IT Disaster Recovery Plan for Jubilee Motor Company

Introduction and Importance of IT Disaster Recovery

The importance of IT Disaster Recovery planning can be understood through examining previous cases of disasters that have paralyzed the normal operations of various nations and organizations. A notable example is the September 11th, 2001 terrorist attack on the United States, which demonstrated the critical need for recovery preparation. A disaster recovery plan, also referred to as a Business Continuity Plan (BCP), provides a description of all the steps that must be followed by an organization to ensure that specific processes continue to run in the event of any disaster, whether man-made or natural.

The formulation of an IT Disaster Recovery plan involves a thorough evaluation of the basic and mission-critical components of an IT-supported and IT-run system. It is essential to develop a BCP that ensures the operations of a given firm continue to flourish and remain available whenever they are required. An effective IT Data Recovery plan must ensure that events are quickly contained to avert possible losses in revenue and company image resulting from unprecedented system failures and breakdowns.

The importance of IT infrastructure to the day-to-day running of business operations cannot be overemphasized. Various critical business processes are controlled by computer systems tailored to meet the demands of these unique processes. However, a disruption to IT infrastructure can bring all of a company's critical operations to a sudden halt, with repercussions including losses of very large amounts of money. This paper describes a systematic plan aimed at restoring the IT infrastructure of Jubilee Motor Company (JMC), which recently suffered a major breakdown of its IT systems as a result of an accidental fire outbreak.

Overview of Data Recovery and Business Continuity

Historical Context and Evolution

During the 1960s and 1980s, users of various IT systems began to recognize the Single Points of Failure (SPOF) that existed in their systems. Corporations and individuals realized that disruption of IT infrastructure resulted in significant impact upon the business continuity operations of organizational key processes. It became clear that maintaining the continuity of business processes was essential and that no amount of threat to the system was tolerable. Various IT infrastructure components such as hardware, network infrastructure, and other IT system elements had to be designed to eliminate these SPOFs. The financial implications of data loss and disruption of mission-critical components were substantial, prompting engineers to develop better systems with fewer vulnerabilities. This necessity led to the development of various forms of data recovery plans to ensure that computer systems and their contained data could be maintained and restored to normalcy prior to incidents that could cause disruption.

Relationship Between IT Disaster Recovery and Business Continuity

The IT Disaster Recovery plan to be drafted for JMC is designed to address specific business processes. Its relationship with various business processes is profound. The manufacturing processes at JMC must continue regardless of circumstances, meaning that all mission-critical parts of the company must be maintained in perfect working condition. The relationship between the Disaster Recovery Plan and the BCP is therefore fundamental. In essence, the BCP can be viewed as an umbrella plan that contains the Disaster Recovery Plan as one of its subcomponents.

The main components of a comprehensive Business Continuity Plan include:

• Business Resumption Plan
• Incident Management Plan
• Continuity of Operations Plan
• Occupant Emergency Plan
• Disaster Recovery Plan

It is important to note that the Business Resumption Plan, the Continuity of Operations Plan, and the Occupant Emergency Plan do not directly address the organization's Information Technology infrastructure, which is the focus of the DRP.

The Disaster Recovery Process and Timeline

Overview of the Recovery Process

The JMC manufacturing processes must continue to thrive regardless of incidents affecting the company's IT infrastructure. It is therefore crucial to gather all system components and supporting staff who will help maintain a continuous flow of data necessary for JMC's manufacturing operations. The initial process for ensuring that normal operations continue at the manufacturing facility is to assemble a team mandated with running a temporary IT infrastructure command post. This command post or control room monitors all vital business operations at JMC.

The computers used must be efficient, and the data and software must be obtained from the offsite data backup system. It is important to prioritize restoring the most fundamental systems—those that are mission-critical. These are systems directly involved with running the organization's main facilities. In JMC's case, all IT infrastructure components directly involved with manufacturing processes must be brought back online first. Systems involved with transactions and monitoring operations are addressed at a later time.

Development of the Recovery Plan

To ensure that IT infrastructure is not interfered with in the future, a solid plan must be drawn and put in place. The plan must be able to be initiated and implemented within the shortest time possible. In order to ensure that JMC IT infrastructure is brought back to normalcy, a specific sequence of events must take place. This sequence is crucial for maintaining mission-critical processes in their normal working conditions.

The initial step in the IT disaster recovery process is the establishment of a planning group. This group is mandated to identify all mission-critical components of the JMC manufacturing processes. Including all mission-critical elements is essential for an effective IT infrastructure. Given the limited time frame, the planning group must be assembled quickly. The planning group then performs risk assessment and audits to ensure all mission-critical elements are captured. An emergency center is then set up based on the results of the risk assessment and audit. The firm then establishes priorities for various applications supporting JMC manufacturing activities and the supporting network infrastructure. Data recovery strategies are then drawn to support appropriate components of the manufacturing system. An efficient inventory and documentation of the prescribed plan is prepared for future reference and troubleshooting. The drawn plan is then verified according to established verification criteria. Finally, the IT data recovery plan is implemented.

Application Classification and Timescales

The IT data recovery planning group should be composed of individuals conversant with all business processes and the technology behind various network architectures. This is crucial for formulating a viable DRP. Applications must be classified according to their importance to business continuity:

Since manufacturing activities at JMC must be brought back online within 12 hours, the classification of this disaster recovery plan is mission-critical. The focus of the Disaster Recovery Plan is to restore operation of systems termed mission-critical. The restoration process does not need to be entirely dependent on technology; some elements can be manual. It is important to ensure that some aspects of data recovery are manually accomplished to minimize the cost of the overall recovery operations.

Having a Disaster Recovery Plan in place reduces the risk associated with the period of time during which a disruption in a critical business process occurs beyond what management deems acceptable. During the recovery process, the focus is on establishing controls over occurring events to limit risk of further loss.

Technical Disaster Recovery Strategies

The development of a technical disaster recovery strategy is one step in the overall IT Disaster Recovery Planning process. This process, common to all IT systems, makes use of the following procedures:

1. Developing the Business Contingency Planning Policy and identifying Business Process Priorities
2. Conducting a Risk Assessment of the entire facility
3. Conducting the Business Impact Analysis (BIA) of the entire facility
4. Developing Business Continuity and Recovery Strategies
5. Developing Business Continuity Plans
6. Conducting awareness of the system, testing its components, and training staff on DRP elements
7. Conducting Disaster Recovery Plan maintenance and related exercises

Data Currency and Personnel Identification

It is vital that the operational activity supporting application Recovery Point Objective (RPO) takes place before disruption or disaster occurs. Once a disaster strikes, applications and data become unavailable for DRP execution. Therefore, copying application and data offsite from the production center to a storage facility is essential. The storage facility location can be at the recovery computing center or nearby, depending on recovery criticality.

Application and data can be copied from production to recovery using two methods. One method is electronic copying of data over a wide area network (WAN) from the production center to the recovery center. This process initially consists of copying entire applications and data, followed by scheduled copying of files. The other method is copying data on physical media such as disks, which can be carried away from the production center to an offsite storage location. Copies must be removed from the production center within the allocated RPO timeframe.

Personnel and manpower with necessary skills and knowledge are required for systems and applications supporting critical business processes. Identifying staff with the knowledge to recover data and applications is essential to a DRP. To ensure the organization has sufficient staff available to execute a DRP if disaster occurs, personnel must be dispersed geographically. The skills of personnel should be recorded in the DRP and updated at the same frequency as the plan itself.

JMC Disaster Recovery Plan Policy and Objectives

Policy Statement

The Jubilee Motor Company IT Disaster Recovery Plan outlines basic policies and procedures to be initiated in the event of an IT disaster incident. The plan is tailored to address process-level plans for recovery of various critical technology platforms and accompanying telecommunications infrastructure. The mission is to ensure that the information system maintains uptime, quality data integrity, and availability to support business continuity.

The core policies governing this plan are:

• The company must develop a workable IT disaster recovery plan.
• A formal risk assessment must be carried out to determine requirements for the disaster recovery plan.
• The disaster recovery plan must cover all essential and critical company infrastructure components, IT systems, and networks in accordance with key business activities.
• The disaster recovery plan must be tested periodically in a simulated environment to ensure it can be easily implemented in emergency situations. Both management and staff must understand how it works.
• All staff must know of the disaster recovery plan and understand their respective roles.
• The disaster recovery plan must be updated frequently to account for changing circumstances.

Objectives

The main objective of the disaster recovery program is to develop, test, and provide a well-structured and easily understood document that will aid the company in recovering quickly from unforeseen disasters or emergency situations interrupting information systems and business operations. Additional objectives include:

• Ensuring that all staff fully comprehend their duties in implementing the plan
• Ensuring that operational policies are completely adhered to within all pre-planned list of activities
• Ensuring that proposed plans are cost-effective in their execution
• Considering the implications on all company sites
• Addressing disaster recovery operations as applicable to all key customers and vendors
• Including an elaborate calling and reporting mechanism

Project Timeline

The implementation of the disaster recovery plan follows a structured timeline:

Emergency Response and Risk Management

Emergency Response Procedures

This section outlines the various forms of alert and plans to be invoked in case of an incident at JMC. The major risk scenarios that would lead to activation of the DRP include:

• Complete loss of all communications
• Total power loss
• Flooding
• Complete destruction of buildings at JMC

In case the premises require complete evacuation, the DRP identifies two major evacuation assembly points where personnel are to gather.

Activation of Emergency Response Team

Whenever an incident occurs, the Emergency Response Team (ERT) is activated. The ERT is mandated to decide the extent of invocation of the DRP. Roles of the ERT include:

• Responding immediately to potential disasters and initiating emergency services
• Assessing the extent of the specific disaster and its impact on business and data center operations
• Making decisions on which elements of the DR Plan to activate
• Establishing and managing the disaster recovery team to maintain vital services and return JMC operations to normalcy

Backup Staff and Personnel Notification

If a manager or employee mandated to contact other employees is unavailable or incapacitated, a designated backup staff member must perform disaster notification. For the most current information on the disaster and the company's response, staff members can call a toll-free hotline listed in the special DRP wallet card. Messages will include data on the nature of the disaster, assembly sites, and estimated work resumption times.

If the incident has resulted in injury or hospitalization, immediate family members of affected employees must be notified as soon as possible. Media contact will be coordinated by mandated staff working according to board-approved guidelines for post-disaster communications. Only the designated media team is authorized to initiate direct contact with media; other staff members who are contacted should refer inquiries to the media team.

Risk Management and Scenario Analysis

Various potential disruptive threats can occur at any time and adversely affect normal business processes. A wide range of possible threats and their corresponding results on JMC operations are considered in this section. The focus is on the amount of business disruption resulting from various types of disasters.

Alternate Recovery Facilities

If needed, a hot site will be initiated and notification made through recorded messages or various communication channels. Hot site staffing will comprise members of the disaster recovery team only during the initial 24 hours, with other staff members joining later if necessary.

Insurance Coverage

As part of JMC's disaster recovery and business continuity strategies, several insurance policies have been initiated. These include errors and omissions, directors and officers' liability, general liability, and business interruption insurance. In case insurance-related assistance is needed during emergency hours outside normal business operations, designated personnel should be contacted for immediate support.

Data Backup Strategy and Testing

Backup Strategy Overview

Major JMC business processes that must be protected and their corresponding backup strategies are outlined below. The chosen strategy uses a fully mirrored recovery site at the company's offsite facilities. This strategy involves maintaining duplicate sites that are fully mirrored to enable instantaneous switching of manufacturing activities between the live site and the corresponding backup site.

The following key business processes utilize the mirrored recovery site approach:

• IT Operations
• Technical Support (Hardware and Software)
• Management of Facilities
• Email Functions
• Purchasing and Finance Systems
• Contracts Administration
• Warehousing and Inventory
• Sales and Maintenance Operations
• Human Resource Management
• Workshop and Call Center Support
• Website Development

Testing and Verification

Test objectives and criteria for success are important to obtain the best results from a disaster recovery test. Their use enables each DRP element to be effective while assessing the Business Continuity Plan. There are two major test criteria: Recovery Time Objective (RTO) and Recovery Point Objective (RPO).

Recovery Time Objective involves disaster declaration timeframes, notification alerts, and assessments. To ascertain that personnel contact information is accurate and up to date, call trees and standard operating procedures are tested. Contained within the RTO is the System Recovery Time (SRT), which is tested via a system recovery exercise to ensure recovery operations can meet the stated objective.

Conclusion

It is crucial for each and every company to ensure that they are equipped with a comprehensive IT disaster recovery plan to avert the possible huge financial losses associated with disruption of critical IT system infrastructure. All mission-critical operations of an organization must be maintained at top operating levels to preserve the firm's profitability. Failure to take precautions regarding contingency planning for impending IT infrastructure disruptions can result in serious damage to both the company's image and financial performance. Every company must therefore invest in a solid IT disaster recovery plan to ensure business continuity and operational resilience in the face of unforeseen events.