Strategies for Developing and Testing Business …

1 85-01-65 Strategies for Developing and TestingBusiness continuity PlansKenneth A. SmithPayoffBecause of the increasing dependence of businesses on their information, planning for therecovery of an interruption to data processing functions has become a top priority. In thepast, companies focused solely on recovery of their large mainframe centers. Now, withinformation spread throughout the organization, a more comprehensive form of recoveryplanning and Testing is essential. Comprehensive Business recovery solutions must includenot only large systems recovery but the recovery and Testing of midrange systems,networks, and work groups. This article presents steps for Developing and Testing acomprehensive Business resumption plan.

2 It reviews specific plan development stages, Testing objectives, and actual Testing approaches. Finally, it offers basic guidelines andrecommendations for a test plan that helps to ensure Business AddressedComprehensive Business resumption planning is growing beyond the walls of the datacenter. Business 's growing dependence on multiple computing platforms and increasinglysophisticated communications networks is making companies more vulnerable to disasters are highlighting the importance and vulnerability of distributed computingsystems, even while mainframe recovery is becoming more reliable. Business continuitymust address these evolving integrated and networked Business awareness of the need for comprehensive Business recovery is on the rise aswell, probably largely because of the increase in major regional catastrophes during the pastfew years.

3 The public sector is also getting involved, with increasing federal, state, andlocal government participation in comprehensive disaster are reacting to this need by Developing enterprisewide disaster recoveryplans but are discovering a host of problems associated with comprehensive businessrecovery planning. These plans require far more participation on the part of managementand support organizations than mainframe recovery planning. The scope is no longerlimited to recovery; plans must integrate with existing disaster prevention and mitigationprograms. These companywide resumption plans are costly to develop and maintain andare frequently prolonged, problematic, and , there have been successes from which security specialists can learn.

4 Thisarticle presents some of the lessons learned, including some of the tools, techniques, andstrategies that have proved Business Recovery StrategiesSuccessful recovery from disaster often depends on workable and timely alternativeoperating recovery Strategies . A well-known set of recovery Strategies , including somesimple and relatively inexpensive commercial products and services, has made recoveryplanning feasible for large-scale mainframes and midrange computers. New solutions arebecoming increasingly available for small computer configurations and businessresumption ( , work group) recovery. These evolving solutions are based onexperiences gained from a multitude of single-site and regional recovery planning and Testing is an essential part of the total recovery that develop, maintain, and regularly test their Business resumption plansrecover far better and faster than those that are not screenExhibit 1 illustrates the scope needed for a companywide Business continuity resumption should be thought of as an ongoing program, much like existingavoidance programs ( security) and loss-mitigation programs ( insurance).

5 Scope of the Companywide Business continuity ProgramResumption planning is moving into departmental work groups. Executive managementand the support organizations are also taking part in Business resumption through integratedcrisis incident management planning tools and Strategies are available to help companies develop tools include commercially available software, consulting services, and several public-domain information sources. These tools and services are invaluable in reducing the effort,elapsed time, and cost involved in Developing Business resumption discussing how to develop a plan, it would be useful to review the availablestrategies for both computer and work group recovery.

6 The following sections examinethese SystemsThe choice of which mainframe recovery strategy to follow is based primarily onbusiness recovery timing requirements, cost, and reliability. Hot sites are fast becoming therecovery strategy of choice for companies requiring rapid recovery. The commercial hotsite is second only to an internally owned redundant site in terms of reliability and timing,and usually at less than 10% to 30% of the annual cost. In some areas ( , disastersupport and telecommunications infrastructure), hot sites can actually provide a morereliable strategy than an internally owned redundant potential Strategies for mainframe and midrange computer recovery (discussed inthe next section) are listed in Exhibit 2.

7 Most organizations use multiple Strategies ,depending on the severity of the disaster and expected outage duration. During planning,different Strategies may be identified for different applications, depending on the potentialbusiness and Midrange Recovery StrategiesPrevious screen RecoveryStrategy Time Frame Advantages Disadvantages_____ _____ _____ _____Repair or Rebuild at 6-12 months --Least cost --Time to recover,Time of Disaster reliability, and testabilityCold Site (private or 1-6 weeks --Cost-effective --Testabilitycommercial)

8 --Time to recover --Detail plans are difficult to maintain --Long-term maintenance costsReciprocal 1-3 days --Useful for --Not legallyagreement specialized acceptable in equipment in low- some volume environments applications --TestabilityService Bureau 1-3 days --For contingency --Not available in planning ( large CPU backup microfilm)

9 EnvironmentsShippable or 1-3 days --Useful for --LogisticalTransportable midrange difficulties inEquipment computing regional disaster recoveryCommercial Hot Site Less than 1 --Testability --Regional disaster day --Long-term commitment and integrityThe recovery time frames in Exhibit 2 do not imply either minimum or maximum times;these figures represent actual company experiences following disaster.

10 For example, in tworecorded examples of a total data center loss, the rebuilding time was 6 months for onecompany and 12 months for the other. Most recoveries using commercial hot sites havebeen accomplished within 8 to 24 costs for mainframe recovery Strategies are analyzed, it is important torealistically estimate personnel and equipment costs. In addition, the Strategies should beplanned out over a minimum three-to-five year period to ensure that the cost of maintainingand upgrading equipment is considered. Equipment resources for mainframe strategiesshould be defined at a fairly detailed level, because the cost of the incidental infrastructureand network can significantly affect actual potential hot-site or cold-site recovery vendors is less clear-cut.