DRAFT Disaster Recovery Policy Template

Transcription

1 <COMPANY> DRAFT Disaster Recovery Policy Template

2 NOTE: This is a boiler plate template much information is needed from <COMPANY> to finalizeconsider this document pre-draft FOREWARD... 3 Policy Overview Introduction Purpose Scope Disaster Recovery Strategy [MOBILE NETWORK]Platforms <COMPANY> Disaster Definition Assumptions Area-Wide Disasters Contractual Arrangement For Recovery Services Disaster Recovery Action Plan Backup and Off-Site Storage Procedures Off-Site Storage Services Disaster Response Hot Site Hardware and Software Configurations Resuming Normal Operations Security Functional Teams and Responsibilities Disaster Recovery Coordinator

3 Damage Assessment Team Executive Team Restoration Team Operations Team Customer Support Team Salvage/Reclamation Team Administrative Support Team Testing the [MOBILE NETWORK]/[IT NETWORK]Disaster Recovery Plan Hot Site Test Procedures Hot Site Test Planning Application Testing Support Post-Test Wrap-Up Hot Site Test Schedule Testing the <COMPANY> Services Disaster Recovery Plan Training Maintaining the Plan Disaster Recovery Check Lists General Background Status DRP Plan Maintenance Check List IT DRP Risk Control Matrix

4 FOREWARD This Disaster Recovery Plan describes the strategy and procedures for recovering Data Center processing of applications should a disaster substantially disrupt operations. The plan is organized into three parts: the main body provides a general description of the disaster recovery strategy and program, the appendices provide detailed information for conducting the recovery, and the attachments provide supplemental information. The main body is public information and may be freely distributed; the appendices and attachments contain sensitive information that is restricted to the individuals responsible for recovering Data Center operations. The appendices and attachments must be destroyed when updated versions are received. The plan is frequently updated to reflect current hardware, software, procedures, applications, and staffing. Revisions are distributed to the disaster recovery team members at least twice a year following the disaster recovery tests. When copies of the plan are no longer required, please return them to the Disaster Recovery (DR) Coordinator. All corrections are welcome at any time and should be directed to the DR Coordinator. POLICY OVERVIEW The Disaster Recovery Policy must be reviewed at least annually to assure its relevance. Just as in the development of such a policy, a planning team that consists of upper management, and personnel from information security, information technology, human resources, or other operations should be assembled to review the disaster policy. Roles and responsibilities of the planning team should be as follows: Perform an initial risk assessment to determine current information systems vulnerabilities. Perform an initial business impact analysis to document and understand the interdependencies among business processes and determine how the business would be affected by an information systems outage. 3

5 Take an inventory of information systems assets such as computer hardware, software, applications, and data. Identify single points of failure within the information systems infrastructure. Identify critical applications, systems, and data. Prioritize key business functions. Company personnel will carry out the following procedures in the implementation of a disaster recovery policy Setup and maintain offsite facilities for data backup storage and electronic vaulting as well as redundant and reliable standby systems if necessary. Ensure that critical applications, systems, and data are distributed among facilities that are reasonably easy to get to but not so close that they could be affected by the same disaster. Establish written policies, contracts, and service level agreements with third party hosting, collocation, telecommunications, and Internet service providers that facilitate prompt recovery and continuity. Create an incident response team that consists of information security, IT, marketing, HR, legal, and other relevant personnel. Define the roles and responsibilities of the incident response team. Obtain each incident response team member s contact information. Determine which methods the incident response team members will use to communicate in the event of a disaster. Create a public relations plan to assist with the effective handling of an incident. Assign a manager (such as an IT or Information Security Manager) that has the responsibility and authority to make critical IT decisions. Develop testing standards. 4

6 Document and distribute the disaster recovery plan. Distribute copies of the written plans to everyone involved and also store extra copies in an offsite, fireproof vault. The following are ongoing procedures that must be followed: Continuously perform data backups, store at least weekly backups offsite, and test those backups regularly for data integrity and reliability. Test plans at least annually, document and review the results, and update the plans as needed. Analyze plans on an ongoing basis to ensure alignment with current business objectives and requirements. Provide security awareness and disaster recovery education for all team members involved. Continuously update information security policies and network diagrams. Secure critical applications and data by patching known vulnerabilities with the latest fixes or software updates. Perform continuous computer vulnerability assessments and audits. 5