MARQUIS DISASTER RECOVERY PLAN (DRP)

Transcription

1 MARQUIS DISASTER RECOVERY PLAN (DRP) Disaster Recovery is an ongoing process to plan, develop, test and implement changes, processes and procedures supporting the recovery of the critical functions in the event of a disaster. The Disaster Recovery Plan outlines the process, procedures and management actions to be taken if a disaster causing an extended outage to the Marquis Information Technology Infrastructure. This DRP provides critical information and procedures necessary to restore operations and continue related business processes as quickly as possible after a service interruption. This plan is designed to provide guidance and critical information for trained and experienced staff. Common sense and technical knowledge are required for timely and accurate recovery. Marquis Information Technology Infrastructure Headquarters 5160 Tennyson Parkway, Ste 1000E Plano, TX Dependencies/Critical Requirements Recovery of the Marquis computer facilities is dependent on the following: A copy of this document (Marquis DRP) is stored in the office and with key team members Vital records required for recovery of critical systems and applications are backed up and stored off-site and can be either retrieved or recreated and moved to the recovery site within twelve (12) hours notice All participants understand their roles and responsibilities, undergo periodic training to ensure familiarity with the plan, and are capable of executing the disaster procedures contained in this plan The Disaster Recovery Plan is kept current by periodic updates and review

2 Disaster Definitions Marquis combination of degree of technological systems and data backup ensures the ability to quickly and efficiently restore customer service and standard business functions. Machine failures, storage failures, power failures and network failures at our primary facility would generally not require activating a remote site. For the purpose of the development of this plan, a disaster is defined as an event that will cause an outage of the computer facilities in excess of twenty four (24) hours. The following situations may lead to the declaration of a disaster for Marquis: 1. Any outage to the primary data center that could potentially exceed the outage time of twenty four (24) hours, as specified. The cause of the outage may be any of the following: Fire in Data Center Water or smoke damage to the Data Center Acts of Nature Sabotage 2. A regional disaster that could potentially cause business interruption to all local user departments and the computer facilities. The computer facilities and equipment may be intact but not accessible. A detailed assessment of the situation by disaster recovery assessment team is required prior to determining the level of the recovery to be implemented. Outage Definitions Service interruptions can be caused be a wide variety of situations. Service disruptions are categorized based on the expected duration of the outage. Outage lengths generally match the appropriate condition code as detailed, although conditions may change as determined by executive declaration. Short Outage Time = 4 hrs to 2 days A short outage (power, physical damage, etc.) is a known or predetermined scope. This is a non-disaster event. Extended Outage Time = 2 to 7 days An Extended outage is the period of time that Marquis would exceed the known scope of a Short Outage. During this type of recovery, Marquis will activate operations within a remote site. Indefinite Outage Time = 1 week to 1 month An indefinite outage is defined as the period of time that Marquis would exceed the scope of an Extended Outage. In this instance, Marquis will permanently move to its own reconstructed or new recovery facilities and begin full restoration of all applications and services from backup.

3 Note: Marquis will recover operations from the remote site after a disaster has been declared. The remote site will be used to manage recovery operations. A disaster can be declared at any level depending on recovery capabilities and circumstances Avoidance Strategy The process of performing avoidance strategy is to develop advance arrangements and procedures that enable Marquis to plan for a disastrous event. This must be done in such a manner that critical business functions are not interrupted and/or have minimal impact. The Emergency Recovery Process defines possible business interruptions and disaster events that could escalate to the point of activating the DRP. The procedure provides guidelines to be followed in specific emergencies and conditions. Levels of Protection Marquis, uses multiple levels of protection for its information technology assets. VOIP Phone System In case of individual system failure, Marquis VOIP phone system would allow continued production using a failover internet access. In case of access inability of the office location, the phone system can be migrated to the remote location to continue operations. Back Ups Marquis backups are performed as type full once a week and the remainder is incremental. A rolling one month encrypted network backup is maintained at a remote location. Client Communication Client communication is the responsibility of client support services at the direction of the executive team. Communication is based upon the type of outage and the systems affected. Client contact information is maintained by proprietary software which is protected by security programming. Client contact data can be accessed from any remote location over the internet. Disaster Recovery Teams The Disaster Recovery Teams are formed to manage the disaster recovery process based on the team member s skill set and expertise. Executive Team Business Recovery Team Technical Recovery Team

4 Team Responsibilities Executive Team The Executive Team appoints the members to the Disaster Recovery Management Team at Marquis. It is also responsible for directing the overall operations of the DR management team. This team has the responsibility to provide executive-level decisions in the period following a disaster and the authority to declare a disaster and mobilize teams to recover at the remote site and communicate status to third parties. This decision will be made after input from the damage assessment process. The Executive Team will make policy decisions, oversee internal and external communications, and serve as the official source of information during the recovery process. It is also responsible for approving the results of periodic plan reviews and invoking declaration initiatives. Pre-Disaster Responsibilities Provide Marquis executive sponsorship for disaster recovery planning Review test plans and drills conducted Review and approve results of periodic plan review Disaster Responsibilities Execute alert/declaration procedures of Marquis based on the severity of the situation Provide overall direction to the recovery management team Authorize purchase of replacement equipment Authorize use of temporary personnel as required Approve and oversee facilities renovation and reconstruction (as needed) Coordinate communication with external media as necessary (press releases, etc.) Approve restoration and system migration plans Post-Disaster Responsibilities Lead the audit of disaster recovery processes following an incident Authorize changes to the DR plan Institute changes in future DR test and procedures Business Recovery Team It is the role of the DR Business Recovery team to provide the overall direction of recovery operations. Activities will be coordinated under the direction of the Executive Team. It will analyze damage reports and make recommendations to the Executive Team on the need for disaster declaration. If a disaster declaration is made, this team coordinates all the internal recovery procedure activities and monitors progress. It schedules recovery personnel for appropriate support activities and serves as the focal point for all technical and operational questions posed by customers during the recovery process. This team has a key role in ongoing disaster recovery preparedness. It is responsible for all planning, testing and maintenance activities necessary to sustain the recovery capability over time.

5 Pre-Disaster Responsibilities Provide overall leadership in the development and implementation of the Marquis DRP Ensure that personnel are familiar with the Marquis disaster notification procedures Review and approve results of periodic plan review Understand documented computer room and general facility equipment specifications, vendors, and contact information established by IT Systems, and Facility and Business Services Establish a team notification plan and a predetermined team meeting location for actual disaster assessment coordination Be versed in site physical security procedures Maintain a supply of miscellaneous equipment (i.e., cable, connectors, flashlights and equipment layouts) for emergency use Understand procedures to update client communications including implementation of VOIP phone system for customer support; 800 number, call support, and outbound outreach Disaster Responsibilities Assess situation in the computer facility Notify the Marquis Executive Team Review damage assessment and make recommendations to the Executive Team Execute final alert/declaration procedures of Marquis based on the severity of the situation Contact alternate or substitute team members as required Study and assess extent of damage to computer equipment and the facility in general; determine the nature of damage and the projected time to repair/restore Establish physical security at damaged facility Contact and/or cooperate with fire, police, and insurance agents Determine if area is safe for personnel with guidance from local authorities Obtain equipment lists from IT Systems, and Facility and Business Services Recover reusable equipment and supplies Activate procedures to communicate with clients Activate procedures to restore communication systems including telephone and internet Post-Disaster Responsibilities Assess the effectiveness of the team during disaster Revise/Update team tasks and procedures as needed Implement updated tasks and procedures into plan testing requirements Revise/Update existing production procedures

6 Technical Recovery Team The Technical Recovery Team is responsible for the restoration and recovery of the equipment, server systems, utility, application software and data for internal business systems at the remote site location or at the reconstructed Marquis data center. Pre-Disaster Responsibilities Maintain a current inventory of all hardware systems, utilities, application software residing in the computer rooms Maintain a current list of vendors, and other support contacts Conduct walk-through of the computer rooms to eliminate hazards Establish system backup and recovery procedures for Marquis operating systems Facilitate the recovery of Marquis operating systems Review and identify required disaster recovery documentation and manuals Have contracts, manuals and documentation available at the recovery site Document and update changes of system backup and recovery procedures Ensure operations are performing backup procedures as required Test backup/recovery procedures at the computer facility Review and analyze test results and implement modifications as necessary Disaster Responsibilities Review current disaster situation, recovery procedures, and roles and responsibilities At the remote site location, ensure all manuals, documentation, and backup media are available Establish alternatives and acquisition procedures for missing documentation and media Restore operating system, subsystems, utilities, application software and data using the recovery procedures Verify operating system availability Provide other recovery teams with an ongoing status and notification of operating system availability Provide technical support for other teams as necessary At the conclusion of the damage assessment, assume responsibility from the assessment team for necessary salvage, repair or replacement of IT equipment only Prepare for and execute procedures to return to the renovated/reconstructed Marquis computer facility when ready Post-Disaster Responsibilities Assess the effectiveness of the team during disaster Revise/Update team tasks and procedures as needed Implement updated tasks and procedures into plan testing requirements Revise/Update existing production procedures