Service Continuity Management Service Description

Transcription

1 Service Continuity Management Service Description Applies to: Office 365 Dedicated Legacy & vnext Platform Releases Topic Last Modified: 13-Nov-2015 Service Continuity Management... 2 Overview... 3 Service Recovery Terms... 3 Incident Classification... 4 Catastrophic Outage Response... 6 Responsibilities... 7 Annual Exercise Program... 9 Exercise Rescheduling Responsibilities Page 1 of 14

2 Service Continuity Management Service continuity management focuses on the ability to restore Office 365 services to your organization in a predetermined timeframe during a catastrophic service outage. Achieving restored services requires preparation, planning, technical implementation, and conducting exercises to validate the incident management and service restoration solution and processes. This service description presents the common approach to service continuity management that Microsoft uses with customers that are subscribed to the dedicated and ITAR-support plans of Office 365 for enterprises. Also provided is the definition of Microsoft and customer responsibilities that relate to service continuity management for the purpose of compliance and auditing. All information provided specifically applies to the following services: Exchange Online Dedicated SharePoint Online Dedicated Lync Online Dedicated Notes: 1. Unless otherwise indicated, references made in this service description to the dedicated offerings of Office 365 for enterprises also apply the International Traffic in Arms Regulations (ITAR-support) service releases. 2. The content of this service description applies to all legacy service releases of Office 365 Dedicated services and the vnext service releases. A vnext release is an offering on a common service fabric capable of supporting either a multi-tenant or dedicated implementation of a service. Contact your Microsoft account team for additional information. Page 2 of 14

3 Overview Office 365 service offerings are delivered by highly resilient systems that help to ensure high levels of service. Services are hosted in Microsoft enterprise-level data centers that utilize the same world-class operational practices as the Microsoft corporate line-of-business applications. Office 365 solutions also take advantage of the extensive experience that Microsoft has in hosting services, and its close ties to the Microsoft product groups and support services, to create a service that meets the high standards that your organization demands. To help maintain high service levels, service continuity provisions are built into Office 365 system design. These provisions enable Office 365 services to recover quickly from unexpected events such as hardware or application failure, data corruption, or other incidents that affect users. The service continuity provisions presented in this service description specifically apply to the Office 365 Dedicated service offerings. The management of catastrophic outage events (such as a natural disaster or fire within a Microsoft data center that renders the entire data center inoperable), preparation to address outages, and the exercising of the service continuity procedures are described. Service Recovery Terms The following terms are commonly used in service continuity management to evaluate disaster recovery solutions: Recovery time objective (RTO). This term refers to the acceptable amount of time the service can be down before being brought back online Recovery point objective (RPO). This term refers to the acceptable amount of data loss at the conclusion of the data recovery process. Failover. This term refers to relocation of an overloaded or failed resource such as a server, a disk drive, a network, or a data center to its redundant, or backup, component. Page 3 of 14

4 The RTO and RPO parameters for Office 365 Dedicated plans services are provided in the table below. Office 365 Dedicated Service RTO RPO *Exchange Online 1 hour or less Nearly instantaneous **Exchange Online 2 hours or less 45 minutes or less ***SharePoint Online 2 hours or less 45 minutes or less ****Lync Online 2 hours or less 45 minutes or less *Exchange 2013 and Exchange 2010 on ANSI-D architecture **Exchange 2010 on Aruna architecture ***SharePoint 2010 and 2013 ****Lync 2010 and 2013 Incident Classification An Office 365 service outage may be due to hardware or software failure in the Microsoft data center, a faulty network connection between your environment and Microsoft, or a major data center challenge such as fire, flood, or regional catastrophe. Most service outage incidents can be addressed using Microsoft high availability technology and process solutions, and are resolved within a short period. However, some incidents are more serious and have the potential for lengthy outages and service interruption. To establish the seriousness of an incident, Microsoft uses the severity scale shown in the figure below. The scale classifies outage incidents as minor, critical, or catastrophic events based on the impact to your organization. Page 4 of 14

5 To learn about how Microsoft manages incidents that impact availability of Office 365 Dedicated services, see the Support service description for Office 365 Dedicated plans. Page 5 of 14

6 Catastrophic Outage Response Microsoft analyzes each outage that impacts Office 365 Dedicated service availability to determine the scope of the incident and possible solutions. An outage that causes a work stoppage in your organization might be considered to be a catastrophic outage. In the event of a catastrophic outage, the Microsoft incident management team will contact you via or other communication methods established with your organization. Status updates are provided to you at least every hour for the particular incident. Next, a phone call is made to an agreed upon telephone number that you have provided for your service desk to allow Microsoft to inform them of the incident. In addition, a Microsoft Critical Situation (CritSit) Manager helps to ensure that outage notifications are received by your executive contacts. This requires that you provide the most current contact information for these executives to the Microsoft Service Delivery Manager assigned to your organization. Initial contact with the executive contacts is made by phone within 60 minutes of the outage being declared. Additional follow-up frequency will be set and agreed upon by the executive contact and Microsoft CritSit Manager. Finally, Microsoft requires disaster Declaration Authority contacts who will be contacted in the event a disaster declaration is enacted. These contacts are typically executive level contacts with decision making authority over the licensed Office 365 Dedicated service(s). Microsoft Declaration Authority contacts will reach out to customer Declaration Authority contacts in the event an incident reaches a critical severity where failover is being considered. Exchange 2010 (Aruna architecture) SharePoint and Lync: An outage may be declared a disaster if it is classified as a catastrophic event based on the severity scale shown in the Incident Classification section. Declaration of a disaster does not automatically result in failover to your secondary Microsoft data center site. The decision to failover to the secondary data center is made by mutual agreement between Microsoft and your organization except in cases of force majeure when Microsoft will proceed with the failover. In these instances, Microsoft will inform you of the failover as quickly as possible after addressing the disaster. Page 6 of 14

7 The figure below illustrates the Microsoft response to a catastrophic service outage. Exchange 2010 (ANSI-D architecture) and Exchange 2013 (ANSI-D architecture) An outage may be declared a disaster if it is classified as a catastrophic event based on the severity scale shown in the Incident Classification section. Declaration of a disaster does not automatically result in failover. The ANSI-D architecture is an active design that provides continuous and automated replication across at least four data centers. Microsoft reserves the right to failover to one of these data centers at any time (including during catastrophic incidents) in order to minimize any customer impact. As a result, a mutual decision between Microsoft and your organization to invoke a failover is not necessary. If a catastrophic incident occurs, Microsoft will inform you of a failover as quickly as possible after addressing the disaster. Responsibilities Customer Responsibilities Provide contact information. Provide appropriate personnel addresses (group distribution lists recommended) and phone numbers to your Service Delivery Manager to allow Microsoft to engage the correct personnel within your organization at the time of an event. Microsoft specialists will engage members of your organization to review the current status of the outage, disaster declaration criteria, and approval or disapproval (if applicable) of failing over to your secondary Office 365 Dedicated data center site. Provide declaration support. Provide executive-level declaration authority contacts to the Microsoft declaration authority to help determine if failover to your secondary site is necessary. Page 7 of 14

8 Microsoft Responsibilities Provide contact information. Provide to you a single group alias and phone number to allow you to engage the appropriate Microsoft personnel at the time of an event. Microsoft specialists will engage members of your organization to review the current status of the outage, disaster declaration criteria, and approval or disapproval (if applicable) of failing over to your secondary Office 365 Dedicated data center site. Decide whether failover is required. Make the decision, with input from your organization, on whether to fail over to your secondary site (excluding Exchange 2010 on ANSI-D or Exchange 2013 per descriptions provided above). Page 8 of 14

9 Annual Exercise Program Exchange 2010 (Aruna architecture) SharePoint 2013 and Lync: At your request, Microsoft facilitates a service continuity exercise, a best practice that is advocated by business continuity specialists. The purpose of the service continuity exercise (also called a failover exercise) is to validate (a) incident management processes and (b) the solution for service restoration which uses your allocated disaster recovery environment. The exercise also provides Microsoft and your organization's management with all documentation regarding the results of the exercise. Microsoft provides for a maximum of one failover exercise for each contract year. The first exercise cannot be scheduled until after the purchased Office 365 Dedicated services are fully deployed. Subsequent exercises must be at least 12 months apart. A typical service continuity failover exercise will involve the following: Simulate a catastrophic outage and validate incident management processes and disaster declaration criteria and processes. Execute failover to the secondary data center as appropriate for each Office 365 Dedicated service. Impact a small number of selected user mailboxes and/or SharePoint site collections. Exchange 2010 (ANSI-D architecture) and Exchange 2013 (ANSI-D architecture): The ANSI-D architecture of Exchange Online Dedicated is an active model that provides fast, seamless, reliable service failover and recovery. Microsoft regularly tests the Exchange environment by performing failover tests to ensure service resiliency and reliability for customers. These tests do not require customer involvement. The Microsoft Office 365 Dedicated Service Continuity Team will provide failover summary reports to your Service Delivery Manager within 10 business days following a routine failover in any one of the hosted datacenters. The data from the reports will be retrieved from the logs of the most recent failover in your environment. A typical service continuity failover test will involve the following: Page 9 of 14

10 Simulate a catastrophic outage. Execute failover of the Exchange service to another data center (or next available rack or pod). Briefly impact some or all user mailboxes in impacted data center (depending upon which racks or pods are failed over). Note: During the failover/failback impact to users connected via OWA will be redirected to the front page and required to re-login. Users connected to Outlook will see a temporary disconnect and reconnect; no action will be required to reconnect. Mobile client users (EAS/BES) will not experience an impact. SharePoint Online Dedicated vnext and OneDrive for Business Dedicated vnext At your request, the secondary environment used to host SharePoint Online Dedicated vnext and OneDrive for Business Dedicated vnext can be used by your internal testing team as a read-only test environment. To access the secondary environment, the host file on each test client must be updated to include the IP address for the test environment. Additionally, Microsoft can facilitate a service continuity exercise that will failover the primary environment to the secondary environment for read-only access. All end-user requests will be in read-only mode for the duration of the exercise. The purpose of the service continuity exercise (also called a failover exercise) is to validate the processes for incident management and the solution used for service restoration using a read-only failover environment. The exercise also provides Microsoft and your organization with all of the documentation that describes the results of the testing performed. Microsoft provides for a maximum of one failover exercise for each contract year. The first exercise cannot be scheduled until after your purchased instance of the Office 365 Dedicated vnext release of SharePoint Online and/or OneDrive for Business is fully deployed. Subsequent exercises must be at least 12 months apart. Page 10 of 14

11 A typical service continuity failover exercise will involve the following: Simulate a catastrophic outage and validate incident management processes. Simulate disaster declaration criteria and processes. Execute failover to the secondary data center as appropriate for the Sharepoint Online and OneDrive for Business offerings of the Office 365 Dedicated service. As a part of this failover, all end users will have read-only access to the environment and all site collections. When the exercise has been completed, read/write access to the environment will be restored on the primary server farm. Note: When your services are in a hybrid state (i.e., production content on both the legacy platform and vnext platform of Office 365 Dedicated), the two environments are considered separate for the purposes of failover exercises. Exercises for each environment can run separately or in parallel but will be handled as two distinct tests. Tabletop Exercises: In addition to conducting failover exercises and tests, Microsoft offers a table-top exercise. A typical tabletop exercise will involve the following: Enable participants to review documented plan activities in a stress-free environment typically via a Microsoft Lync meeting. Effectively validate team roles and responsibilities during an emergency. Identify needs for training, documentation errors, missing information, and inconsistencies across business continuity plans for both Microsoft and your organization. Page 11 of 14

12 Microsoft recommends that you consider conducting a table-top exercise prior to your first failover exercise before deployment is fully implemented. This will prepare your teams for their first full failover exercise after service deployment is complete. The three phases of a failover exercise Preparation, Validation, and Resolution are shown in the following figure. Page 12 of 14

13 Exercise Rescheduling All scheduled exercises will be subject to immediate cancellation or termination if Microsoft or other Office 365 Dedicated subscribers declare a disaster and request use of the resources that have been designated for the exercise. Exercises may also be postponed if there are active catastrophic (Severity 1) or critical (Severity A) issues in your environment 24 hours prior to the exercise. In the event an exercise is cancelled, reasonable effort will be made to reschedule it at the earliest agreed upon availability. Responsibilities Customer Responsibilities Submit a written request to your Service Delivery Manager to schedule a service continuity exercise at least 90 days prior to the proposed exercise date. The request should identify a first and second choice for dates and timeframe, and define the service or services to be validated during the exercise. Microsoft recommends conducting the initial exercise within 10 working days after your migration to Office 365 Dedicated services is complete. Provide written cancellation notice within 30 days of the scheduled exercise if the exercise is no longer required. Provide a project manager to work with the Microsoft service continuity project manager during the exercise planning, execution, and post-exercise phases. Participate in the pre-exercise, exercise, and post-exercise phases. Microsoft Responsibilities Respond in writing to your request for an exercise within 10 business days, with confirmation on resource availability and projected start date. Provide an Office 365 Dedicated service continuity project manager to work with your project manager during the exercise planning, execution, and post-exercise phases. Review the service continuity management exercise calendar to ensure that your migration and Office 365 Dedicated provisioning are completed prior to scheduling an exercise and to ensure that the requested exercise date does not conflict with other migration, deployment, upgrade, or maintenance work being managed by Microsoft teams. Page 13 of 14

14 Determine the availability of the resources necessary for the exercise and schedule the exercise accordingly. Participate in the pre-exercise, exercise, and post-exercise phases. Document exercise results via an executive summary and then work with your teams to close any issues encountered during the exercise. Page 14 of 14