White paper Disaster Plaig A dime to prepare versus a dollar for repair I corporatios worldwide, C Level Executives are frettig over oe questio: Are we i a positio to restore our busiess quickly i case there is disaster i our IT operatios? Disaster Plaig provides oly a partial aswer to this critical questio. O a broader cavass, though, it is a ackowledged fact that idetifyig ad correctig defects i later stages of the Software Developmet Life Cycle (SDLC) is te times costlier tha the earlier stages such as aalysis ad desig. So we eed to look farther to determie what eeds to be doe by corporatios to esure that their busiess operatios are ot disrupted whe, ot if, disaster strikes their IT assets. This paper discusses the key justificatio for the IT orgaizatios to have a pro-active disaster recovery pla i the first place ad the eed for disaster recovery preparedess i order to avoid the heavy re-active spedig for restorig / resumig the busiess processes post disaster occurrece.
About the Author K. Vaidyaatha K. Vaidyaatha is a IT ifrastructure cosultat ad part of TCS Global Cosultig Practice - Ifrastructure Solutios uit. He has 14 years of experiece i the IT services ad has delivered successful cosultig egagemets to customers i various idustries such as bakig, isurace, telecom & retail, coverig a wide rage of areas such as maiframe optimizatio, maiframe cosolidatio, maiframe exit, maiframe capacity upgrade, maiframe capacity plaig, IT Disaster Strategy & IT Disaster plaig. He holds a Master of Computer Applicatios degree from BMS College of Egieerig, Bagalore Uiversity. 2
Table of Cotets 1 Itroductio 2. What is a Disaster Pla? 3. Why such a pla is critical? 4. Disaster Challege 4 4 4 4 5. Essetial Buildig Blocks of Disaster Plaig 6. Disaster Maagemet Life Cycle Stages 5 7 7. TCS Comprehesive Approach to Disaster Plaig 9 8. TCS Framework for Disaster Eco-System 9 9. Global Techology Treds for Disaster 10 10. Best Practices of Disaster Pla 11 11. Way Forward 11 3
Itroductio Disaster i the IT eviromet refers to ay icidet which causes a uplaed outage or disruptio to the busiess operatios ad supportig IT systems. Disaster ca be caused due to atural calamity, catastrophic failures ad / or huma errors. Busiess Cotiuity Plaig is a process of preparig the orgaizatio to restore ad resume the busiess operatios durig a outage, which icludes the key elemets such as busiess office locatios, people, iformatio techology ifrastructure, IT applicatios, data ad busiess processes. Disaster plaig is a subset of Busiess Cotiuity Plaig. The objective of Disaster is to recover / restore the IT assets like ifrastructure, busiess applicatios, busiess data ad the supportig IT facilities from the potetial disaster evets based o their pre-defied recovery priorities. What is a Disaster Pla? EA Disaster pla usually cotais the procedures, steps, people roles, resposibilities, escalatio procedures, automatio processes, applicatios, data, IT devices ad recovery priorities that are ecessary to restore the damaged missio critical IT systems ad the peripheral IT ifrastructure to resume busiess operatios post uplaed outage. Why such a pla is critical? Disaster occurreces are upredictable ad the fiacial impact to the busiess will vary i magitude. The disaster ca cause direct reveue loss ad loss of idirect factors such as productivity loss / loss of customer cofidece / impact o brad equity to the busiess orgaizatio. So it is essetial for eterprises to have a Disaster Pla i place at all times. Disaster Challege While it is clear to CxOs that a Disaster Pla is essetial, the most critical challege i desigig a disaster recovery strategy for a eterprise is to determie the itagible impactig factors to the busiess, ad to come up with the estimated view of the impact itesity for uplaed applicatio / IT compoet dowtime. Determiig the appropriate busiess value for a give applicatio is the key for arrivig at priorities for recovery ad restoratio i the evet of potetial uplaed outage evets. There is o covicig fiacial busiess case i ivestig heavily o settig up a disaster recovery IT ifrastructure setup ad recovery / restoratio procedures for the applicatio compoets which has a lesser busiess impact. But at the same time eterprises eed to maitai a balace i addressig the major challege, i.e., derivig the reveue loss impact versus the moey spet o havig to setup the disaster recovery solutio capabilities. 4
Essetial Buildig Blocks of Disaster Plaig The essetial elemets for the disaster recovery plaig are illustrated i the followig diagram: 1 Busiess Impact Aalysis Threat Assessmet Vulerability Assessmet IT systems Criticality ad Priority Estimated Reveue Loss due to dowtime of IT systems Exteral Threats, Likelihood occurrece, Magitude or degree of Threat impact Iteral Vulerabilities, Likelihood occurrece, Magitude or degree of impact due to vulerability Time Objective Poit Objective 2 Estimated/ Justified DR cost ivestmet Disaster Requiremets Chage Drivers Guidig Priciples Eterprise Stadards ad Treds 3 Disaster Pla DR Referece Architecture Carry out a detailed Busiess Impact Aalysis (BIA) for the IT compoets such as applicatios, IT ifrastructure compoets ad idetify the busiess value, reveue loss to the orgaizatio due to the occurrece of disruptio scearios. This will eable to defie recovery priorities for the various IT aspects such as applicatio systems & ifrastructure (say, hardware server, etwork commuicatio, storage box) of a orgaizatio. It is very importat to ote that the busiess team plays a very crucial role i providig busiess impact iputs as compared to the IT divisio staff. Where Reveue Loss (Moetary Value) Cost = P (DR Evet Occurrece) X M X T Prefers to the probability of disaster evet occurrece M refers to the moetary reveue loss value that will be icurred due to the dowtime of IT system per miute or per hour or per day T refers to the time (say, umber of miutes / hours / days) that the core IT systems that are estimated to be dow due to disaster evet occurrece. (Note: Assessig the itagible impact factor such as loss of customer cofidece; brad loyalty degradatio etc. due to dowtime of IT systems supportig key busiess process executio is a challege). 5
Carry out a detailed Threat assessmet such as idetificatio of exteral threats (say, fire, flood, earth quake, power shutdow etc.), categories, probability / likelihood of threat occurrece situatios, ratig / rakig of threats ad the correspodig mitigatio / cotigecy actio plas & steps. Carry out a detailed Vulerability assessmet (say, exceptio hadlig i applicatio, hardware / software chage triggerig failure i applicatios ad hardware etc.) such as idetificatio of iteral threats, categories, probability of vulerability exposures ad the correspodig mitigatio / cotigecy actio plas & steps. Arrive at Time Objective (RTO) for the IT compoets / system elemets based o their pre-defied recovery priorities. The recovery time objective (RTO) value is the legth of time i which a specific busiess fuctio / service to be available back followed by a disruptio to busiess due to potetial disaster. Arrive at Poit Objective (RPO) for the busiess applicatios based o their predefied recovery priorities ad estimated reveue loss due to potetial disaster. The recovery poit objective (RPO) value refers to the acceptable amout of potetial loss for the busiess data ad busiess trasactio operatios i terms of time that a orgaizatio ca tolerate prior to a potetial disaster occurrece. Reveue loss to the orgaizatio due to uplaed outage of IT systems over loger duratio is a icreasig fuctio ad the cost for settig up DR solutios with varyig degree of recovery capabilities is a decreasig fuctio. Reveue Loss Due to outage Rough Estimate of likely DR ivestmets Cost Cost to Restore/ Recover Core Systems Time Select the appropriate disaster recovery capability levels (level 1 to level 7) for aligig the solutio for meetig the agreed upo Time Objective (RTO) ad Poit Objective (RPO) for the IT applicatio systems of a orgaizatio as per the recovery priorities 6
The defiitio ad the correspodig solutio descriptio for the 7 levels of disaster recovery are illustrated i the followig diagram. Level 7 - Disk Mirrorig, 100% automated procedures for take over from failure ode/site with zero loss for the busiess data Level 6 - Disk Mirrorig, Data Replicatio to preserve Data itegrity ad data cosistecy Cost Remote Site (Hot Site) Parallel Secodary Site Active Poit i Time Tape Backup Solutios Level 5 - Applicatio ad Data Redudacy maitaied with trasactio itegrity, Multiple PIT copies with egligible loss i busiess data Level 4 - Data Shadowig, Overlapped Poit i Time Backup Copies Level 3 - Vault (electroic) Level 2 - Trasport to Offsite Level 1 - Trasport to Offsite 1-30 miutes 31-60 miutes 1-6 hours 7-12 hours 13-18 hours Time to Recover 19-24 hours Days Weeks Derive busiess chage drivers ad guidig priciples i aligmet with the disaster recovery requiremets for the IT systems of a orgaizatio Arrive at disaster recovery pla for the IT systems by aligig the solutio architecture with the eterprise Disaster Referece Architecture framework, eterprise stadards, guidig priciples, time objectives ad poit objectives Disaster Maagemet Life Cycle Stages The followig diagram illustrates the Disaster Maagemet life cycle stages: Life Cycle Aalyze Busiess Impact, Threats, Vulerabilities, DR Requiremets, DR Ivestmets DR Improve Implemet improvemet measures ad ehace DR solutio capabilities o a cotiues basis Disaster Maagemet Defie Priorities, RTO, RPO, DR Strategy, Solutio, Pla Verify Test & Verify DR Solutio & Idetify Improvemet opportuities Deploy DR Solutio Capabilities 7
The key activities i the life disaster recovery maagemet life cycle stages are described below: From the life cycle stages of disaster recovery maagemet, it is clearly evidet that the Plaed testig exercise (DR Drills) with a pre defied frequecy is absolutely ecessary to uderstad the process gaps, bottleecks / drawbacks i the DR solutio agaist the predefied RTO & RPO i order to idetify the improvemet measures Implemet the ehacemet measures ito the DR pla to make it more robust ad achieve fit for purpose state ad this is goig to be a cotiuous process ad treated to be a key stage i the disaster recovery life cycle 8
TCS Comprehesive Approach to Disaster Plaig The essetial steps ivolved i TCS approach for arrivig at the target disaster recovery pla are illustrated i the flowchart below: Busiess Impact Aalysis Aalyze Fiacial Impact for dowtime of busiess ad correspodig applicatios Arrive at Criticality order of busiess applicatios Defie Priorities for busiess applicatio recovery Defie recovery Priorities for busiess applicatio Start Threat & Vulerability Idetify Potetial Threat & Vulerability Scearios Evaluate the likelihood of Various Threat/ Vulerability Occureces Come up with Cotigecy actios for potetial threat sceario occurreces Evaluate Disaster Solutios Select the most appropriate solutio for DR Idetify & Evaluate Restoratio Strategies Test the DR Processes ad Procedures ad idetify vulerabilities Coduct plaed DR drills ad idetify the gaps Prioritizatio Idetify Drivers Arrive At Guidig Priciples Defie Disaster (DR) Strategy Plaig Mitigatio Actios Defie Target Restoratio Strategy Arrive at cost for buildig the Target DR Solutio Implemetatio Improve the DR processes & procedures ad esure robustess Ed Defie Target Architecture for DR Idetity Various Disaster (DR) Solutios Build the target DR Pla, Processes, Steps, Sites, IT Ifrastructure compoets, DR Solutio Architecture There is o solutio which will match oe size fits all case i the Disaster cotext, from the ivestmet stadpoit. TCS follows a customized ad cotextual based approach for arrivig at the most appropriate solutio for addressig the customer eeds. TCS Framework for Disaster Eco-System TCS has developed a robust framework which eables the customers to achieve their objectives with respect to Disaster plaig ad disaster recovery solutio deploymet. This framework serves as a goverig guidelie to the disaster recovery practitioer i arrivig at specific target solutio for addressig the RTO & RPO goals ad the disaster recovery requiremets of customers. 9
The followig diagram illustrates the TCS framework for disaster recovery eco-system: Eablers Systems & Processes Core Elemets Techology System S/W Others Eablers Iputs Executive Sposorship Requiremets Threats Vulerability TCO/IT Budget Cotracts/ SLAs Policies/ Stadards Guidig Priciples Sychroizatio, Replicatio, Backup Data Sychroizatio Data Replicatio Data Backup Disaster Architecture Desig Backlogged Busiess Trasactios Recociliatio Procedures Buildig Blocks Busiess Impact Threat Aalysis Vulerability Aalysis RTO & RPO Value Priority Busiess Processes Core Busiess Processes Back office busiess Operatios Maual Busiess Trasactios Applicatio Systems Core Applicatios Applicatio Architecture Techical & Iterface Architecture Service Mgmt. Helpdesk Maaged Services Icidet Mgmt. Operatig System Database Moitorig Tools Hardware Servers Storage devices Priters & peripherals Switches Routers Data Ceter HVAC UPS Devices Power Supply Site Map & Pla Coectivity Blueprit Itagible Factors Market Share Productivity Brad Equity Competitive Advatage Itellectual Properties Stakeholders Customers Parters Ivestors Maagemet Vital Records Legal Records Busiess Reports Ivestors Maagemet Security Physical Network Firewall Iformatio Crisis Mgmt. Team Escalatio Traiig Availability Mgmt. Redudat Desig Fail Over Capabilities Support Redudat Power Supply Dual Stadby UPS Iputs Busiess Tech Mappig Architecture Requiremets Fuctioal Criticality Busiess Impact Dowtime Costs RTO & RPO Customer Demads Mgmt Strategic Pla Global Techology Treds for Disaster The recet emergig treds i the disaster recovery area are as follows: This is the decade i which the disaster recovery services will move towards the cloud parters for the small ad medium busiess orgaizatios. Movig towards cloud computig is reported to be cheaper compared to the cost i maitaiig the i-house DR solutio ad service capabilities. Eterprises have started limitig the umber of service & product solutio vedors / suppliers i formulatig, desigig ad buildig the DR solutio capabilities ad processes. This is to avoid or reduce the potetial vedor iterdepedecy support risks Eterprises are more iclied for leveragig virtual ifrastructure techology compoets ad buildig recovery procedure automatio for the disaster recovery purposes to esure reducig the legthy recovery time. Reductio i the recovery poit objective is a obvious requiremet sice the tolerace level for the busiess data loss ad trasactios seem to be dimiishig for the ed users ad this has triggered breakthrough improvemets ad ehacemets i the data replicatio ad disk mirrorig techology products i the recet past. May eterprises have started outsourcig Disaster maaged services to the well kow service providers. Outsourcig players are expected to be resposible for meetig the capacity, availability ad recovery requiremets of the eterprises. 10
Best Practices of Disaster Pla The best practices with respect to disaster recovery pla for the eterprises are as follows: Create maagemet awareess campaigs to obtai buy-i from seior maagemet for buildig a disaster recovery pla Iclude people ad create a cross fuctioal team with subject matter experts from differet groups such as applicatio busiess aalysts, developers, system programmers, etwork specialists, ifrastructure specialists, database admiistrators ad data recovery specialists etc Prepare comprehesive ivetory of IT compoets ad documetatio of the disaster recovery pla which also icludes people roles, actio sequeces, resposibilities, orgaizatio structure, goverace structure ad escalatio procedures Develop key performace idicators ad the mechaism to capture the metrics i order to measure the success of disaster recovery pla ad processes Develop robust verificatio mechaism ad criteria for the disaster recovery pla Test ad verify the implemetatio of disaster recovery pla ad processes to idetify the process gaps ad provide improvemet measures Coduct periodic audits o the Disaster facilities ad processes ad determie the opportuities for improvemets i lie with RTO ad RPO of the eterprise Prepare the traiig artifacts for disaster recovery ad impart traiig for the cross-fuctioal disaster recovery team Documet the challeges ad solutio workaroud resolutios adopted to fix the issues durig the plaed disaster recovery exercises Way Forward The executive sposors for disaster recovery plaig iitiatives ow believe that the quatum of spedig is sigificatly less i the pro-active preparedess tha whe the eterprise eeds to repair its IT assets i a outage. Global idustry treds idicate that there is a margial icreased share i the overall IT budgets for sustaiig ad ehacig the existig the disaster recovery solutio capabilities & processes for addressig the aticipated disaster scearios ad also for adherig to the regulatory requiremets. This really provides the potetial ed-to-ed opportuities for the key IT service players to leverage ad gai competitive advatages for comig up with strategic disaster recovery plaig solutio offerigs for the customers across the globe. We, at TCS, have the frameworks ad the solutios to esure that ay pro-active actio by eterprises for Disaster pays rich divideds i terms of moey saved ad brad reputatio ehaced i the log-term. 11
About TCS Global Cosultig Practice TCS Global Cosultig Practice (GCP) is a key compoet i how TCS delivers additioal value to cliets. Usig our collective idustry isight, techology expertise, ad cosultig kow-how, we parter with eterprises worldwide to deliver itegrated ed-to-ed IT eabled busiess trasformatio services. By tappig our worldwide pool of resources - osite, offshore ad earshore, our high caliber cosultats leverage solutio accelerators ad practice capabilities, balaced with our kowledge of local market demads, to eable eterprises to effectively meet their busiess goals. GCP spearheads TCS' cosultig capacity with cosultats located i North America, UK, Europe, Asia Pacific, Idia, Ibero-America ad Australia. Cotact For more iformatio about TCS cosultig services, cotact global.cosultig@tcs.com or visit www.tcs.com/cosultig Subscribe to TCS White Papers TCS.com RSS: http://www.tcs.com/rss_feeds/pages/feed.aspx?f=w Feedburer: http://feeds2.feedburer.com/tcswhitepapers About Tata Cosultacy Services (TCS) Tata Cosultacy Services is a IT services, cosultig ad busiess solutios orgaizatio that delivers real results to global busiess, esurig a level of certaity o other firm ca match. TCS offers a cosultig-led, itegrated portfolio of IT ad IT-eabled, ifrastructure, egieerig ad assurace services. This is delivered through its uique Global Network Delivery ModelTM, recogized as the bechmark of excellece i software developmet. A part of the Tata Group, Idia s largest idustrial coglomerate, TCS has a global footprit ad is listed o the Natioal Stock Exchage ad Bombay Stock Exchage i Idia. For more iformatio, visit us at www.tcs.com IT Services Busiess Solutios Outsourcig All cotet / iformatio preset here is the exclusive property of Tata Cosultacy Services Limited (TCS). The cotet / iformatio cotaied here is correct at the time of publishig. No material from here may be copied, modified, reproduced, republished, uploaded, trasmitted, posted or distributed i ay form without prior writte permissio from TCS. Uauthorized use of the cotet / iformatio appearig here may violate copyright, trademark ad other applicable laws, ad could result i crimial or civil pealties. Copyright 2011 Tata Cosultacy Services Limited TCS Desig Services M 0311