In This Issue
- Core Disaster Recovery and Business Continuity Assessment
- Budgets Cuts Impact Disaster Preparedness
- Security Policies and Procedures
Core Disaster Recovery and Business Continuity Assessment
Many businesses have never tested the recovery process in the event of a server or site failure
With business continuity a core component of risk management, a well-rehearsed plan lays the foundation for confidence that IT systems will work when needed most.
Terms like Maximum Tolerable Period of Disruption (MTPOD), recovery time objective (RTO) and recovery point objective (RPO) are often used, but what do they really mean? In practical terms, recovery time objective is the duration until a business can return to normal after the failure of a server or key computer site, and recovery point objective is the place in the transaction flow where the business resumes.
- Recovery Time Objective (RTO) – How long can your business afford to be down?
- Recovery Point Objective (RPO) – How often do you backup? How much data can your business afford to lose in the event of a disaster?
- Level of Service (LOS) – What are your business’ critical servers and essential units that cannot be disrupted?
Implementing a disaster recovery plan includes documenting the process to bring a server or group of servers back online in the event of failure. An overlooked step in the process often flows from the assumption that an IT expert is always readily available. Due to the inherent unpredictability of a disaster, the IT staff that your company relies on may take time to find and start action. Considering this human latency when developing the recovery plan naturally highlights any undesirable complexity in the systems and processes, and the need to support recovery even with minimal IT expertise on hand.
- Core disaster recovery and business assessment questions
- Could a newly hired IT professional quickly handle the situation?
- Could a remote IT engineer talk a novice through the procedures?
- Could a smart phone, tablet, or remote laptop provide all needed access to bring your business back online?
- Could the disaster recovery business continuity plan be executed within the RTO and RPO requirements?
In addition to reviewing your disaster recovery and business continuity plan your team needs to define a realistic picture of their expectations. You could spend too much time thinking of costly alternatives to cover aspects of daily operations that may not be critical. When doing so, ask yourself and your executive team:
- Specifically, what level of protection is necessary (RTO, RPO, LOS)?
- Which aspects of your company’s business must stay operational?
All of this is defined in Janco's "Disaster Recovery - Business Continuity Template".
Budget Cuts Impact Disaster Preparedness
The needs for available data and regulatory compliance requirements have not slowed down...
Disaster recovery and business continuity plans are not up to date
Most businesses never suffer a catastrophic data loss. For those that do, whether caused by hardware failure, natural disaster, fire/flood, employee malice…..it can be devastating. More than 50% of businesses suffering a catastrophic loss of data never recover.
In the last two years, internal IT resources become stretched. This has lead to companies looking for ways to cut costs in all areas in disaster recovery and business continuity. Disaster recovery plans need to be viewed as ongoing programs -- not projects that can be put on the shelf for a year.
In addition, companies scaled back IT recovery sites. This has lead to a recovery installation which does not match the current production environment. Critical applications can then no longer be recovered in a timely manner.
The IT Productivity Center - a division of Janco Associates, Inc. has conducted a study of 253 recovery efforts and identified why DRP BCP plans fail.
The most common issue and occurring in 62% of all recovery plans are errors in the plan itself. This is often due to the plan not being kept up to date (47%) and the unavailability or inaccurate passwords (34%).
Additional reasons for failures are:
- Insufficient backup power - 22%
- Communications not in place - 18%
- Personnel not trained - 17%
- System priorities not identified - 14%
- Recovery not documented - 13%
- Event not identified - 12%
Detailed and Customizable for Your Business
The IT Security Manual Template provides all the essential sections of a complete security manual and walks you through the creation of each step. Detailed language addressing a variety of topics is included in a 230-page Microsoft Word document which you can modify as much or as little as you need to fit your business requirements. This instant download includes sections on critical topics like:
- Risk analysis
- Staff member roles
- Physical security
- Facility design, construction and operations
- Media and documentation
- Data and software security
- Network security
- Internet and IT contingency planning
- Insurance
- Outsourced services
- Waiver procedures
- Incident reporting procedures
- Access control guidelines
Includes Supplemental Assessment Material
To help you assess factors affecting your IT security, the IT Security Manual Template comes with the Business & IT Impact Questionnaire, a Word document that helps you gather essential security-related information from across your organization. You'll also receive the Threat & Vulnerability Assessment Tool, a Microsoft Excel workbook you can use to define and compare dangers that could impair your business operations.
Comes in Standard - Premium - Gold Editions
Not only can you get the template in easily modifiable Microsoft WORD but you can get full multi-page job descriptions when you order the Premium or Gold Editions. Read on...