DISCUSSION PAPER DISASTER RECOVERY/BUSINESS CONTINUITY PLANNING IN THE FRESH FOOD INDUSTRY

Transcription

1 DISCUSSION PAPER DISASTER RECOVERY/BUSINESS CONTINUITY PLANNING IN THE FRESH FOOD INDUSTRY Created by David Watt February 2011 TRACE body carcase correlation solution

2 Document Control Page Revision Ver. Date Author Chk d Appr d Change Notice DW SC SC Reviewed and Approved Note: This proposal (Version 1.0) supersedes all previous versions of this document. Distribution List Name Organisation Confidentiality The information contained in this document is confidential and proprietary to the Cedar Creek Company (CCC). CCC submits this document with the understanding that it will be held in strict confidence, and will not be disclosed, duplicated or used, in whole or in part, for any purpose other than the evaluation of CCC s qualifications, without prior written consent from CCC. For the purposes of Freedom of Information legislation, CCC classifies this entire document as Commercial in Confidence. Disclaimer This document should be taken in its entirety; each individual recommendation, statement or conclusion may rely on the acceptance of other recommendations, statements, or conclusions. CCC does not warrant or guarantee any individual statement in this document as a stand-alone statement. Each statement must be considered in the context of the document Page 2 of 10

3 Contents Document Control Page...2 Introduction...4 Disclaimer...4 Background...4 What to consider? Step Approach to DR/BCP Development...6 Appendix A: Data Backup...8 Appendix B: Contact Information Page 3 of 10

4 Introduction Disclaimer This document is provided for the purposes of education and information and should not be a substitute for professional advice. Background What is Disaster Recovery/Business Continuity Planning (DR/BCP)? It is a roadmap of predetermined actions and processes so normal service resumption will take place quickly, efficiently, and cost effectively. Achieving resilience to technology failure in a world increasingly reliant on technology Why consider DR/BCP? 1. Money a. Do you know the average cost of down-time (per hour) in your business? This includes: i. Lost production ii. Inventory spoilage iii. Contractual penalties due to non-performance 2. Reputation 3. Regulatory and Legislative requirements a. NLIS compliance is not optional Benefits of a proper Business Continuity Plan Minimising potential economic loss. Ensuring the safety of personnel and customers. Minimising risky on-the-fly decision-making during a disastrous event Reducing risks, and improving the capability of your organisation to continue business-critical activities no matter what o Ensuring organisational stability o Protecting the assets of the organisation 2011 Page 4 of 10

5 o Reducing the probability of occurrence o Reducing disruptions to operations o Providing an orderly recovery Providing shareholders, customers, employees, third parties and general public with confidence in your business Gaining competitive advantage when responding to tenders Increase control over DR/BCP processes and improve ability to measure progress. Minimising legal liability o Meeting regulatory and contractual requirements o Decreasing potential exposures Achieving insurance premium discounts What to consider? In an ideal world nothing would fail and we would have two of everything to ensure business continuity. In reality, this isn t financially viable for most businesses. Through normal growth, single points of failure creep into organisations that, on failure, can have catastrophic consequences. What is the impact to my business if this fails (financial, contractual, people, loss of stock, reputation). More customers (particularly the bigger players) are insisting on auditable DR/BCP plans are in place to protect their supply chain How do I protect my business in the event of a catastrophic failure (fire, flood, earthquake). Could your business recover? How would you know who owed you money, who you owed money to? A DR/BCP plan should document risk assessments, responsibilities, policies and procedures, and agreements and understandings for necessary internal and external entities. It also needs to take into consideration security (physical, data, network, wireless, etc). Companies themselves can then turn the flexibility and resilience implicit in DR/BCP to their advantage by being able to ramp up production levels or divert supply chains in response to spikes in demand. DR/BCP is designed to cope with failure, but it can also help to ensure success Page 5 of 10

6 10 Step Approach to DR/BCP Development 1. Obtain commitment from Management 2. Establish a DR/BCP Committee 3. Perform equipment assessment (Age, support, maintenance, realistic response times, etc) It s no good waiting for things to fail then putting pressure on external companies to put it right 4. Perform a Risk Assessment (Impact to business) 5. Establish priorities 6. Analyse and define business requirements for recovery 7. Design the program for recovery operations 8. Conduct DR/BCP training 9. Test the Business Continuity Plan a. The DR/BCP plan needs to be regularly tested 10.Maintain and Update the Business Continuity Plan a. It s no help if your plan was done 5 years ago and no-one has looked at it since Potential Deliverables on the way to the BCP Overall executive ownership Policies Risk Assessment Preventative actions Priorities and recovery windows Lists of inventory Recovery kits Emergency response plan Testing, update, and maintenance plan Salvage and restoration Fallback procedures Training/Awareness plan 2011 Page 6 of 10

7 Clearly defined critical business processes o Validation and sign-off of these processes o Dependencies mapped to business processes o Risk exposure accurately addressed Business model change where appropriate Business partners included in planning and activities Commitment to resources (financial and human) A DR/BCP strategy doesn t have to be complex and time consuming. It can be as simple as a table (refer below) of identified risks and how they are to be managed. ITEM IMPACT TO BUSINESS SEVERITY (H/M/L) STRATEGY Once in place, it needs to be a continuous process: 1. Test 2. Review 3. Communicate 4. Go to step Page 7 of 10

8 Appendix A: Data Backup Recent tragic events have made us all more aware of the devastating potential of a physical disaster. In addition, other failures mean we need to look carefully at backup strategies to ensure data integrity, reliability, and business continuity to minimise risk. A good backup strategy requires careful planning, from the selection of devices, to the determination of backup methodology, and other logistical issues. Each step must be carefully analysed in light of such factors as staffing, technical expertise, and budget. Selecting your backup system Before you can determine your backup strategy, you must first determine how much data your organisation needs to protect. This information will help determine what type of system you require - from single-tape drives through large hard-disk systems. The process of determining what will be protected goes beyond summing up the total of all data on your servers. Much of this data may not be mission-critical to your organisation. Examples are programs (which are easily restored from the original media), and users personal files (such as MP3). Once you know the amount of data you need to protect, you can determine which type of device best suits your needs. DDS tape systems are generally acceptable only for smaller organisations with less than about 10 GB of data to protect. For the small/home office, this is a very good choice, since the drives are economical and are considered reliable. For the larger business, disk or DLT tape systems are somewhat more expensive but have significantly greater capacity for data. These systems can be scaled to meet the data-protection needs of most organisations, regardless of size. Setting up your methodology You next need to determine the best methodology for backing up your data. Most commercial backup software systems allow for a wide array of options. The most common are the following: Full: This methodology transfers a copy of all data within the scope of the backup to media, regardless of whether the data has been changed since the last backup was performed. Differential: This methodology backs up all files changed since the last full backup, regardless of whether they have been changed since the last backup operation of any kind. Incremental: Here, only those files that have changed since the last backup operation of any kind (full, differential, or incremental) will be transferred to media Page 8 of 10

9 Essentially, the method you choose will depend on your backup capacity and required recovery speed. For example, by running a full backup daily, you will need a very large amount of capacity but will need only the last backup to restore all data. Conversely, using a full backup once a week with an incremental daily lets you use much less space, but a recovery would require the last full backup and each incremental to be fed back onto the servers. Using weekly full backups with daily incremental backups is generally considered the strategic norm. Rotating your media You will need to develop a media rotation scheme and decide where to store your media. Unfortunately, most companies store physical backup media within about three feet of the servers they protect. As recent physical disasters have shown us, this is not the best way to protect data since the media stands a very good chance of being lost with the servers in a disaster. Physical media needs to be stored off-site in a secure location from which it can be retrieved quickly if needed. To reduce costs for both media and off-site storage, a good media-rotation scheme is essential. The most common rotation scheme is Grandfather-Father-Son (GFS). In the generic version of this scheme, full backups are done at two intervals. The first interval is monthly, and that media is immediately stored off-site (grandfather). Weekly full backups are also performed (father), and these are generally held on-site for the week of their use, then moved off-site for a predetermined number of weekly cycles (two or three cycles is generally sufficient). Daily incremental backups are performed (son) and stored on-site for the week of their use as well, then moved off-site with the corresponding weekly backup on the same cycle schedule. At the end of a cycle for a media set, they can be returned to the system and reused. Monthly media would be held for 12 months before being reused. Weekly sets are generally held for about three weeks after they leave the server room (so about four weeks total) and are then reused. The number of times media can be reused is determined by the type of media. While there is some limited liability inherent in this system (you could lose up to one week of data if you suffer a fire or some other disaster), this system offers the highest security with the lowest cost. The last word As with a well implemented DR/BCP plan, you need to verify and test-restore your data on a regular basis. It s no good waiting until a disaster to find your backups haven t been executed correctly Page 9 of 10

10 Appendix B: Contact Information David Watt Senior Sales Executive Telephone: Fax: Mobile: Cedar Creek Company Address: 11/62 Bishop Street, Kelvin Grove QLD 4059 Australia Telephone: Fax: Web: Page 10 of 10