IFSM 432 Prince Georges Business Continuity and Disaster Recovery Plan Capstone Assignment: Template for Detailed BC_DR Plan with Instructor Notes.docx Re
IFSM 432 Prince Georges Business Continuity and Disaster Recovery Plan Capstone Assignment: Template for Detailed BC_DR Plan with Instructor Notes.docx
Readings: Please follow readings for 4
Grading Rubric: Please follow the grading rubric to complete the assignment. It will enable me to get a better grade
Note: This is a group work and we must finish up by Thursday next week EOD. The overall assigned has 21 sections.
My assigned section: 1-5 as found in “Template for Detailed BC_DR Plan with Instructor Notes.docx”
Please follow the assignment instructions carefully and use the GRADING RUBRIC as a guide. Company Logo
Rel. 1, Ver. 0
Business Continuity and Disaster
Recovery Plan
By
group member name risk or process area
group member name risk or process area
group member name risk or process area
group member name risk or process area
IFSM 432
1
This template is for the educational use of this class and has been modified for that purpose.
Company Logo
Rel. 1, Ver. 0
Emergency notification contacts
Name
Address
Home
Mobile phone
2
This template is for the educational use of this class and has been modified for that purpose.
Company Logo
Rel. 1, Ver. 0
Revisions control page
Date
Summary of changes made
Changes made by (Name)
3
This template is for the educational use of this class and has been modified for that purpose.
Company Logo
Rel. 1, Ver. 0
1. Purpose
The purpose of this business continuity and disaster recovery plan is to prepare in
the event of extended service outages caused by factors beyond our control (e.g., natural
disasters, man-made events), and to restore services to the widest extent possible in a minimum
time frame. All sites are expected to implement preventive measures whenever
possible to minimize operational disruptions and to recover as rapidly as possible when an
incident occurs. This include disaster recovery processes to recover and protect in
the event of a disaster.
The plan identifies vulnerabilities and recommends necessary measures to prevent . It is a plan that encompasses all system sites
and operations facilities.
Instructor note: Please tailor this section so that it addresses both a business continuity and
disaster recovery purpose. Also, ensure that it scales to proper fit the scope of NewOptMarketing
and its sites.
2. Scope
The scope of this plan is limited to . This is a business continuity and disaster
recovery plan, not a daily problem resolution procedures document.
Instructor note: Provide a good comprehensive description of the scope of this plan and its
limitations.
3. Plan objectives
Serves as a guide for the recovery teams.
References and points to the location of critical data.
Provides procedures and resources needed to assist in recovery.
Identifies vendors and customers that must be notified in the event of a disaster.
Assists in avoiding confusion experienced during a crisis by documenting, testing and
reviewing recovery procedures.
Identifies alternate sources for supplies, resources and locations.
Documents storage, safeguarding and retrieval procedures for vital records.
Instructor note: This section is already quite detailed but please tailor if there are additional
objectives that apply.
4. Assumptions
Key people (team leaders or alternates) will be available following a disaster.
A national disaster such as nuclear war is beyond the scope of this plan. Each support
organization will have its own plan consisting of unique recovery procedures, critical
resource information and procedures.
4
This template is for the educational use of this class and has been modified for that purpose.
Company Logo
Rel. 1, Ver. 0
Instructor note: List any additional assumptions that may be applicable to support this plan. Of
importance, are there any assumptions for the storage and recovery of assets at all locations.
5. Disaster definition
Any loss of utility service (power, water), connectivity (system sites), or catastrophic event
(weather, natural disaster, vandalism) that causes an interruption in the service provided by
operations. The plan identifies vulnerabilities and recommends measures to prevent
extended service outages.
5.1 Business Continuity definition
Instructor note: Please provide a definition for completeness.
6. Recovery teams
Emergency management team (EMT)
Disaster recovery team (DRT)
IT technical services (IT)
Instructor note: Tailor the names as appropriate see appendix A for details on the roles and
responsibilities of each team. You may have additional recovery teams identified. If so, be sure
that these are consistently addressed in subsequent sections.
6.1 Team member responsibilities
Each team member will designate an alternate
All of the members should keep an updated calling list of their work team members work,
home, and cell phone numbers both at home and at work.
All team members should keep this plan for reference at home in case the disaster happens
after normal work hours. All team members should familiarize themselves with the contents
of this plan.
6.2 Instructions for using the business continuity plan
Instructor note: From a team members perspective, please provide any instructions for the
specific use of this plan.
7. Invoking the plan
This plan becomes effective when a disaster occurs. Normal problem management procedures
will initiate the plan, and remain in effect until operations are resumed at the original location or
a replacement location and control is returned to the appropriate functional management.
5
This template is for the educational use of this class and has been modified for that purpose.
Company Logo
Rel. 1, Ver. 0
8. Disaster declaration
The senior management team, with input from the EMT, DRT and IT , is responsible for declaring a disaster and activating the various recovery teams as
outlined in this plan.
In a major disaster situation affecting multiple business units, the decision to declare a disaster
will be determined by senior management. The EMT and DRT will respond based
on the directives specified by senior management. Check this statement for accuracy.
9. Notification and Justification
Regardless of the disaster circumstances, or the identity of the person(s) first made aware of the
disaster, the EMT and DRT must be activated immediately in the following cases:
_____ or more systems and/or sites are down concurrently for ______or more hours
______or more systems and/or sites are down concurrently for ______or more hours
Any problem at any system or network facility that would cause either of the above
conditions to be present or there is certain indication that either of the conditions are about to
occur
. Add any other
filters as relevant to your assessed risk scenarios>
10.
External communications
Corporate public relations personnel are designated as the principal contacts with the media
(radio, television, and print), regulatory agency, government agencies [be specific for the given
scenario], and other external organizations following a formal disaster declaration.
11.
Emergency management standards
Data backup policy
Full and incremental backups preserve corporate information assets and should be performed on
a [indicate period] basis for audit logs and files that are irreplaceable, have a high replacement
cost, or are considered critical. Backup media should be stored in a secure, geographically
separate location from the original and isolated from environmental hazards.
Department-specific data and document retention policies specify what records must be retained
and for how long. All organizations are accountable for carrying out the provisions of the
instruction for records in their organization.
6
This template is for the educational use of this class and has been modified for that purpose.
Company Logo
Rel. 1, Ver. 0
IT follows these standards for its data backup and archiving:
Tape retention policy
Instructor note: This section is dated if your organization is no longer using tapes but other
forms of media. Please modify this section to match current forms of media utilized. If still using
tapes, that is fine. Usually students want to modify this section to make it more relevant to how
data is retained in the present day.
Backup media is stored at locations that are secure, isolated from environmental hazards, and
geographically separate from the location housing the system.
Billing tapes (Again, modify this section as you see appropriate to the scenario)
Tapes greater than ____ years old are destroyed every six months.
Tapes less than three years old must be stored locally off-site.
The system supervisor is responsible for the transition cycle of tapes.
System image tapes
A copy of the most current image files must be made at least [indicate frequency].
This backup must be stored offsite.
The system supervisor is responsible for this activity.
Off-site storage procedures
Tapes and disks, and other suitable media are stored in environmentally secure facilities.
Tape or disk rotation occurs on a regular schedule coordinated with the storage vendor.
Access to backup databases and other data is tested annually.
Emergency management procedures
The following procedures are to be followed by system operations personnel and other
designated personnel in the event of an emergency. Where uncertainty exists, the
more reactive action should be followed to provide maximum protection and personnel safety.
Note: Anyone not recognized by the IT staff as normally having business in the area must be
challenged by the staff who should then notify security personnel.
These procedures are furnished to management personnel to take home for
reference. Several pages have been included to supply emergency contacts.
In the event of any situation where access to a building housing a system is denied, personnel
should report to alternate locations. Primary and secondary locations are listed below.
Instructor note: Be sure to indicate all of the locations that apply to the scenario.
7
This template is for the educational use of this class and has been modified for that purpose.
Company Logo
Alternate locations
Rel. 1, Ver. 0
Workplace: Keep in mind the locations in the scenario
Attempt to contact your immediate supervisor or management
via telephone. Home and cell phone numbers are included in
this document
Workplace:
Attempt to contact your immediate supervisor or management
via telephone. Home and cell phone numbers are included in
this document
Workplace:
?ttempt to contact your immediate supervisor or management
via telephone. Home and cell phone numbers are included in
this document
8
This template is for the educational use of this class and has been modified for that purpose.
Company Logo
12.
Rel. 1, Ver. 0
Response Scenarios
Instructor note: Please refer to your group risk assessment assignment as a guide for
completing this section.
In the event of a fill in with risk or the process area Note keep it simple. For example. In the
event of a fire
.. or, In the event of a flood
..
In the event of a major catastrophe affecting facility, immediately notify the .
Procedure
STEP
ACTION
1
2
9
This template is for the educational use of this class and has been modified for that purpose.
Company Logo
Rel. 1, Ver. 0
In the event of risk area
Procedure
STEP
ACTION
1
2
3
4
5
6
7
In the event of a risk area
In the event of a network service provider outage to any location, the guidelines and
procedures in this section are to be followed.
Procedure
STEP
ACTION
1
2
10
This template is for the educational use of this class and has been modified for that purpose.
Company Logo
Rel. 1, Ver. 0
In the event of a [risk area]
In the event of a flood or broken water pipe within any computing facilities, the guidelines
and procedures in this section are to be followed.
STEP
ACTION
Procedure
1
2
3
4
In the event of a [risk area]
In the event of a flood or broken water pipe within any computing facilities, the guidelines
and procedures in this section are to be followed.
STEP
ACTION
Procedure
1
2
3
4
13.
Plan review and maintenance
This plan must be reviewed semiannually and exercised on an annual basis. The test may be in
the form of a walk-through, mock disaster, or component testing. Additionally, with the dynamic environment present
within , it is important to review the listing of personnel and phone numbers
contained within the plan regularly.
Instructor note: Please provide additional insights on the testing of this plan. Often scenarios
are defined to be reviewed and tested.
The hard-copy version of the plan will be stored in a common location where it can be viewed by
site personnel and the EMT and DRT. Electronic versions will be available via
network resources as provided by IT. Each recovery team will have its own directory with
change management limited to the recovery plan coordinator.
11
This template is for the educational use of this class and has been modified for that purpose.
Company Logo
14.
Rel. 1, Ver. 0
Alert/Verification/Declaration phase (x-x hours)
Flow Diagrams
Create a workflow diagram for each risk area based on the identified steps in your procedures
and based on what needs to be done within the first X-X hours, include decision points in the
workflow.
Instructor note: For the draft plan (phase 2), please provide a high-level set of flow
diagrams, realizing that these diagrams will be matured (and may change) when you submit
the final plan (phase 4). You will want these to match your risks identified in your group risk
assessment assignment.
12
This template is for the educational use of this class and has been modified for that purpose.
Company Logo
Rel. 1, Ver. 0
Plan checklists
Instructor Note: Develop a list of what you would need to have available to you in order to
address each risk area. For example, if you are addressing a natural disaster, you would need
floor diagrams for a building.
Risk or process area
Step
Required data, forms, or other tools or information
Risk or process area
Step
Required data, forms, or other tools or information
Risk or process area
Step
Required data, forms, or other tools or information
13
This template is for the educational use of this class and has been modified for that purpose.
Company Logo
15.
Rel. 1, Ver. 0
Notification of incident affecting the site
On-duty personnel responsibilities
If in-hours:
Upon observation or notification of a potentially serious situation during working hours at a
system/facility, ensure that personnel on site have enacted standard emergency and evacuation
procedures if appropriate and notify the EMT and DRT.
If outside hours:
IT personnel should contact the EMT and DRT.
Provide status to EMT and DRT
Contact EMT and/or DRT and provide the following information when any of the following
conditions exist:
Instructor note: Please provide a list of information for contact purposes
..
Any problem at any system or location that would cause the above condition to be present or
there is certain indication that the above condition is about to occur.
The EMT will provide the following information:
Instructor note: The plan defaults to EMT and/or DRT but you can tailor this as you have defined
your teams. If not change, that is fine.
Location of disaster
Type of disaster (e.g., fire, hurricane, flood)
Summarize the damage (e.g., minimal, heavy, total destruction)
Meeting location that is a safe distance from the disaster scene
An estimated timeframe of when a damage assessment group can enter the facility (if
possible)
The EMT will contact the respective market team leader and report that a disaster involving
voice communications has taken place.
The EMT and/or DRT will contact the respective team leader and report that a
disaster has taken place.
14
This template is for the educational use of this class and has been modified for that purpose.
Company Logo
16.
Rel. 1, Ver. 0
Decide course of action
Based on the information obtained, the EMT and/or DRT need to decide how to respond to the
event: mobilize IT, repair/rebuild existing site (s) with location staff, or relocate to a new facility.
17.
Inform team members of decision
If a disaster is not declared, the location response team will continue to address and manage the
situation through its resolution and provide periodic status updates to the EMT/DRT.
If a disaster is declared, the EMT and/or DRT will notify IT Tech Services immediately for
deployment.
Declare a disaster if the situation is not likely to be resolved within predefined time frames.
The person who is authorized to declare a disaster must also have at least one backup person who
is also authorized to declare a disaster in the event the primary person is unavailable.
Contact general vendors
Instructor note: Indicate what type of vendors could be needed by industry as it may apply to the
scenario.
18. Disaster declared: Mobilize incident response/Technical services
teams/Report to command center
Once a disaster is declared, the DRT is mobilized. This team will initiate and coordinate the
appropriate recovery actions. Members assemble at the designated location as quickly as
possible. [Indicate where a command center might be established for this scenario]
19. Conduct detailed damage assessment (This may also be
performed prior to declaring a disaster.)
1.
Under the direction of local authorities and/or EMT/DRT, assess the damage to
the affected location and/or assets. Include vendors/providers of installed
equipment to ensure that their expert opinion regarding the condition of the
equipment is determined ASAP.
A.
Participate in a briefing on assessment requirements, reviewing:
(1)
Assessment procedures
(2)
Gather requirements
(3)
Safety and security issues
15
This template is for the educational use of this class and has been modified for that purpose.
Company Logo
Rel. 1, Ver. 0
NOTE: Access to the facility following a fire or potential chemical
contamination will likely be denied for 24 hours or longer.
B.
2.
3.
Document assessment results using assessment and evaluation forms
contained in __provide sample forms in an Appendix________.
Building access permitting:
Conduct an on-site inspection of affected areas to assess damage to
essential hardcopy records (files, manuals, contracts,
documentation, etc.) and electronic data.
Obtain information regarding damage to the facility (s) (e.g.,
environmental conditions, physical structure integrity, furniture,
and fixtures) from the DRT.
Develop a restoration priority list, identifying facilities, vital records and
equipment needed for resumption activities that could be operationally restored
and retrieved quickly.
Recommendations for required resources.
20. Contact DRT: Decide whether to continue to business recovery
phase
The EMT and DRT gather information regarding the event; contacts senior management and
provides them with detailed information on status.
Based on the information obtained, senior management decides whether to continue to the
business recovery phase of this plan. If the situation does not warrant this action, continue to
address the situation at the affected site(s).
21.
Business recovery phase (xx hours – full recovery)
This section documents the steps necessary to activate business recovery plans to support full
restoration of systems or facility functionality at an alternate/recovery site that would be used for
…
Purchase answer to see full
attachment
