---

---

 

Disaster Recovery Planning is Key to Business Continuity

ISO 27000, SOX, PCI-DSS & HIPAA Compliant

The Standard for Business Continuity and Disaster Planning

    

Janco's Disaster Recovery Planning (DRP) Template can be used for any size of enterprise. The Disaster Recovery template and supporting material have been updated to be Sarbanes-Oxley and HIPAA compliant. The Disaster Planning Template comes as both a Word document and a static fully indexed PDF document and includes:

• Disaster Recovery Planning and Business Continuity Planning Template,
• Business and IT Impact Analysis Questionnaire,
• Work Plan,
• Disaster Recovery / Business Continuity Audit Program, and
• Pandemic Planning Checklist.

Preparation for Disaster Recovery / Business Continuity in light of SOX has two primary parts. The first is putting systems in place to completely protect all financial and other data required to meet the reporting regulations and to archive the data to meet future requests for clarification of those reports. The second is to clearly and expressly document all these procedures so that in the event of a SOX audit, the auditors clearly see that the DRP exists and will appropriately protect the data.

New are (Version History):

• Backup & Backup Retention Policy,
• Disaster Recovery Audit Program,
• Compliance with the ISO 27000 Series Standards (formerly ISO 17799 now ISO 27001 & ISO 27002), Sarbanes-Oxley, PCI-DSS, and HIPAA,
• Web Site Disaster Recovery Planning Form,
• Project Status Report Form,
• Personnel Location Report,
• Department Disaster Recovery Activation Workbook,
  • Quick Reference Guide,
  • Team Alert List (Form),
  • DRP Team Responsibilities,
  • DRP Team Checklist,
  • Critical Function(s) Definition,
  • Normal Business Hour Response Procedures,
  • After Hours Response Procedures,
  • DRP Location(s) Definition,
  • DRP Recovery Procedures,
  • Notification Procedures,
  • Notification Call List (Form),
• Updated Business and IT Impact Analysis Questionnaire,
• Vendor Disaster Recovery Questionnaire,
• Vendor Phone List Form Updated,
• Key Customer Notification Form,
• Critical Resources to be Retrieved Form,
• Business Continuity Off-Site Materials Form, and
• Business Continuity Audit Program,

The premium edition contains full job descriptions. They are:

 

 

 

 

---

 

DRP / BCP News

---

Expensive weather and climate disasters in the United States

February 2nd, 2012

Disaster Recovery and Business Continuity plans need to consider natural weather and events. The effects that natural events have on the environment directly and indirectly may be harmful to people. Forest fires and volcanoes harm air quality. Hurricanes and floods can contaminate water supplies and damage wastewater facilities. Any of these can spread contaminated materials into the environment.

The United States set a record with 12 separate billion-dollar weather/climate disasters in 2011, with an aggregate damage total of approximately $52 billion, according to the National Oceanic and Atmospheric Administration. That is just continuing the trend of the past 30 years.

These incidents have prompted many organizations to reconsider the human element during a crisis or major news event and evaluate how they communicate with employees, suppliers, investors and customers. Emergency and mass notification systems are designed to help organizations communicate to stakeholders during an incident or disruption. However, in response to the high occurrence of prominent disasters in recent years, the marketplace has been flooded with products to address emergency and mass notification needs. The need to diligently evaluate vendors is critical to ensure that services will meet an organization's specific requirements.

- more info

---

Disaster Life Cycle

January 20th, 2012

A business disruption has a life cycle; it starts small and could potentially become a disaster of epic proportion, depending on its duration. The longer the duration, the greater the disruption to your business. Your organization’s response should shift as an incident evolves from threat to emergency to crisis to disaster. It’s one thing to say access to contract data isn’t essential for a day or two, but what about a week or two? This is why it’s important to protect more than just data. Now that you know what processes are critical to the operation of your business, you can consider threats according to their impact on those critical processes.

To help you mitigate impact to your core processes, your plan should address three key phases:

• Business Continuity Response - these are the steps you take immediately to sustain your core processes, your primary business priorities
• Disaster Recovery Response - these are the steps you take to extend your core processes indefinitely and address your secondary priorities
• Restoration Planning Response - these are the steps you take to restore your business to its pre
  -incident level

- more info

---

DRP for virtual data centers

January 8th, 2012

Protecting application data from disasters is critical to keeping businesses up and running. Yet traditional disaster recovery solutions were never intended to address the needs of today's virtualized data center.

As a result, the cost and complexity of using traditional disaster recovery products to address data replication needs in highly virtualized environments forces many organizations to forego disaster recovery altogether.

- more info

---

Business continuity management will minimise business interruptions

December 14th, 2011

In addition to this, it is integral for managers to devise business continuity plans to deal with the threats identified by setting out what needs to be done should a certain event occur.

And although not possible to avoid all risks, business continuity management (BCM) can minimise the disruption to a business to a great extend, protecting its share price, stakeholder relations, and reputation, among others.

With that said, BCM is a critical strategic function that cannot be neglected by any organisation whatsoever.

Still, managers often neglect charting a strategic course for their company's future survival, which in itself poses a huge risk, seeing that there are many internal and external events that could impact on a company's overall performance, such as:

• the death of the CEO, owner or key staff member
• fire, flood or earthquake damage - this could hamper operations while organisations repair damages or settle insurance claims
• an interruption in the supply chain
• the loss of a major client
• production line failure or breakdown
• failure to stay abreast of technological innovation
• product failure or contaminationinterruption in telecommunications or power supply

  

- more info

---

Tape still used in my DR plans

November 5th, 2011

Data protection requirements are further necessary to comply with regulated and long periods of data retention. For example, laws about data storage and privacy apply to the vertical markets of the medical industry. HIPAA requires medical companies to store patient’s medical records for five to seven years, and to store their childhood records for the life of the patient. This data also has to be highly secure and easily accessible to address patient care and also for legal reasons, such as a mishap in the office. Laws exist like this in many other industries as well, and a company is advised to research legal strictures on data protection. If there is a law requiring compliance, companies must often store more data for a longer period of time, necessitating secure, cost‐effective storage.

These requirements build a basis for using tape for data protection in the mid‐market, in part because of the high likelihood that organizations already use some form of tape in their IT set‐ups. Tape continues to be the preferred home for nearly 70 percent of the world's data. Using tape for DR automatically builds on existing infrastructure and practices, and provides cost‐effective long‐term storage that addresses DR and legal compliance.

- more info