Disaster Recovery Planning is Key to Business Continuity
ISO 27000, SOX, PCI-DSS & HIPAA Compliant
The Standard for Business Continuity and Disaster Planning
Janco's Disaster Recovery Planning (DRP) Template can be used for any size of enterprise. The Disaster Recovery template and supporting material have been updated to be Sarbanes-Oxley and HIPAA compliant. The Disaster Planning Template comes as both a Word document and a static fully indexed PDF document and includes:
- Disaster Recovery Planning and Business Continuity Planning Template,
- Business and IT Impact Analysis Questionnaire,
- Work Plan,
- Disaster Recovery / Business Continuity Audit Program, and
- Pandemic Planning Checklist.
Preparation for Disaster Recovery / Business Continuity in light of SOX has two primary parts. The first is putting systems in place to completely protect all financial and other data required to meet the reporting regulations and to archive the data to meet future requests for clarification of those reports. The second is to clearly and expressly document all these procedures so that in the event of a SOX audit, the auditors clearly see that the DRP exists and will appropriately protect the data.
New are (Version History):- Backup & Backup Retention Policy,
- Disaster Recovery Audit Program,
- Compliance with the ISO 27000 Series Standards (formerly ISO 17799 now ISO 27001 & ISO 27002), Sarbanes-Oxley, PCI-DSS, and HIPAA,
- Web Site Disaster Recovery Planning Form,
- Project Status Report Form,
- Personnel Location Report,
- Department Disaster Recovery Activation Workbook,
- Quick Reference Guide,
- Team Alert List (Form),
- DRP Team Responsibilities,
- DRP Team Checklist,
- Critical Function(s) Definition,
- Normal Business Hour Response Procedures,
- After Hours Response Procedures,
- DRP Location(s) Definition,
- DRP Recovery Procedures,
- Notification Procedures,
- Notification Call List (Form),
- Updated Business and IT Impact Analysis Questionnaire,
- Vendor Disaster Recovery Questionnaire,
- Vendor Phone List Form Updated,
- Key Customer Notification Form,
- Critical Resources to be Retrieved Form,
- Business Continuity Off-Site Materials Form, and
- Business Continuity Audit Program,
- Chief Information Officer,
- Chief Security Officer,
- Chief Compliance Officer,
- VP Strategy and Architecture,
- Director Disaster Recovery and Business Continuity,
- Director e-Commerce,
- Manager Disaster Recovery,
- Manager Disaster Recovery and Business Continuity,
- Disaster Recovery Coordinator,
- Disaster Recovery - Special Projects Supervisor,
- Manager Database,
- Capacity Planning Supervisor,
- Manager Media Library Support,
- Manager Site Management, and
- Pandemic Coordinator.
DRP / BCP News
Data protection in a state of flux
The state of IT Disaster Planning and data protection is in flux. Conventional models of backup and restore have become obsolete and are being replaced by newer dynamic paradigms that involve disk-to-disk, virtual server provisioning, sophisticated data deduplication, and appliance-based operations.
Disaster Recovery Plan - Business Continuity Plan Template
ISO 27000 ( formerly ISO 17799 ) - Sarbanes-Oxley - HIPAA - PCI-DSS Compliant
Janco has identified four primary business drivers of data protection:
- more info
- Provide Business Continuity and Disaster Recovery. This is the traditional concern of mitigating exposure to information loss. However it has grown more complicated as 24/7, global economy, and open source have become standard business issues. Of paramount importance is overcoming the hurdles associated with backup window requirements, application performance, reliability and consistency, and recovery time.
- Streamline Process Management and Increase Productivity. As staff and resources become overburdened, companies are refocusing on process management. Easing critical pressure points is often the catalyst to surviving a difficult fiscal climate.
- Contain Storage and Server Costs. Controlling cost of operations has become a top priority for many organizations. With data growing at exponential rates, these costs can easily mushroom.
- Support IT Infrastructure Consolidation. Today's data protection architecture seems to be intrinsically broken - as characterized by slow backups, complex recoveries, compromised application performance, and difficult resource administration. IT infrastructure consolidation including server virtualization magnifies the problems and elevates the rearchitecture of storage and data protection as a priority. Finding high performing, easy-to-use, scalable data protection remains a key imperative. Further, system migration of production servers and critical applications to a virtual environment are likely to be costly and painful unless an easy and minimum-impact solution to migration is built into the rearchitecture.
Which disasters should CIOs plan for?
Planning for a disaster is a difficult task at best. A major provider of disaster recovery services, lists hardware problems as the number one cause of disaster, followed by power outages, hurricanes and floods. CIOs often ask "What scenarios should we prepare for?" and "How likely is it that it will happen to us?" When one thinks of disasters, big events such as Hurricane Katrina or 9/11 are the first come to mind. But if we look at the ultimate consequence of a disaster - downtime - we can see that any event, large or small, can have the same effect on IT infrastructure.
Certain areas of the United States have also had power supply problems in the recent past. Most notable is California with its infamous rolling blackouts. Parts of Texas also implemented rolling blackouts when there are abnormally high temperatures. Other regions of the country implement brownouts, where the voltage is reduced to customers during power emergencies. Brownouts can severely affect electronic equipment not protected with an UPS or voltage regulation device. A CIO whose data center was located in the region of California affected by the power crises said: You have to restore and operate your systems from an alternate location that has power. Obviously, that site is usually pretty far away and it is not practical to physically move systems. Moving an interconnected web of storage and servers to another set of infrastructure is a huge challenge. These things just were not designed for that kind of mobility and that is exactly the problem that virtualization solves.
- more info
Data deduplication as part of your backup strategy
Traditional backup solutions create duplicate data in two ways:
- Repeated full backups
- Repeated incrementals of the same file when it changes multiple times.
A deduplication system identifies both situations and eliminates redundant files, reducing the amount of disk necessary to store your backups anywhere from 10:1 to 50:1 and beyond,
depending on the level of redundancy in your data. Deduplication systems also work their magic at the subfile level. To do so, they identify segments of data (a segment is typically smaller than a file but bigger than one byte) that are redundant with other segments and eliminate them. The most obvious use for this technology is to allow users to switch from disk staging strategies (where theyre storing only one nights worth of backups) to disk backup strategies (where theyre storing all onsite backups on disk).
There are two main types of deduplication. Target dedupe systems allow customers to send traditional backups to a storage system that will then dedupe them; they are typically used in medium to large datacenters and perform at high speed. Source dedupe systems use different backup software to eliminate the redundant data from the very beginning of the process and serve to back up remote offices and mobile users.
- more info
What is new in Disaster Recovery and Business Continuity Planning
Disaster Recovery and Business Continuity planning (DRP / BCP) is not new - many organizations have employed some form of (DRP / BCP) for quite some time.
Companies have been replicating their mainframe, storage, and database systems for years. Before that, they moved paper documents to offsite locations.
So, what' s new with DRP / BCP?As business technology proliferated over the past 10 to 15 years, DRP / BCP coverage expanded from back office systems to all types of additional business applications.
New business applications and IT services help organizations react quickly to a dynamic marketplace and provide access to information - wherever and whenever it's needed. Areas of concern include:
- more info
- Companies are reducing the overall number of data centers, consolidating remote and branch office assets in the process.
- E-mail, instant messaging, IP telephony, and collaboration applications have become integral parts of many companies business processes.
- Given the volume of users accessing information, securing the environment is crucial. Allowing unauthorized users to access classified information or failing to protect data in flight could result in significant security breaches.
Tape Versus Disk for Data Retention
Long-term data retention includes weekly, monthly or other long-term backup, primary backup copy of data, off-line copy of static or fixed content data, archive and strategic data preservation. The emphasis is on low cost, long-term durability, compatibility, and energy efficiency for lengthy data retention. Tape is leveraged as a high performance bulk storage medium to off-load the disk cache, boosting the effectiveness and utilization of disk-based systems. From a green and economic efficiency standpoint, data staged off-line to tape consumes no energy while enabling exceptional performance during bulk restore operations. The combination results in both very green and economically efficient storage in addition to supporting business sustainability and enabling compliance.
A tape copy operation may be made locally and then physically transported to another location for safe off-site storage, or data may be replicated as part of the backup and data protection process to a remote VTL or tape library where a removable tape copy is made. Hybrid solutions also leverage diskto- disk locally with snapshots or other point-intime copies that are then replicated to another location or to a cloud-based storage managed service provider (MSP). Data and network bandwidth optimization techniques and technologies, including compression and deduplication among others, enable more data to be moved on available networks or to reduce networking requirements.
- more info
