Business Continuity Program Disaster Recovery Program Update

1
Business Continuity Program/Disaster Recovery
Program Update

• Statewide BCP Project
• SDC Disaster Recovery Plan Service Contract
  Project
• eBRP Project

Contributors CNIC BCP Team
CNIC Disaster Recovery Task Force State
Data Center
February 2007
2
Background Multiple Projects within a BCP/DR
Program
3
Background - Projects

• 1) Statewide BCP Initiative
• This initiative was launched in March 2006 with
  the implementation of the Statewide BCP Policy.
  It is managed by the DAS Enterprise BCP office
  and provides guidelines and direction for State
  agencies in their plan development.
• 2) eBRP Toolkit Project
• In Fall 2006, the eBRP Toolkit was selected for
  the storage and publication of BCP and DR plans
  for state agencies. This project manages Phase 1
  of the implementation, training and utilization
  of the toolkit by 12 state agencies. Subsequent
  phases will include the inclusion of additional
  agencies and testing.
• 3) BCP Tabletop Test Project
• At the conclusion of the eBRP Toolkit Project,
  this project will manage BCP tabletop tests for
  12 state agencies.

4
Background - Projects

• 4) SDC Recovery Service Contract Project
• This project establishes a disaster recovery
  service contract for applications and systems
  hosted at the SDC.
• 5) SDC/Agency DR Test Project
• This project executes disaster recovery tests per
  the DR awarded service contract for systems
  hosted at the SDC.
• 6) Agency DR Test Projects
• This project executes disaster recovery tests per
  the DR awarded service contract for agency
  systems.
• 7) Ongoing BCP/DR Plan Maintenance
• Business Continuity Plans and Disaster Recovery
  Plans will be maintained and routinely tested by
  each agency through their established
  maintenance programs.

5

• Statewide BCP Initiative

6
Statewide BCP Initiative Objectives

• Designation of BCP Coordinators and Sponsors.
• Identification of critical business functions.
• Developed, tested, and maintained BCP.
• Complete DR plans for the IT infrastructure that
  support the critical business functions.
• Implementation of BCP maintenance programs.
• Established awareness and training programs to
  create organizational awareness.

7
Ultimate Goal

• All Agencies will have developed, maintained, and
  tested plans by June 2009 to restore and recover
  their business operations in the event of a
  disaster.

8
Phased Approached Proposed Planning Goals

• The Enterprise BCP Office has recommended that
  agencies develop their BCP utilizing a phased
  approach
• This will focus agencies to work on those most
  critical business functions
• Four Phases are recommended
• Phase 1 CBF that must be restored within 2 days
• Phase 2 CBF that must be restored within 1 week
• Phase 3 CBF that must be restored within 2
  weeks
• Phase 4 CBF that must be restored within 1
  month

9
Statewide BCP Initiative Tracking the Progress

• The Enterprise BCP Program will use a Scorecard
  to track the progress of the implementation of
  the Statewide BCP Policy.
• The Scorecard will use the standard Green
  Yellow Red Status indicators
• Agencies that have met the planning goals will
  receive a GREEN Status
• those that have partially met the goals will
  receive a YELLOW status and
• those who have not met the goal in any form will
  receive a RED Status.

10
Statewide BCP Initiative The Scorecard
11

• SDC Disaster Recovery Plan Service Contract
  Project

12
SDC Disaster Recovery Plan Contract Project
Overview

• The CNIC CIOs formed a CNIC Disaster Recovery
  taskforce to examine and propose DR solutions for
  systems and services managed by the State Data
  Center.
• The current Sungard DR service contract was
  extended through October 2007, while requirements
  for a new RFP and service contract can be
  gathered and awarded.

13
SDC Disaster Recovery Plan Contract Project
Objectives

• Gather requirements for critical business
  functions and applications supported by SDC
  managed systems.
• Issue an RFP for recovery service contract
  pricing.
• Analyze pricing and select recovery options and a
  recovery vendor.
• Issue a recovery service contract that
• will be executed with the SDC for SDC managed
  systems and services
• may be executed by CNIC agencies for out-of-scope
  systems and services
• The DR component of this project will be tracked
  and managed by the use of a Scorecard which
  includes the DR tasks and milestones.
• IT data gathered to support the acquisition of
  the DR service contract will be used to load SDC
  and Agency instances of eBRP.

14
Recovery Time Objective (RTO)
SDC Disaster Recovery
The Recovery Time Objective (RTO) is the least
amount of time required by a business function
and/or application to recover critical services,
measured from time of disruption to resumption of
critical business operations. As a part of the
BIA, SunGard classified the RTOs for the critical
functions identified by the State of Oregon
agencies. The graph below denotes the number of
functions that have an RTO of less than 1 day
(blue) and between 1-2 days (burgundy).
14
15
SDC Disaster Recovery
Recovery Point Objective (RPO)
Data
The Recovery Point Objective (RPO) is the amount
of data that each business function is willing to
lose if a disruption occurs. As a part of the
BIA, SunGard classified the RPOs for the critical
functions identified by the State of Oregon
agencies. The graph below denotes the number of
functions that have an RPO of less than 1 day
(blue) and between 1-2 days (burgundy).
15
16

SDC Disaster Recovery

16
17
SDC Disaster Recovery Plan Service Project
Scorecard
Note The scorecard reflects phases for a) DR
Plan Development, b) DR RFP and Service Contract,
and c) Subsequent DR Planning and Tests.
18
How Much of a Robust DR Capability is Needed?
When compared against Agencys consensus on
existing risk..
Recovery Windows
Recovery Point
Recovery Time
18
19

• eBRP Toolkit Project

20
eBRP Toolkit Project Overview

• This project supports the Statewide BCP Policy
  by implementing the eBRP Toolkit software within
  the 12 CNIC agencies.
• The eBRP Toolkit bridges the gap between business
  and IT. This project encompasses two distinctive
  components, the development and maintenance of
  agency BCP and DR plans.
• The software will allow state agencies to manage
  business continuity planning (BCP) and disaster
  recovery (DR) planning. The resulting plans
  published through the software will be used
  during an event to manage recovery strategies.
• All 12 Agencies are expected to support and
  maintain the eBRP Toolkit by dedicating the
  resources necessary for the development of their
  business continuity plans and disaster recovery
  data within the tool. The implementation team
  consists of a minimum of a BCP and DR
  administrator from each agency.

21
eBRP Toolkit Project Objectives

• Implementation of toolkit to the 12 CNIC
  agencies.
• Build disaster recovery strategies and plans that
  are aligned with critical business functions and
  support agency business continuity plan
  development.
• Data will be loaded and maintained by each of the
  agencies into their own eBRP instance, using data
  entry and toolkit import processes.
• Each agency will determine the extent of data
  loaded based on their individual BCP
  requirements.
• The 12 CNIC agencies will participate in the
  development and use of common terms and codes to
  support the long term goals of the statewide BCP
  initiative.

22
eBRP Toolkit Project Bridging the Gap
23
eBRP Toolkit Project Logistics

• All location data must be entered.
• All technology data must be entered.
• To populate the other sections of the Toolkit,
  each Agency will use their top 6 Critical
  Business Functions (CBF).
• New milestones have been established.
• To successfully meet the new milestones
  identified on the WBS, the complete location and
  technology data must be entered into the Toolkit
  as well as the information pertaining to the 6
  CBFs.
• If an Agency has less than 6 CBF they will be
  required to input the data of those CBF they have
  identified.

24
eBRP Toolkit Project - WBS
25
eBRP Project - Project Support Toolkit Training

• Basic Training 1 September 2006 (Plan
  Development)
• Basic Training 2 November 2006 (Basic Entry
  Organization Data)
• IT Training January 17th 18th 2007
• Basic Training 3 TBD 2007 (Process
  Development)
• Toolkit Assistance for individual help, the
  Enterprise BCP Office, Enterprise Application
  Services (EAS), and the SDC are available to
  assist BCP and DR Administrators as needed. Call
  the Enterprise BCP Office to request help
  503-373-1067.