Business continuity management (case study)

IT-Related
Business Continuity & Disaster Recovery
All Rights Reserved. Wissam Abdel Baki | Managing Partner I.T Essentials FZE
Email: info@itessentials.me Mobile: 00971-502648691
An approach through which we accomplished buy-in
Abu Dhabi, 2010-2011

Outline
• Introduction
• Technology progress and value
• Risk Assessment
• Live examples from local news
• Some industry statistics
• Business Impact Analysis
• Reliability and Prevention
• Existing Backup Plan
Information
• Availability and Continuity
• Response and Recovery
• Funding Options
• Key Emergency Contact
Information
• Testing and keeping the plan up-
to-date
• Conclusion
• Quotes
• Recovery Evolution

This presentation discusses HOW our IT department built and
presented IT services continuity and disaster recovery, and got
senior management’s approval on:
• The IT Continuity and Disaster recovery Plan
• Investing in building a Recovery Data Center, a Hot Site.
Introduction

Technology progress and value
In today’s complex and constantly changing business world,
technology became one of the main factors in the success or
failure of companies, due to the high dependency on all its forms.
Discussed the technology evolution in the region:
• Cloud computing, Smart homes, eGovernment , Smart phones,
eBanking, etc…
Discussed our dependency on technology
• ERP, EPM, CRM, Archiving, Property Management, HR
Processes, ISA, IP Telephony, Emails, and others.

What is the probability that something will happen, and
what does it mean when it does?
Being able to inform management about an enterprise’s risk
exposure helped give them a clearer picture of the liability of
not having a plan.
Risk Assessment
• Listed risks, probability and impact
• Listed responses and costs
• Used live news feeds and articles
• Used Statistics
Risk Assessment

• Heavy rains kill one, injure 3 others in RAK 07/02/2010
• Sandstorm, heavy rain lash Al Ain 13/09/2009
• Weather disrupts shipping 03/08/2009
• Thick dust continues to blanket the UAE, bringing visibility down to a few
hundred meters in some areas 03/08/2009
• Thousands evacuated as tremors hit UAE 10/09/2008
Live examples from Local News

Some Industry Statistics
• According to research by the University of Texas, only 6 percent of companies suffering from a catastrophic
data loss survive, while 43 percent never reopen and 51 percent close within two years.
• Gartner estimates that only 35 percent of small and medium businesses have a comprehensive disaster
recovery plan in place.
• International Data Corp. estimates that companies lose an average of $84,000 for every hour of downtime.
According to Strategic Research, the cost of downtime is estimated at close to $90,000 per hour.
• According to a recent NFIB National Small Business Poll, man-made disasters affect 10% of small businesses,
whereas natural disasters have impacted more than 30% of all small businesses in the USA. Hurricanes are by
far the most destructive force causing power failure, flooding, customer loss, and the closure of many
businesses.
• According to a recent Touche Ross study, the survival rate for companies without a disaster recovery plan is less
than 10%!
• According to analyst firm IDC, about 70% of all successful attacks on computer networks were carried out by
employees and insiders.
• A 2006 AMR Research study showed that only 32% of businesses have a disaster preparedness plan in place.
• According to a Harris Interactive survey in 2004, 54% of executives from Fortune 1000 companies admitted to
having a technology disruption because they weren’t adequately prepared.
• KPMG Risk Advisory Services and Continuity Insights Magazine conducted a 2005 survey that reported 43% of
businesses damaged in a disaster close for good.

Business Impact Analysis
Knowing the IT and enterprise operational dependencies, is critical part of
the BCP process, the reason why we developed a questionnaire (Business
Impact Questionnaire) to interview department heads and gather their
feedback, after which the result was to be consolidated in the Business
Impact Analysis Report.
The objectives of the business impact analysis (BIA) were as follows:
• Estimate the financial impacts for each major business unit, assuming a
worst-case scenario.
• Estimate the intangible (operational) impacts for each major business
unit, assuming a worst-case scenario.
• Identify the organization’s business unit critical records and libraries as
well as their locations and alternatives if any.
• Identify the maximum downtime and the maximum data loss accepted
for each business unit.

Reliability and Prevention
• Uninterruptible power supply (UPS) in server room
• Physical controls to server room / Automatic Door Lock, Finger Print Access, CCTV
• Temperature Alert, Fire Detection and Extinguisher in Server room
• Intrusion Detection System and Antivirus software (Servers and Machines)
• Redundancy (Dual Components)
• Local Anti-Theft Safe in the 3rd floor for tapes storage
• Backup and Recovery for all servers with daily check for Backup performance
• SLA signed with supplier for remote storage of backup tapes
• Insurance Coverage, Policy: P/2004/20011/2009/00092
• Deploy a stand-by AC Unit in the Server Room
• Deploy an Electricity Generator for the floors rented

Availability and Continuity
• Hot sites
• Warm sites
• Cold sites
• Mobile sites
We presented recovery site options, described each
of the options, and based on the BIA report
presented earlier, we recommended the Hot Site
option, which was approved.
Currently we are in the stage of implementing the
Recovery Data Center in the main ISP of the UAE,
Etisalat.

Availability and Continuity
As per the BIA, 3 of our
services were found
critical, and were to be
replicated between our
data center and the
recovery data center:
• Email
• Fileserver
• ERP

Response and Recovery
What to be done in the event of disaster?
We formed four teams, whose main responsibility is to restore operations in
the original data center back to normal.

Funding Options
Funding the disaster recovery and business continuity
plan was to be decided by management.
We provided and explained the following options:
• Corporate funding
• Business unit funding
• Information technology funding
It was decided to include the disaster data
center cost to the IT budget.

Key Emergency Contact Information
IT Personnel
IT Managers / IT Admins / Software Engineers
Emergency Services
Police / Fire / Ambulance / Utilities / Weather Forecast /
Abu Dhabi Municipality / Abu Dhabi International Airport /
Coast Guard / Directory Enquiry Services
Key IT Suppliers and Maintenance Engineers
Hardware / Etisalat / Network providers/ Software /
Magnetic Media / Printers and photocopy machinery / Attendance and CCTV /
Insurance Company / Offsite Storage
Coordinator for Each Functional Area
IT Department / Internal Auditor / Marketing / HR / MSD / Admin / Projects / CEO
Office / Finance / Investor Relations / Collections / Contracts / Legal

Risks Probability Impact Risk Level
Hurricane, Earthquake 10 30 300
Flood, Storm 20 30 600
Terrorist Attack 10 30 300
Theft 10 30 300
Fire 20 30 600
Electrical Power Failure 30 30 900
Air Conditioning Failure 30 30 900
.
.
.
Probability and Impact Analysis
Back

Risks Impact / Result
IT
Services
Affected
Actions
Prevention Recovery Continuity
Hurricane, Earthquake
Building defected
All
Insurance / Recovery
Teams Mobilization /
Shift to office location at
Rented Office
Connect to Hotsite
through internet
Server Room Totally
ruined/defected
Flood, Storm
Electricity Outage for whole
building (HO)
Rented Office
Connect to Hotsite
through internet
Water Leakage (Server Room) All
Terrorist Attack
Building Defected / Server
Room Defected
All
Automatic Door Lock, Finger
Print Access, CCTV, Security
Guards
Rented Office
Connect to Hotsite
through internet
Theft Server Room Defected All
Automatic Door Lock, Finger
Print Access, CCTV, Security
Guards
Teams Mobilization
Connect to Hotsite
through internet
Fire
Building Defected / Server
Room Defected
All
Fire Detection and
Extinguisher in Server room
Rented Office
Connect to Hotsite
through internet
Electrical Power
Failure
Power failure in Server Room
All
Electricity Generator
UPS Outage
Support Agreement with APC
(1 day replacement)
Supplier to replace
defected UPS
Air Conditioning
Failure
Air Conditioning Down (Server
Room)
All
Temperature Alert in Server
room
Spare split unit deployed
Supplier to replace
defected item(s)
Utilize spare unit.
Connect to Hotsite
through internet
.
.
.
Back
Register and Responses

Existing Backup Plan Information
Applications Server ID
/ Name
Database (s) Full Backup
Freq
Off-Site Incremental
Backup
Frequency
Off-Site Backup Media Estimated
Recovery
Time (day)Yes/No Yes/No
Exchange
Server
MAILSRV Exchange Data
Base + WFS
Backup
Weekly +
Monthly
Yes Daily No 1.6TB Media Tape
Drive
1 – 2
Application
Server – GP
GPSRV WFS Backup Weekly +
Monthly
Drive
1
+ Database
Database
Server
SQLSRV Full Database
Backup
Weekly +
Monthly
Drive
1
File Server FSRV Employees +
Departments Data
+ WFS
Weekly +
Monthly
Drive
1
Customer
Relationship
Management
CRM WFS Backup Weekly +
Monthly
Drive
1
+ Database
AL Khazna Shareholders-
Registry
WFS Backup +
Database
Weekly +
Monthly
Drive
1
WFS: Windows File System
TB: Terabyte = 1000 GB = 1,000,000 MB
Back

.
.
.
Risks
Cost estimate of continuity
Hotsite Available
(1st year)
Hotsite Available
(> 1st year)
Hotsite Not Available
Hurricane, Earthquake AED 560,000.00 AED 60,000.00 AED 2,772,000.00
Flood, Storm AED 560,000.00 AED 60,000.00 AED 2,772,000.00
Terrorist Attack AED 560,000.00 AED 60,000.00 AED 2,772,000.00
Theft AED 560,000.00 AED 60,000.00 AED 2,772,000.00
Fire AED 560,000.00 AED 60,000.00 AED 2,772,000.00
Electrical Power Failure
AED 560,000.00 AED 60,000.00 AED 138,600.00
Air Conditioning Failure AED 560,000.00 AED 60,000.00 AED 138,600.00
Cost of Availability
Back

Testing and keeping the plan up-to-date
• Testing
• Semi-Annual Testing activities
• Updating
• Change Controls for Updating the Plan
• Responsibilities for Maintenance of Each
Part of the Plan
• Test All Changes to Plan
• Advise Person Responsible for BCP Training

Conclusion
Business continuity is a business survival strategy for an organization. Executive
managers who fail to take action to protect their organization will be held
accountable by the shareholders, strategic business partners, regulatory
authorities or other interested parties.
A strong business continuity environment provides assurance to the
organization's executive management that in the event of a disaster, the
organization is in a superior position to survive.
Continuity and Recovery Priority Recommendations

Quotes
Humans cannot prevent natural disasters such as earthquakes,
but they can greatly reduce damage from these disasters by
being well prepared.
Predictors of Two Types of Earthquake Preparation - An article by SAGE publications
Despair is most often the offspring of ill-preparedness
Don Williams, Jr.
The trouble with the future is that is usually arrives before we're
ready for it.
Arnold H. Glasgow

Recovery Evolution

Business continuity management (case study)

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Destacado

Destacado (17)

Similar a Business continuity management (case study)

Similar a Business continuity management (case study) (20)

Último

Último (20)

Business continuity management (case study)