Best Practices And Trends In Business Continuity Planning -PPT

Best Practices and Trends in Business Continuity Planning Simon Mingay Notes accompany this presentation. Please select Notes Page view. These materials can be reproduced only with Gartner’s official approval. Such approvals may be requested via e-mail -quote.requests@gartner.com. Real-Time Enterprise and BCP — A Collision Course Business Is Moving Faster Than Ever Before: • Real-time interenterprise business process integration • Significant reliance on partners in the value chain • Faster flow and immediate responses expected • You are only as strong as the weakest link Yet, less than 25 percent of Global 2000 enterprises have invested in comprehensive business continuity planning; only 50 percent have fully tested disaster recovery plans. Copyright © 2003 BC Components Business Business Recovery Resumption Mission-critical Business business process Objective processing workarounds (workspace) Application Site or component Site outage Focus outage outage (external) (external) (internal) Disaster Business Alternate Deliverable recovery plan recovery plan processing plan Disaster Recovery Mission-critical applications Contingency Planning External event External behavior forcing change to internal Business contingency plan Sample Event(s) Sample Solution Fire at the data center; critical server failure Recovery site in a different location Electrical outage in the building Recovery site in a different power grid Credit authorization system down Manual procedure Main supplier cannot ship due to its own problem 25 percent backup of vital products; backup supplier Copyright © 2003 Crisis Management Evolution of BC Sept. 11 Forever Changed Business Continuity Planning Disaster Recovery RTO = Three Days Scenarios Limited Y2K and BPR + Contingency Planning RTO = < 24 hours Aftermath of Sept. 11 + Crisis Management + New Scenarios Business Recovery for critical work processes Internet and BPR RTO/RPO ~ 0 + New Scenarios 1990 1995 2000 2002 Copyright © 2003 Sept. 11 Raises the Bar for BCP • People vs. asset centricity/protection – Resilience in people/processes – Resilience in workspace – Resilience in safety and communications • New planning scenarios — loss of life, lack of decision makers, interruption of transportation, building evacuation, loss of physical assets and workspace, lack of communications, crisis command center site unavailable, terrorism, bioterrorism and such • Capacity management — technology and people • Contingency planning — mitigate risks of external events Copyright © 2003 BC in the Real-Time Enterprise: More Risks, More Collaboration Performance/Capacity Rolling Disaster/ Multiple Failure Points Human Error/ Operations Risk Outsourced Service Providers Planned/Unplanned Downtime Security Incidents Content/Application Links to Third Parties Copyright © 2003 Creating Business Continuity Plans Process Change Management Education Testing Group Plans and Procedures Testing Review Ongoing Process Risk Reduction Implement Standby Facilities Create Planning Organization Recovery Strategy Risk Analysis Business Impact Analysis Policy Organization Project Resources Scope Business Continuity Planning Initiation Copyright © 2003 What Is Your Cost of Downtime? Productivity • Number of employees affected x hours out x burdened hourly rate Revenue • Direct loss • Compensatory payments • Lost future revenue • Billing losses • Investment losses Financial Performance Damaged Reputation • Customers • Revenue recognition • Suppliers • Cash flow • Financial markets • Lost discounts (A/P) • Banks • Payment guarantees Know your downtime • Business partners • Credit rating costs per hour, • ... • Stock price day, two days ... Other Expenses Temporary employees, equipment rental, overtime costs, extra shipping costs, travel expenses, legal obligations ... Copyright © 2003 Too Much Testing and Reporting Is Never Enough There Is No Such Thing as a Failed Test Plan Tested (+One Year) Plan Tested (One Year) 25% 50% 25% Management Reporting Is Critical BCP Phase Impact Analysis Risk Analysis Strategy Resources Committed Last Tested Change Mgmt. Last Major Review Plan Tested (70 days Audit/BCP Assessment Action: Confirmed RTO Requirements (BIA), Assessed Data Center and Recovery Strategies; Chose to Insource and leverage development/test for recovery; Result: met 24-hour RTO goal Copyright © 2003 What to Focus on When BC Funds Are Limited • Crisis management plan — ensuring the safety of employees, continuity of decision making, and view from outside world. Includes employee call-tree and facilities diagrams • Asset list and key supplier contact information • Secure, offsite backup tape storage • Prioritize spending on most critical business processes — perform a BIA to determine priorities • Work-at-home programs for workspace recovery • Contingency planning — mitigate the risks of external events Copyright © 2003 Classifying Business Process Service Levels in Project Life Cycle Class Business Process Services Service Levels Class 1 (RTE) • Customer-/Partner-Facing • Functions Critical to Revenue Production • Less-Critical RevenueProducing Functions • Supply Chain • Enterprise Back-Office Functions • 24x7 scheduled • 99.9% availability (<45 min./month) • RTO = two hrs.; RPO = zero hrs. • 24x6-3/4 scheduled • 99.5% availability (<3.5 hrs./mo.) • RTO = 8-24 hrs.; RPO = four hrs. • 18x7 scheduled Class 2 Class 3 • 99% availability (<5.5 hrs./month) • RTO = three days; RPO = one day • 24x6-1/2 scheduled • 98% availability (<13.5 hrs./month) • RTO = five days; RPO = one day Copyright © 2003 Class 4 • Departmental Functions Technologies to Reduce RTO/RPO Assumes mirroring or shadowing plus Hot Standby or a complete application environment Load-Balanced Database and/or file and/or object replication Mirroring Log/journal transfer (continuous or periodic) net $$$+ Shadowing host $$$+ Cost Database and/or file disk $$$$+ and/or object backup Electronic app. $+ Elec. Journaling Standard Vaulting net $-$$+ net $$$+ Recovery net $ host $$+ host $$+ host $ net $ disk $$$$+ disk $$$$+ disk $ tape $ tape $ 72 48 24 hours hours hours 12 hours Disaster Recovery Time minutes Copyright © 2003 Emerging Technologies • Wide-area clusters for automated recovery  HP Continental Clusters.  IBM Geographically Dispersed Parallel Sysplex. • Stretching local clusters across a campus to increase ROI. ü HP MC/ServiceGuard, IBM HACMP, Microsoft Clustering, SunCluster, Veritas Cluster Server. • Capacity on demand/emergency backup for in-house recovery. Becoming mainstream on S/390 and z Series mainframes. • Server disk imaging/archiving of OS and/or applications for rapid system recovery. Copyright © 2003 DR Strategies: Where Do Outsourcers Fit? Class 1 (RTO & RPO ~ 0) • Two sites within ~ 20 km • Hot standby (dedicated); insourced or outsourced facilities • Mirrored data • Shadowed data • In-house or outsourced • Standard recovery from tape • Outsourced usually more cost effective (hot site or mobile) • Quick ship program most cost-effective • Standard recovery from tape Copyright © 2003 Class 2 (RTO = 8–24 hours RPO = 4 hours) Class 3 (RTO = 72 hours RPO = 24 hours) Class 4 (RTO = 4–5 days RPO = 24 hours) Reciprocal Agreements — Look Before You Leap $ $ Shared Resource ABC Inc. XYZ Inc. Drivers •Cost •Guarantees •Capacity •Location Risks • • • • Diverging needs Change Short- vs. long-term Financial Best Practices •Use dedicated facility •Use third party to operate •Low change, generic requirements •Open-book risk •Define exit strategies •Concurrent occupation Copyright © 2003 Negotiating the Hot-Site Contract Do’s • Three-year deals • Exit strategy – Termination clauses – Buyout schedule • Break costs in schedules • Re-compete • Agree to the costs of extra test time • Aligned termination dates • Determine support required to reattain normal operation • Have test scheduling worked out • Negotiate support required during exit • Negotiate non-hot-site equipment allowed into the cold site Don'ts • Just throw in the DASD — it can be a major cost item • Have blanket coverage for everything • Have automatic renewal • Agree to contract extensions • Just accept declaration fees and day rates • Automatically renew • Accept less test time than required, but don’t demand more than needed • Accept discounts on the price list — there isn’t one Copyright © 2003 The BC Management Maturity Model Scope and Sophistication of BCM Capabilities Nonexistent Repeatable Optimized Managed Defined Initial 0 1 2 3 Maturity Level/Time • • • • • • • • • • 4 5 Assessment Elements: • Awareness • Board and Executive-Level Sponsorship • Organization and Governance • Roles and Responsibilities • People • Budget/Spending • Goals and Rewards • Policy • Process Excellence (e.g., BIA, Risk Assessment) Strategy and Plans Reporting Tools IT Applications and Systems Information and Data Protection Project Life Cycle Testing ESPs Enterprise Risk Management Cross-Enterprise BCM Copyright © 2003 Recommendations: Effective BC Is Built Into an Enterprise’s Culture • Don’t forget Sept. 11 or the myriad of more-common threats to your business; don’t lapse into complacency. Invest in business continuity planning NOW. • Build BC into enterprise culture by creating/refining processes for crisis management, contingency planning, project life cycle, asset documentation (for example, people, technology and facilities). • Establish a service-level classification scheme for availability and BC — and define standard, repeatable development, infrastructure and operations architectures to meet them. • Test, Test, Test. If comprehensive testing is not practical, perform walk-through testing and ensure that external dependencies are addressed. Copyright © 2003