Disaster Recovery Manual
The Disaster Recovery Business Continuity Manual is what over 3,000 enterprise world wide have chosen as their standard.
ISO 27000, SOX,
PCI-DSS & HIPAA Compliant
The Standard for Disaster Recovery and Business Continuity
The Disaster Recovery Manual (DRP) can be used as a Disaster Planning template for any size of enterprise. The Disaster Recovery template and supporting material have been updated to be Sarbanes-Oxley and HIPAA compliant. The Disaster Planning Template comes as both a Word document and a static fully indexed PDF document and includes:
- Disaster Recovery Manual and Business Continuity Template
- Business and IT Impact Analysis Questionnaire
- Work Plan
- Disaster Recovery / Business Continuity Audit Program
- Pandemic Planning Checklist
Preparation for Disaster Recovery / Business Continuity in light of SOX has two primary parts. The first is putting systems in place to completely protect all financial and other data required to meet the reporting regulations and to archive the data to meet future requests for clarification of those reports. The second is to clearly and expressly document all these procedures so that in the event of a SOX audit, the auditors clearly see that the DRP exists and will appropriately protect the data.
New in recent addition to the DRP BCP Template:- Backup & Backup Retention Policy
- Disaster Recovery Audit Program
- Compliance with the ISO 27000 Series Standards (formerly ISO 17799 now ISO 27001 & ISO 27002), Sarbanes-Oxley, PCI-DSS, and HIPAA
- Web Site Disaster Recovery Planning Form
- Project Status Report Form
- Personnel Location Report
- Department Disaster Recovery Activation Workbook
- Quick Reference Guide
- Team Alert List (Form)
- DRP Team Responsibilities
- DRP Team Checklist
- Critical Function(s) Definition
- Normal Business Hour Response Procedures
- After Hours Response Procedures
- DRP Location(s) Definition
- DRP Recovery Procedures
- Notification Procedures
- Notification Call List (Form)
- Updated Business and IT Impact Analysis Questionnaire
- Vendor Disaster Recovery Questionnaire
- Vendor Phone List Form Updated
- Key Customer Notification Form
- Critical Resources to be Retrieved Form
- Business Continuity Off-Site Materials Form
- Business Continuity Audit Program
- Chief Information Officer
- Chief Security Officer
- Chief Compliance Officer
- VP Strategy and Architecture
- Director Disaster Recovery and Business Continuity
- Director e-Commerce
- Manager Disaster Recovery
- Manager Disaster Recovery and Business Continuity
- Disaster Recovery Coordinator
- Disaster Recovery - Special Projects Supervisor
- Manager Database
- Capacity Planning Supervisor
- Manager Media Library Support
- Manager Site Management
- Pandemic Coordinator
The DRP template is over 200 pages and includes everything needed to customize the Disaster Recovery Plan to fit your specific requirement. The electronic document includes proven written text and examples for the following major sections of a disaster recovery plan:
- Plan Introduction
- Business Impact Analysis - including a sample impact matrix
- DRP Organization Responsibilities pre and post disaster - DRP / BCP checklist
- Backup Strategy for Data Centers, Departmental File Servers, Wireless Network servers, Data at Outsourced Sites, Desktops (In office and "at home"), Laptops and PDA's.
- Recovery Strategy including approach, escalation plan process and decision points.
- Disaster Recovery Procedures in a check list format
- Plan Administration Process
- Technical Appendix including definition of necessary phone numbers and contact points
- Job Descriptions
- Disaster Recovery Manager
- Manager Disaster Recovery and Business Continuity
- Pandemic Coordinator
- Work Plan to modify and implement the template. Included is a list of deliverables for each task. (Risk Assessment and Vulnerability Assessment)
- Disaster Recovery Manager Responsibilities
- Distribution of the Disaster Recovery Plan
- Maintenance of the Business Impact Analysis
- Training of the Disaster Recovery Team
- Testing of the Disaster Recovery Plan
- Evaluation of the Disaster Recovery Plan Tests
- Maintenance of the Disaster Recovery Plan
Click on the link below to get the DRP/BC sample pages now and make it part of your disaster recovery toolkit.
Backup Matrix - Sample from Disaster Recovery Manual
Disaster Recovery Manual News
Business continuity planning for a Pandemic
Larger corporations typically can continue business as usual even while many employees are out sick in a Pandemic. However Business Continuity Planning at small firms rely heavily on key individuals and find themselves nearly incapacitated if several of those key people get sick, must stay home with sick children, or are in areas put under quarantine.
-
Phone Trees
At
a minimum, small business owners should update employees' contact information to
include current home phone numbers and addresses, e-mail addresses, and cell
phone numbers. Some employers establish phone trees so they can efficiently
contact all their employees to check on and alert them during an emergency.
Another
vital component to a business continuity plan is to collect contact information,
including cell phone numbers, for their suppliers, vendors, and key customers.
Keep this information in print and online, and store copies off-site in case you
can't get into your office.
A
host of legal and medical questions may arise for small business owners if swine
flu roars back with a vengeance this fall.
Imagine
you run a small business like a day-care center, where vulnerable children
congregate and colds and flu are prevalent. Do you close and send your entire
staff and all children home at the first sign of any flu? Do you send home only
sick children and sick staff? When? When do you reopen or allow them to return?
What information and medical clearance would you need to send staff or children
home, allow them to return, close, or reopen the center? These are not easy
questions.
-
Backup Staff
Janco
recommends that companies prepare for operational disruptions by doing employee
cross training or lining up backup staff now. Employers should review and
enhance existing emergency disaster plans to ensure business continuity.
Employers that are just getting started should develop a plan that includes
pandemic preparedness, and review it and conduct drills regularly. A checklist
for flu policy is posted at the government's flu awareness Web site.
Aside
from preparing and practicing for pandemic, small business owners may want to
check with their attorneys for advice on unusual situations -- What do you do
with employees who are medically vulnerable to the flu or those with young
children or elderly relatives at home? Do you send them home? When and for how
long? With pay?
-
Paid Sick Leave?
The
federal Family Medical Leave Act provides eligible employees with up to 12 weeks
of unpaid leave to care for themselves or sick family members. Generally, FMLA
regulations do not cover flu absences unless complications arise, but courts
recently have interpreted the FMLA to mandate leave for the flu and other viral
infections.
However,
the federal law does not cover firms with fewer than 50 employees. Small
employers usually do not have to provide sick leave, so it is a surprise to many
employees that they are not entitled to any sick leave, much less any paid sick
leave.
Another
question for your human resources manager and/or attorney is what communications
responsibility you have as a business owner if one of your employees is
diagnosed with swine flu. There are health confidentiality and privacy issues
for employees, so employers should not disclose personal health information. But
employers do not want a modern day Typhoid Mary spreading swine flu at work. If
there is an employee with confirmed swine flu, some employers are alerting
employees that there may be swine flu exposure at work without identifying the
involved employee.
You might need to think about giving an infected person's immediate co-workers enhanced sick leave to protect themselves or family members, particularly if they have particular medical vulnerability to the illness, he says. Some employers bring in cleaning crews to disinfect an office where swine flu has been found. Providing hand disinfectant for employees is not a bad idea.
- more infoCloud Recovery Not Easy - Disaster Recovery Not Under User Control
Microsoft officials still have not provided many details about what caused the outage, other than to say it was a core system failure. The failure is unrelated to Microsoft's cloud infrastructure and/or Microsoft's Azure datacenters, as the company has continued to run the Sidekick back-end on the same infrastructure it has been running on before Microsoft acquired the company in 2008.
The Microsoft/Danger team apologized for the amount of time they are taking to restore contacts, photos, e-mail and other Sidekick services to which users lost access at the start of the month. The team said they were taking their time "to make sure we are doing everything possible to maintain the integrity of your data."
The team still is not committing to an exact recovery timetable, but is saying restoration should begin this week. Microsoft said, "We continue to make steady progress, and we hope to be able to begin restoring personal contacts for affected users this week, with the remainder of the content (photographs, notes, to-do-lists, marketplace data, and high scores) shortly thereafter."
After telling users that they likely had lost all of their personal data, the Microsoft/Danger team then said they expected to be able to recover some of their data. Mid-weeklast week, they said they expected to recover "most if not all" of the missing user data.
What is a Disaster Recovery and Business Continuity Plan
Disaster recovery and business continuity planning are processes that help organizations prepare for disruptive events - whether those event might include a hurricane or simply a power outage caused by a backhoe in the parking lot. The CIO's involvement in this process can range from overseeing the plan, to providing input and support, to putting the plan into action during an emergency.
- more infoCloud is not as secure as many thought
T-Mobile and Microsoft Sidekick is a set of exterior shells (for
mobile phones) that can be personalized and provides the capability
to record, play and share videos: record videos using the camera; receive video
attachments from e-mail, picture messaging, or side load videos to the microSD
card; play video using the built-in media player; share videos via e-mail,
Bluetooth or picture messaging.
Sidekick failed and lost user data. On the face of it, there are some obvious lessons to be learned from the Sidekick snafu, even as Microsoft Corp. reported today that most of the data that was missing will be recovered from servers at its Danger Inc. subsidiary.
The lessons learned are:
- Back up your mobile phone's critical data independently - on a laptop, a desktop or a thumb drive.
- Raise questions about cloud computing and related services.
- Find out how your mobile device stores data, and
make sure you understand it.
The Sidekick incident should serve as a reminder to users to back up critical data. You cannot rely on cloud services to be 100% available all the time.
Not only is a backup of critical data imperative, users need to
have a way to retrieve the backed-up data. CIOs need to think about the value of
the data and what happens if the service is not available. There are many
Internet-based services that can be a second backup version to the original
backup, such as Plaxo. Having the second one drastically reduces the odds of
total loss.
At larger companies, data backups are commonplace and often include information contained on wireless phones as well as desktop computers, analysts said. The issue becomes more difficult when IT shops trust users who put critical company data on personally-owned wireless phones that aren't backed up.
Despite urging users to back up critical data, Staten joined three other analysts in remaining faithful to the mobile phone industry's strong push for cloud computing services, noting that the Sidekick case was relatively isolated.
Nearly every major smartphone provider is working on some version of cloud computing to back up data from smartphones and other cell phones. All those services could be vulnerable to data loss, and the Sidekick example is likely to prompt a broad re-examination of internal server backup procedures.
One added is risk is that backend services open enterprisees up to having data potentially lost, stolen or replicated somewhere that enterprises do not have knowledge of.
Imagine if this happened across an entire carrier's servers. For Verizon Wireless that could be 90 million people. Everybody should think twice if these services could really save your data up in the cloud.
- more infoImprove your RTO and RPO
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this question. Download this outline learn how the Janco Disaster Recovery Business Continuity Template can reduce RPOs and RTOs even more.
Disaster Recovery Guide
Business
Continuity Planning
ISO 27001, ISO 27002, ISO 17799, Sarbanes-Oxley, and HIPAA Compliant
What is Disaster Recovery and how does the Disaster Recovery Planning Template help?
This DRP Template can be used for any sized enterprise.
The template and supporting material have been updated to be Sarbanes-Oxley compliant. The complete package includes:
- Disaster Recovery Planning and Business Continuity Template
- Business and IT Impact Analysis Questionnaire
- Work Plan
- Disaster Recovery / Business Continuity Audit Program
With lost data being a competitive liability, there is no room for downtime in today's business world.
- more infoHuge Waves - Office Buildings and Businesses Demolished
A series of tsunamis smashed into the Pacific island nations of American and Western Samoa killing possibly more than 100 people, some washed out to sea, destroying office buildings and homes, and injuring hundreds. Television images showed offices and homes ripped apart, cars submerged in the sea or lodged in trees and large fishing boats hurled ashore by the waves generated by a 8.0 magnitude quake southwest of American Samoa.
A second 7.9 magnitude earthquake hit the Indonesian island of Sumatra late.
Disaster officials said the toll may reach 100 as rescuers search for bodies in flattened villages along the southern shore of the island of Upolu. Twenty villages on Upolu's south side were reportedly destroyed, including Lepa, the home of Samoa's prime minister. The area is also the main tourist area, and the waves destroyed some resorts. In neighboring American Samoa at least 24 people were killed and 50 injured with the southern portion of the main Tutuila island "devastated". The death toll there may also rise, said officials.
Huge Waves, Buildings Demolished
The waves that hit Pago Pago village were about 20 feet high. Some buildings were demolished by the waves, you know, there are no buildings anymore except the foundation. In addition, the island of Tonga was hit by a 13-foot wave on its northern coast. Tongan officials confirmed seven people were killed, while three were missing late on Wednesday.
Small tsunamis also reached New Zealand, Hawaii, and Japan.
Some areas have been flattened and the tsunami brought a lot of sand onshore. The Samoan resort Sea Breeze on the Southside of Upolu was destroyed when the waves hit it. The restaurant just floated out to sea complete, until it was smashed up in the water.
- more infoDisater Plan Manual - CIO and CSO conflict
When the task of disaster recovery
planning (DRP) is dropped in the laps of information security managers and
IT staff, DRP becomes a security problem. If the disaster plan is handed off to an organization's
information security officer or IT director with little or no support, the
result is usually either a set of a few policies and procedures without a solid
foundation in risk assessment, or a long-winded document that overreaches and
focuses on the wrong issues.
When this happens, the disaster recovery plan
often does more harm than good. Thinking that disaster recovery is assured
by a novice's tape backup rotation plan and off-site storage in a cabinet down
the hall could lead to overconfidence, false statements during audits or
contract negotiations, or even encourage risky data, network, and service
management behavior. Mixing up a data, recovery procedure for a full-blown plan
or inflated data-focused plan into a management policy and standards is
dangerous stuff for the livelihood of a business.
Worse, there is the possibility that minimal action on the part of the CIO and IT to protect information assets will cause senior management to cool its support for enterprise risk management, disaster recovery and business continuity. Organizations making the transition from small to medium size occasionally check disaster recovery off the list when they have information asset-preservation policies, and neglect to scale up disaster response decisions and processes where they concern human safety.
- more infoA disaster occurs -- now what?
A disaster or business interruption occurs, what do you do? A quick roadmap to follow is:
-
Do not panic and remain calm! When a disaster or business interruption occurs the first priority number is to ensure the safety of the employees.
-
Evaluate the disaster! Determine the impact on your personnel and enterprise operations, this evaluation the event is critical in making the decision to activate the disaster recovery business continuity procedures.
-
Communicate with everyone that can be impacted! Communicate with your team, managers, affiliates, and vendors frequently. Even if there is no status to report, do not leave anyone guessing or letting them draw their own conclusions.
-
Know the disaster recovery business continuity plan! Testing the Business Continuity Plan regularly helps everyone in becoming familiar with what will happen and how it will be done.
-
Be decisive! Once you have determined the level of disaster and everyone is safe to operate, it is time to make the decision if you need to implement the business continuity procedures or if the downtime for recovery acceptable.
-
Start the process! Start with recovering the most business critical systems first to restore business operations to a functional level. There should not be any question, which order which applications need to be restored first.
-
Lock down all backups and critical documentation! The first step to the recovery is having a set of data to recover from. This could be anything from archived tape, local disk copy, and a co-location or disaster recovery data center.
-
Use multiple solution paths! Assume that nothing will work and have alternatives in place
-
Reactivate normal operations! Once the systems are operational, the disaster is over and systems are repaired it is time to move the workloads back to where they were originally.
Disasters can occur any where at any time
Disasters are unpredictable by nature and can strike anywhere at anytime with little or no warning. Recovering from one is expensive and time consuming, particularly for those who have not taken the time to think ahead and prepare for such possibilities.
Janco has found that 80% of all enterprises that do not have a disaster recovery / business continuity plan in place before a disaster occurs never reopen. However, when disaster strikes, those who have prepared and made recovery plans survive with comparatively minimal loss and/or disruption of productivity.
Disasters can take several different forms. Some primarily impact individuals -- e.g., hard drive meltdowns -- while others have a larger, collective impact. Disasters can occur such as power outages, floods, fires, storms, equipment failure, sabotage, terrorism, or even epidemic illness. Each of these can at the very least cause short-term disruptions in normal business operation. But recovering from the impact of many of the aforementioned disasters can take much longer, especially if organizations have not made preparations in advance.
Most of us recognize that these potential problems as possibilities. Unfortunately the randomness of some of these disasters lulls some organizations into a sense of false security-"that's not likely to happen here." However, if proper preparations have been made, the disaster recovery process does not have to be exceedingly stressful. Instead the process can be streamlined, but this facilitation of recovery will only happen where preparations have been made. Organizations that take the time to implement disaster recovery plans ahead of time often ride out catastrophes with minimal or no loss of data, hardware, or business revenue. This in turn allows them to maintain the faith and confidence of their customers and investors.
Disaster Recovery Planning is the factor that makes the critical difference between the organizations that can successfully manage crises with minimal cost and effort and maximum speed, and those that are left picking up the pieces for untold lengths of time and at whatever cost providers decide to charge; organizations forced to make decision out of desperation.
- more infoNetwork Disaster Recovery and Business Continuity CIO's Concern
In addition to the lack of a consolidated disaster recovery
/ business continuity plan for the network management system, network operations
are plagued by other problems:
-
Network recovery plans are impacted by unanticipated traffic growth, configuration issues; link overloads due to traffic rerouted around failed network elements, and more.
-
Changes may lead to undocumented side effects, so understanding the impact of changes before making them is essential for reliable network operations.
-
The monotonous work of making simple changes to hundreds or thousands of devices or objects is error prone and often difficult to reproduce in the recovery mode.
To
add to the pressure, network operations teams are expected to run larger
networks that have become many times more important to the business, and to do
so with fewer staff members.
These conditions exacerbate the problems associated with disparate disaster
recovery and business continuity plans.
State of Texas disaster recovery plan in jeopardy
Disaster planning for the State of Texas has been put in jeopardy with the delay in the signing of contracts for seven of the state’s agencies. The 7-year contract, signed in 2007, calls for data-center operations for 27 separate state agencies to be consolidated into two new facilities with the objectives being enhanced security and lower costs, according to the Austin American-Statesman.
In addition, high-profile data breaches involving state systems last year led to the suspension of the data-center consolidation project until IBM could prove to the state that necessary security measures were in place. As a result, seven of the state's 27 agencies have still not signed off on IBM's proposed plan for managing data backup, which could lead to additional delays.
Adding to IBM's challenge on this project are the results of a survey of the IT directors for the state agencies: 88% said they are dissatisfied with the services IBM has been providing.
- more info