedure RECOVERY ACTION PLAN STEP 1 -- Activate the IT Emergency Recovery Team STEP 2 -- Assess Damage STEP 3 -- Declaring a Disaster STEP 4 -- Take Action to Restore the Damaged Facility STEP 5 -- Deliver Critique of Plan STEP 6 -- FINISH (if a disaster was not declared) STEP 7 -- Move to Emergency Alternate Facilities STEP 8 -- Manage External Contacts STEP 9 -- Recover IT Processes STEP Salvage Damaged Offices/Computer Room STEP Deliver Critique of Plan STEP FINISH TESTING AND MAINTENANCE OF THE PLAN Overview About Tests Types of Tests CHECKLISTS AND FORMS Overview Incident Description Assessment Checklist Recovery Checklist of 48

4 7. APPENDICES Appendix 1: Other Things to Include Appendix 2: Activity Log Appendix 3: Expense Log Appendix 4: Sample Fax Message to Clients of 48

5 1. INTRODUCTION 1.1. Policy Statement A business continuity management process should be implemented to reduce the disruption caused by disasters and security failures (which may be the result of, for example, natural disasters, accidents, equipment failures, and deliberate actions) to an acceptable level through a combination of preventative and recovery controls. AS/NZS ISO/IEC 17799:2001 Clause 11.1 It is the policy of Company X to develop and maintain enterprise-wide disaster recovery plans (DRP s) for Company X s IT services. These will provide Company X with the opportunity to recover from a catastrophic event, be it accidental, man-made or natural, and resume IT operations in an efficient and effective manner. This DRP is designed to reduce the risks of COMPANY X failing to continue to operate the IT element of business critical functions in the face of various crisis situations. It is recognized that the probability of a severe disaster is low, however the existence of a DRP is considered vital should an emergency occur. The ultimate goal of the DRP is to allow COMPANY X IT facilities to resume essential business operations at an alternate location within a predictable time Scope of this Plan Document This document outlines the steps to be taken to restore COMPANY X s IT facilities in a controlled manner and in line with defined business application priorities. It is not a Business Continuity Plan since it only addresses the IT component of business applications. Business Continuity Plans are the responsibility of the relevant business units. Incident Alert & verification Initial Emergency Reponse Focus on specific incidents Scope of activities covered by this document Emergency Procedures Focus on specific services Fallback Plans Focus on specific business activities Figure 1 Framework for Business Continuity Planning Resumption Plans 5 of 48

6 1.3. Disaster Scenarios All scenarios assume that the disaster is likely to continue for more than two working days. Facility Scenario A Scenario B Scenario C Secondary Data Centre COMPANY X Computer Room 1 COMPANY X Computer Room 2 COMPANY X general office facilities Facility is accessible and operable Facility is inaccessible and inoperable 6 of 48

7 1.4. Conceptual Recovery Time Line The graphic below depicts the typical progression of steps and activities anticipated within a well-orchestrated disaster recovery plan. Disaster Occurs Team Alerted Damage Assessed Disaster Declared Recovery Site Occupied Systems & Data Restored Data Network Connected Applications Validated Production Mode Elapsed Time in Hours NOTE: Clients should not expect any production COMPANY X computing services to be available within the first 48 hours after a disaster declaration. All client business recovery plans should include this as a basic planning assumption Assumptions This Disaster Recovery Plan has been prepared with these assumptions: Facilities The recovery will be controlled from an IT Control Centre in Head Office. An alternative IT Control Centre location will be established if Head office is unavailable. A contingency site will be established and will become the interim office Headquarters for Company X under Scenarios A and B (i.e. Head Office unavailable for general office accommodation). The steps involved in establishing this site are not included in this Disaster Recovery Plan. 7 of 48

How to Plan for Disaster Recovery and Business Continuity

A TAMP Systems White Paper TAMP Systems 1-516-623-2038 www.drsbytamp.com How to Plan for Disaster Recovery and Business Continuity By Tom Abruzzo, President and CEO Contents Introduction 1 Definitions