TM Disaster Recovery Strategy in the Modern Market A PRACTICAL GUIDE FOR BUSINESS Your Proven Partner in Communications Solutions
Contents What is Disaster Recovery? 1 Components of Disaster a Recovery Solution 3 Business Planning and Preparation 3 Readiness Assessment 3 Business Impact Analysis 3 Gap Analysis 3 Business Process Re-engineering 4 Business System and Technology Preparation 4 Incident Response Planning 5 Normal Operations Restoration 5 Disaster Recovery Strategy Options 6 RGTS Disaster Recovery Solutions Differentiators 7 RGTS Comprehensive Disaster Recovery Solutions 8 Contact Information 9 Rockefeller Group Technology Solutions 2002 Rockefeller Group Technology Solutions, Inc. All rights reserved. D ISASTER R ECOVERY IN THE M ODERN M ARKET
What is Disaster Recovery? Today, more than ever, we have a heightened awareness of potential dangers that exist in everyday life. As a result, the business world is seeing a dramatic increase in the need to address Disaster Recovery as a critical aspect of daily operations. So, What is Disaster Recovery? Disaster Recovery is simply planning ahead to avoid problems, and being prepared in the event a problem occurs. Disaster Recovery is not something you can hold in your hand. You cannot go to the store and buy Disaster Recovery. There aren t any magic Disaster Recovery do-ityourself kits available on the Internet. (If you find one, beware we ll address this later.) When you think about it, most people are exposed to Disaster Recovery strategies in daily life, just not under such an imposing title. Some examples of commonplace Disaster Recovery include: Spare tire in the trunk of a car Yearly flu shot Emergency exit signs 911 emergency support services Each of these examples illustrates an aspect of planning ahead or responding to everyday problems. Disaster Recovery for business is used for the same objectives. From a business perspective, Disaster Recovery has three basic components referred to as: Business Planning and Preparation Business Systems and Technology Preparation Incident Response Planning Just as our everyday measures protect us from potential hazards, these businessrelated components of Disaster Recovery address how to effectively prepare for and respond to an unexpected business impacting outage. You can compare the three components of Disaster Recovery for business to the spare tire in your trunk: Planning and Preparation: What steps do you take to ensure you are prepared? Because you drive through the nail factory everyday, you should keep a spare in the trunk Check the spare tire each time you check your oil to make sure it is still there Keep the spare tire changing manual in the glove box, and make a dry run, practice changing the tire in the driveway Systems and Technology Preparation: Do you have the tools you need in case of a problem? Is the spare tire inflated? Is the spare tire the correct model? Can you get another spare if this one doesn t work? Does the jack work? D ISASTER R ECOVERY IN THE M ODERN M ARKET 1
What is Disaster Recovery? Incident Response Planning: You ve got a flat tire! What do you do? Following the spare tire manual, you change the flat with the spare You proceed to the nearest service station, as stated in the manual, to have your primary tire repaired You replace the spare with the repaired primary tire You re-check the spare and place it back in the trunk for the next time In a nutshell, this is Disaster Recovery strategy. While the technical and logistical aspects of Disaster Recovery can be very complex, the operational components can be boiled down into these three basic concepts: Do you know what your risks are? Are you taking the necessary steps to proactively prepare for potential problems? Do you have a plan identifying how to respond when a problem occurs? Scouts provide a prime example of a Disaster Recovery strategy in their simple, yet effective slogan, Be Prepared! How do you know your Disaster Recovery plan will work? To perform a rudimentary assessment of your organization s Disaster Recovery capabilities, you need to answer (honestly) the following three questions: Do I understand all of the systems and processes that are critical to the operation of my business? Solid Disaster Recovery strategies must be based on quantifiable facts, not on assumption and opinion. Do I have a prioritized plan to recover each system or process? While it may be easy to say that everything is important, when a dollar amount for recovery is applied to specific business functions, many aspects of a business drop down or off the priority list for Disaster Recovery solutions. Will my plan work? (This is the toughest one to answer honestly) One of the biggest mistakes in business (some times career-ending mistakes), have been working with a Disaster Recovery solution based on I think it will work, as opposed to I know it will work. Until you have performed a test of your Disaster Recovery plan, there is no way to know that it will work. Many professionals will answer no to at least a few of these questions. How many can say they truly understand and have performed a formal review of all aspects of their business, created a list of the critical business functions, and prioritized them from the most critical to the least? A comprehensive Disaster Recovery solution encompasses ongoing assessment of risks, implementation and updates of business processes and technologies, and regularly scheduled testing and review of Disaster Recovery plans. 2 D ISASTER R ECOVERY IN THE M ODERN M ARKET
Components of a Disaster Recovery Solution Business Planning and Preparation The most common mistake businesses make when addressing Disaster Recovery, is to address technology solutions first, and in isolation. Typically, the IT team is asked, Do we have a Disaster Recovery plan? and they answer, We back up our data on a daily basis. The question to the IT folks of Do we have a plan? and the response of We back up our data is similar to asking Do we have a ride to the party? and receiving the answer of We have a spare tire. While it is an important part, it is only a part of the whole solution. As far as business is concerned, without the process and procedure necessary to restore normal operations, backups of data are rendered useless. Effective Disaster Recovery plans first address the process and procedure for running an organization, which, in turn, drives the requirements for technology solutions. Readiness Assessment Before making changes, it makes sense to have a clear understanding of what you currently have. After all, you may review the current state and find you ve been doing a good job all along and don t need to do anything different. With this in mind, the first step in creating a Disaster Recovery plan is called Readiness Assessment. The Readiness Assessment is an objective review of the business processes, operational procedures and business systems in place to make an organization run. Business Impact Analysis Business processes and systems identified in a Readiness Assessment are assigned a dollar value through a Business Impact Analysis to determine the impact to your business if they were unavailable. The table below provides a simplified example of output from a Business Impact Analysis. Gap Analysis Using information generated by a Business Impact Analysis, the gap analysis considers the current state, and identifies the weak or missing areas necessary to achieve an ideal state. The gap analysis provides crucial information needed to develop a reliable Disaster Recovery Plan. Table provides a simplified example of output from a Business Impact Analysis. System or Outage Business Financial Business Process Duration Impact Impact Human Resources Greater than Negative employee $2,000 per day 72hrs relations Order Processing Greater than 6hrs Unable to complete $15,000 per hour new orders Customer Service Greater than 4hrs Unable to communicate $25,000 per day outage to clients, lost service revenue D ISASTER R ECOVERY IN THE M ODERN M ARKET 3
Components of a Disaster Recovery Solution Business Process Re-engineering Now that you know what you have, how much it is worth, and where your weak points are, the next step in Disaster Recovery planning and preparation is to create and implement a Disaster Recovery Plan. It s important to note that effective Disaster Recovery plans are integrated into everyday business operations; they are not stand-alone measures to launch in emergency situations. A good Disaster Recovery Plan affects the design of everyday operations and vice versa. Consequently, when business processes and systems are implemented or changed, the Disaster Recovery aspects of each must be considered accordingly. This is, by far, the most difficult aspect of implementing a Disaster Recovery strategy. Not only do you have to have a game plan of how you are addressing Disaster Recovery, but you have to change the way people work, sometimes people who have operated the same way for many years with virtually no changes. Many organizations have attempted to implement Disaster Recovery procedures as an overlay to existing business process, even going as far as creating teams with the sole responsibility of inflicting Disaster Recovery on the rest of the organization. But, no matter what tact was taken, until each member of the operation understood and actively participated in the effort, successes were few and far between. The most effective way to accomplish this is by educating staff on why Disaster Recovery is important, and working through processes to ensure the Disaster Recovery components fit into the overall work environment. When an existing process is modified in this way, with staff input and buy-in, the success rate for adoption is significantly higher. In this stage of Disaster Recovery planning, it is critical to work through the Business Process Re-engineering effort. While sometimes lengthy and tedious, the end result is a much more efficient and effective solution. Business Systems and Technology Preparation In conjunction with modifying and refin - ing business processes, you also need to ensure you have the technology to support those changes. Also, as mentioned earlier, while not the sole component of Disaster Recovery, technology does play a key part. The technology aspects of Disaster Recovery planning break down into three areas: Data Backup Data Archival and Retrieval Technology Facilities Planning With Business Impact Analysis results, you will have a prioritized list of the key systems and technologies necessary for minimal operations. With this list, you can address the preparation requirements for each system or technology. The technology preparation process seems fairly simple: 1. Are you backing up your information and configurations? 2. Can you access them in an emergency? 3. Do you have a place and equipment to restore your configurations? 4 D ISASTER R ECOVERY IN THE M ODERN M ARKET
Components of a Disaster Recovery Solution However, the logistics of this component tend to be the most complex technology challenges presented to an organization. It is sometimes difficult enough to get a single system to work on it s own, and to be able to replicate the same system, under the pressure of the business being down, in a different location, can sometimes overcome even the brightest technologist. The only way to successfully overcome this technology challenge is to plan it out and test it. Each time you test your plan, lessons will be learned, plans improved, and when the time comes to execute in an emergency situation, the surprises will be minimal. Until you take your plan for a test drive, you never know if it will work when you really need it. There is also a process re-engineering component involved in technology preparation. Each technical component must be consistently backed up, backups verified, and test restorals performed on a regular basis. Incorporating Disaster Recovery processes such as this into day-today operations of the technology teams ensures, when necessary, recovery of key business systems in a timely fashion. Incident Response Planning Once business process and technology operations have proactive procedures in place to prepare for a disaster, the next component is to map out what is done in the event of a business impacting outage. Simply put, an Incident Response Plan identifies who does what, when and how, in the event of a business impacting outage. It also defines the criteria for declaring a disaster. The Incident Response Plan defines, in detail, the process and procedures to be followed in the event of an outage including: Criteria for declaring a disaster Procedures for notifying employees, clients, partners, etc. Individual responsibilities for restoring operations Where to report in the event of a disaster, and how to access critical systems An Incident Response Plan provides the game plan to be followed in the event of a business impacting outage. An effective Incident Response Plan will clearly define what is done in an outage, minimizing the amount of confusion surrounding the daunting task of restoring normal operations. Normal Operations Restoration An incident has happened, our Disaster Recovery Plan and Incident Response Plan allowed you to get back to work quickly and efficiently in a temporary work environment. Now you are ready to move back into your facility, but the key business systems are running in data centers miles away, most of the employees are reporting to other work sites, and no one knows that the primary office is back in operation. This is the reason for working through a Restoration Plan as part of the Disaster Recovery solution. Once the disaster is over, and it is time to get back to work, having a plan in place for restoring operations can be just as important as the Disaster Recovery and Incident Response Planning elements. D ISASTER R ECOVERY IN THE M ODERN M ARKET 5
Disaster Recovery Strategy Options Traditional Disaster Recovery options present individual components of an overall solution, which leaves the management and integration up to each individual client. In cases of large, wellfunded, organizations where a dedicated staff is available, this may be acceptable. However, for all but the largest business operations today, this traditional approach is not a practical solution. Both the financial overhead and logistics of managing and maintaining a traditional solution are overbearing in the majority of today s businesses. With our current awareness, it is clear that effective Disaster Recovery involves a comprehensive solution, made up of unique business processes, operational procedures, technology solutions, and response planning. As noted earlier, this is why there aren t any effective do-ityourself kits available on the Internet. This comprehensive Disaster Recovery solution is what we term modern Disaster Recovery strategy. The distinguishing aspect of the modern solution is that the strategy is approached as a managed solution, with a central point of contact for management, logistics, maintenance and review. This type of modern, managed strategy provides a more flexible solution, providing alternatives and options for all of today s business needs. 6 D ISASTER R ECOVERY IN THE M ODERN M ARKET
RGTS Disaster Recovery solutions Differentiators Like many of the traditional Disaster Recovery vendors out there, RGTS has the capability to offer traditional Disaster Recovery Services which include: Audit and Assessment Disaster Recovery Facilities In order to be effective in today s market, RGTS had developed a comprehensive solution methodology that fills in the blanks in the traditional Disaster Recovery services, while also providing the glue to tie it all together. RGTS approaches Disaster Recovery services as a comprehensive process. Each step in the process of developing and implementing a plan feeds the next. And, by carefully managing each step by a set of pre-defined industry best practices, the RGTS solution provides a more efficient and effective solution. Basically, the total is greater than the sum of the parts. The RGTS Disaster Recovery Solutions Methodology follows the steps outlined below, using detailed process, analysis and assessment templates. 1. Readiness Assessment 2. Business Impact Analysis 3. Gap Analysis 4. Disaster Recovery Planning Services 5. Business Process Re-Engineering 6. Technology Preparation 7. Disaster Recovery Plan Testing and Evaluation 8. Operational Procedure Development 9. Incident Response Services 10.Disaster Recovery Facilities 11.Operational Restoration Planning Each aspect of the RGTS Disaster Recovery Solution can stand on its own as an individual product, or serve as an integrated part of the total RGTS managed solution. The RGTS approach allows our clients to outsource part or all of their Disaster Recovery solution. This also provides the added benefit of having seasoned experts, whose primary responsibility is Disaster Recovery solutions, dedicated to developing and implementing your organization s Disaster Recovery solution. The RGTS Incident Response team will also be uniquely qualified to serve as your rapid response team in the event of a disaster. Having an experienced team of project managers, business process analysts, and a wide range of technology resources available in the event of a disaster will allow you to return to the primary focus of your business quickly, efficiently and cost-effectively. The RGTS Disaster Recovery Solution is designed to provide a flexible and practical solution to the needs of our clients. In developing the RGTS service offerings, the stated goal is to provide a cost-effective managed service, providing alternatives to the more restrictive and costly traditional models of providing Disaster Recovery Solutions. D ISASTER R ECOVERY IN THE M ODERN M ARKET 7
RGTS Comprehensive Disaster Recovery Solutions As we have discussed, there are many facets to an overall Disaster Recovery solution. RGTS is uniquely qualified to provide managed Disaster Recovery tailored to each client s needs. RGTS offers a flexible model for developing and deploying a Disaster Recovery solution, with as much or minimal input as is desired. The RGTS solution provides options for addressing each aspect of the Disaster Recovery process including: Audit and Assessment Services Planning and Preparation Services Recovery and Response Services Operations Restoration Services Testing and Review Services Each of these areas can be addressed as a component of the overall solution, taking it one piece at a time, or as a single, comprehensive effort covering all aspects of the process in a manageable time frame. A key advantage of RGTS Disaster Recovery solution is that we carefully coordinate and manage the process, whether the entire solution, or smaller components of the whole. Why a managed service? As we have noted, Disaster Recovery solutions encompass many aspects of a business operation. The process of developing a Disaster Recovery solution hits many common roadblocks in organizations including: Not enough time or resources Other high priority business issues take precedence Operational teams and business units have never worked together Organizational politics slow down the process Incomplete understanding of what Disaster Recovery encompasses Business units have different definitions of what is important A proven method of overcoming these hurdles is engaging an objective, third party to help work through operational reviews and planning, while also serving as a mediator between internal groups. Also, working with an established partner provides the additional benefit of accessing prior industry experience and best practices to guide decisions when developing a Disaster Recovery solution. Why RGTS? RGTS provides today s businesses with a flexible partner, experienced in developing and deploying Disaster Recovery solutions, working from an established assessment and planning process based on industry best practices. 8 D ISASTER R ECOVERY IN THE M ODERN M ARKET
Contact Information Rockefeller Group Technology Solutions 1221 Avenue of the Americas New York, NY 10020 (212) 282-2000 Timothy Popp Vice President of Sales tpopp@rgts.com (212) 282-2801 Jonathan Worman Director of Network Services jworman@rgts.com (212) 282-2257 Andrew Vesay Solutions Architect, Engineering and Operations Manager avesay@rgts.com (212) 282-2842 D ISASTER R ECOVERY IN THE M ODERN M ARKET 9
TM Rockefeller Group Technology Solutions NEW YORK HEADQUARTERS 1221 Avenue of the Americas New York, NY 10020-1095 Tel: 212-282-2200 www.rgts.com