Disaster recovery strategic planning: How achievable will it be?

Transcription

1 Disaster recovery strategic planning: How achievable will it be? Amr Ahmed Ernst & Young Advisory Services, Executive Director Christopher Rivera Ernst & Young Advisory Services, Manager

2 Risk-based Prioritization Strategy implementation Resiliency touch points BCM program alignment and implementation continuity driven resiliency objective Assess phase (Risk-based prioritization) process/apps identification impact analysis Dependency analysis Risk assessment (gap analysis) Continuity strategy development Current technical capabilities Mitigation phase (Progress against plan) Technical solution acquisition and implementation Incident response management continuity and disaster recovery plans Plans exercise and maintenance IT DR driven

3 Disaster recovery strategy approach The outcomes of the strategy may have more than one solution to fulfill an organization s recovery and continuity in the face of a business disruption What is to be recovered: People, business processes, application critical paths and technical services How will it be recovered: Technology and technical solution options Where will it be recovered: Technologies facilities (e.g., data center, data rooms), workplace and/or service provider(s) When will it be planned: Execute short-term and long-term roadmap How much it will cost: High-level budget requirements

4 Disaster recovery strategy requisites Guiding principles Total cost of ownership strategy and impact Infrastructure strategy Technical dependency Enterprise risk In-source Co-location Outsourcing Current strategy gaps Sourcing alternatives Managed hosting Cloud services Disaster recovery strategy High -level investment Roadmap and timeline constraints People constraints Technology constraints

5 Disaster recovery strategy requisites strategy and impact Understand the business direction, criticality and prioritization, and the impact that would arise if a threat became an incident and caused a business disruption. Infrastructure strategy Align disaster recovery strategy options with current infrastructure technology strategy (i.e., use the organization s existing cloud strategy as a disaster recovery options) Technical dependency Identified all dependencies relevant to the critical business processes/applications, including the underlying infrastructure technology, operational resources and suppliers, and outsource partners Enterprise risk Determine the criteria for acceptable level of risk and statutory, regulatory and contractual duties

6 Disaster recovery strategy requisites Guiding principles Total cost of ownership Guiding principles that provide a clear link to business and technical priorities and define leading practices for technology architecture and implementation Current environment cost transparency Issues and obstacles that will affect the future strategy development and disaster recovery (DR) architecture. For Example: the business s or the country s political establishment and/or regulation requires that the application and/or data be served from a specific location (e.g., state/providence, country, region) and/or by a specific sourcing service type (e.g., in-house, co-location, managed service) constraints People constraints Technology constraints

7 Disaster recovery sourcing options Understand your alternative service delivery models: Layers/levels of hosting In-house Co-location Managed hosting IaaS/ PaaS SaaS Apps Complete outsourcing process layer Application layer Application Infrastructure layer (tools layer) Operating system layer Device layer Networking layer Data center layer Client responsibility Service provider responsibility

8 Tolerance to service loss Disaster recovery levels Understand your disaster recovery solutions related to business impact results Recovery time objective (RTO) solutions example Level 1 <= 4 hours Clustering and geodiverse Level 2 Level 3 >4 10 hours >10 hours 3 days Like-or-like and virtual servers Re-purpose dev/testing and vendor drop-ship Level 4 Time 0 of the outage >3 days 2 weeks Time BIA categories Vendor drop-ship Low (hours) High (hours) Vital service 0 24 Essential service >24 72 Important service > Supportive service >

9 Tolerance to data loss Disaster recovery levels Understand your disaster recovery solutions related to business impact results Recovery point objective (RPO) solutions example Level 1 <= 1 hour SYNC/ASYNC replication and VTL backup Level 2 >1 hour 12 hours ASYNC replication and VTL backup Level 3 >12 hours 24 hours VTL backup Level 4 >24 hours 72 hours VTL or tape backups Last data backup and/or replication Time BIA categories Low (hours) High (hours) Vital service 0 24 Essential service >24 72 Important service > Supportive service >

10 Facility Others Labor Hardware Data network Disaster recovery total cost of ownership (TCO) Measure your current IT DR spending so you can effectively improve, manage and control your future DR strategy costs. Build and maintain an accurate inventory of hardware, software and appropriate licenses. Develop a TCO model that includes a combination of the following OPEX and CAPEX (recurring and non-recurring) spending: o Labor; plan, build, test and run o Facilities, including in-source or external data centers, data rooms and workspace o Hardware, data network and other items are for hosting hardware and applications Example of cost items included in the model Plan Build Test (app development testing) Run (DR operation) X86 (Wintel, Linux) Unix (e.g., Solaris) Storage Space (technology and workspace) Power WAN connectivity LAN switches Security (e.g. firewall, IPS) Other Devices (e.g. router, LB) Software (e.g., OS, DB) Racks/cabinets Structured wiring and patch cords

11 Disaster recovery total cost of ownership (TCO) Comparative cost summary (in thousands) example:

12 Disaster recovery strategy roadmap 1. Current facilities to accommodate DR requirements (e.g., space, power, Tier III) and/or address different sourcing options. 2. Infrastructure foundation services recovery capabilities such as networks, AD, DNS, authentication, etc. 3. Service applications and collaboration tools such as , unified communications, etc. 4. application recovery based on criticality, priority, interdependencies, etc. Develop the strategy implementation roadmap based on your current maturity to address: application Messaging Network application Incident response plan Active directory application application DNS application Infrastructure foundation services Facility (e.g., power, space, hosting service) application Dependencies and sequence of applications recovery Unified comm. Service applications and collaboration tools application Team Desktop Mobile spaces tools services 3 Core platform services (Systems/OS, storage) 4 2 1

13 Thank You!

14 Ernst & Young Assurance Tax Transactions Advisory About Ernst & Young Ernst & Young is a global leader in assurance, tax, transaction and advisory services. Worldwide, our 152,000 people are united by our shared values and an unwavering commitment to quality. We make a difference by helping our people, our clients and our wider communities achieve their potential. Ernst & Young refers to the global organization of member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit EYGM Limited.. All Rights Reserved. This publication contains information in summary form and is therefore intended for general guidance only. It is not intended to be a substitute for detailed research or the exercise of professional judgment. Neither EYGM Limited nor any other member of the global Ernst & Young organization can accept any responsibility for loss occasioned to any person acting or refraining from action as a result of any material in this publication. On any specific matter, reference should be made to the appropriate advisor. The opinions of third parties set out in this publication are not necessarily the opinions of the global Ernst & Young organization or its member firms. Moreover, they should be viewed in the context of the time they were expressed.