keeping people and information connected ® implementing a business continuity capability name:mark...

KEEPING PEOPLE AND INFORMATION CONNECTED®

Implementing a Business Continuity Capability

Name: Mark Horne

Title: Consulting Solution Architect, Strategic Accounts

Date: December 9, 2009

© 2009 SunGard Availability Services LP. All Rights Reserved. | 2KEEPING PEOPLE AND INFORMATION CONNECTED®

SunGard Research


Research Objectives

SunGard Availability Services is interested in conducting research to evaluate the difference in perceptions between IT and business leadership relative to the impact of unplanned downtime on business success, and their strategies for disaster/unplanned outage risk mitigation.

The information gathered from this research will identify disconnects between the two groups surveyed to develop initiatives designed to bridge gaps and educate and motivate proactive risk mitigation planning.

SunGard commissioned Harris Interactive to conduct the research on their behalf in February, 2009.


Respondent Qualifications To qualify for this research, respondents had to meet the following criteria:

– Business Qualified Respondents - Hold at least a Director level title and have associated responsibilities, such as budget and staff, in business areas.

– IT Qualified Respondents - Hold at least a Manager level title and have associated responsibilities, such as budget and staff, in IT areas.

– Work for companies with at least 50 employees.

General Information A survey was administered in March 2009

– Data collection was conducted online– The survey took an average of 10 minutes to complete– There were 497 qualified respondents:

277 Business completes 220 IT completes

SunGard was not identified as the sponsor of this research

Methodology


Most decision makers indicate their company has a Disaster Recovery plan in place. In fact, recovery plan deployment increased slightly in the past two years (ITDM 86% and BDM 81% compared to 2007:ITDM 77% and BDM 78%).

But is it enough of an increase? Interestingly, the increase only represents a 10% increase over 2 years from an IT perspective and only 3% from a Business decision maker perspective. Considering the importance of Disaster Recovery in this day and age, one would expect that deployment growth should be a little higher.

With 30% of IT decision makers giving their organizations a “C” rating or worse, the real market opportunity here appears to be in the realm of continuous improvement of existing plans (through plans testing, deficiency discovery and minimization, and implementation of improvements).

While the economy has impacted IT budgets overall, respondents indicate the economy has not impacted their investment for Disaster Recovery (BDM 49% and ITDM 43%). One-third of ITDMs (33%) indicated investment in disaster recovery has become more important, significantly more so than the 18% of BDMs. Evidently, this may be a major disconnect between attitude and actions since ITDMs (42%) and BDMs (32%) identified insufficient funding as the largest challenge to developing recovery plans.

Market Overview/Dynamics


86%

83%

83%

75%

74%

69%

63%

61%

66%

65%

87%

78%

78%

49%

68%

68%

72%

62%

Availability of Network, Data, Systems, and Applications

Customer Satisfaction

Information Availability

Cost Containment

Disaster Recovery/Business Continuity

Regulatory Compliance

Profitability

Revenue Generation

Risk Mitigation

Attitudes in 2009

IT Business

*

*

*

Elements of Business Success

Q600 Thinking specifically of your area of responsibility, please tell us how important each of the following items are to the success of your business. Base: Qualified Respondents; 2007 ITDM (n=351); 2007 BDM (n=176); 2009 ITDM (n=220); 2009 BDM (n=277)

There is a distinct difference between perceptions of IT DMs and Business DMs relative to the importance of availability of networks, data systems and applications as well as with disaster recovery to the success of their business.Business DMs are significantly less likely to find these items very important. This is true in both the 2007 and 2009 studies.

*Tested significant to 95% confidence

*

*

*


12%

10%

21%

13%

5%

20%

19%

12%

10%

14%

5%

5%

19%

35%

0 - 3 months ago

3 - 6 months ago

6 - 12 months ago

12 - 18 months ago

18 - 24 months ago

Over 2 years ago

Cannot recall an outage

2009 - Last Outage

IT Business

*

*

*

Experience with Unplanned Outages

Q610 (Q522) When the last time was your company experienced an unplanned outage or a disaster? Base: Qualified Respondents; 2007 ITDM (n=351); 2007 BDM (n=176); 2009 ITDM (n=220); 2009 BDM (n=277)

19%

17%

21%

9%

8%

10%

17%

20%

11%

11%

7%

5%

14%

33%

0 - 3 months ago

3 - 6 months ago

6 - 12 months ago

12 - 18 months ago

18 - 24 months ago

Over 2 years ago

Cannot recall an outage

2007 - Last Outage

IT Business


*

About one-third of Business respondents cannot recall an outage. As can be expected, IT decision makers are more likely to be aware of outages. Respondents reporting outages within the past 0-3 months have seen a slight decline compared to 2007.


Tolerance of Unplanned Outages

Q625 Generally speaking, how would you say the tolerated amount of “downtime” for business systems and processes (such as network, email, databases, telecommunications, etc.) has changed, if at all, over the last 2 years? Base: Qualified Respondents; ITDM (n=220); BDM (n=277)

30%

36%

34%

Tolerated Downtime – IT

27%

31%

42%

Tolerated Downtime – Business

Significantly shorter

Somewhat shorter

Has not changed

Over the last two years, about 3 of 5 Business respondents say the amount of tolerated downtime has grown shorter. Two-thirds of IT respondents say the same.


Adequate Resources - IT

72%

23%

6%

2007 Adequate Resources – IT

Yes

No

Not sure

Q630 (Q535) Does your department have the resources and people in place to provide the adequate levels of system, application, and data availability?Base Qualified 2007 IT Respondents (n=351); 2009 IT Respondents (n=220)

71%

25%

5%2009 Adequate Resources – IT

About 7 in 10 IT respondents say their department has the resources and people in place to provide adequate support. This is on par with the 2007 study.


Adequate Resources - Business

72%

10%

18%

2007 Adequate Resources – Business

Yes

No

Not sure

Q635 (Q540) Does your company have the IT resources and systems in place to provide the adequate levels of system, application, and data availability?Base Qualified 2007 Business Respondents (n=176); 2009 Business Respondents (n=277)

79%

11%

9%

2009 Adequate Resources – Business

Nearly 8 in 10 Business respondents believe their company has the IT resources to provide adequate support. This is a slight increase from 2007.


Costs of Prolonged Lack of Availability of Business Systems

81%

77%

75%

66%

65%

56%

52%

81%

72%

69%

57%

58%

42%

38%

Lost Productivity

Impact on Customer Satisfaction

Lost Data

Lost Revenue

Impact on Employee Morale and Satisfaction

Impact on Ability to Maintain Compliance with Regulations

Loss of Customers to Competitors

Strongly/Somewhat Agree

IT Business

Q640 Please indicate to what extent you agree that each of the following represents a significant “cost” or consequence to your business in the event of an unplanned outage or disaster that resulted in a prolonged lack of availability of business systems, applications and business information.Base: Qualified Respondents; ITDM (n=220); BDM (n=277)

The biggest cost of an unplanned outage is the lost productivity followed by the impact on customer satisfaction, and lost data. IT respondents are significantly more likely to be concerned with lost revenue, impact on ability to maintain compliance with regulations, and loss of customers to competitors due to unplanned outages.


*

*

*


Types of Disasters or Major Business Disruptions: SunGard Declaration EventsSunGard: 100% success rate for customer recoveries (over 2,300 to date)

29

12

19

52

90

500

275

84

213

27

176

0 100 200 300 400 500 600

Bomb Threat/Evacuation

Building Damage, Gas/Water Break

Earthquake

Fire/Electrical, Explosion

Flood

Hardware Failure

Hurricane/Weather

Network Outage

Power Outage

Software

Terrorism

Eve

nt R

easo

ns

- Su

nG

ard

On

ly

# of Disasters

Source: SunGard Availability Services US data, September 2008


BS25999 and BCM Lifecycle


BCM Lifecycle

Understandingthe Organization

DeterminingBCM

Strategy

Developing andImplementing

BCM Response

Exercising,maintaining

and reviewing

BCMProgram

Management

BS 25999:1 Figure 1


BCM Lifecycle: Embedding BCM in the Organization’s Culture

BS 25599:1 Section 10 “… To be successful, business

continuity has to become part of the way that an organization is managed, regardless of size or sector.”

Awareness and ongoing skills training

More than “corporate culture,” this is “corporate policy” – Core Values

BCMProgram

Management

Understandingthe Organization

DeterminingBCM

Strategy

Developing andImplementing

BCM Response

Exercising,maintaining

and reviewing


BS 25999:2 – BCMS Lifecycle

Establish

Monitor andReview

Implementand Operate

Maintainand Improve

BusinessContinuity

Requirementsand

Expectations

InterestedParties

Continual improvement of the business continuity management system

BS 25999-2 Figure 1

InterestedParties

ManagedBusinessContinuity


Implementation of a Solution and Continuity Program


Backup Offsite

Backup Offsite

Immediate Response Life/Safety - Notifications

Immediate Response Life/Safety - Notifications Resume

Business Operations

Resume Business

OperationsActivate Incident

Mgmt. Plan

Activate Incident

Mgmt. Plan

Restore Applications

Restore Applications

Restore Data

Restore Data

Restore Platform

Restore Platform

Damage Assessment

Damage Assessment

Return Home

Return Home

Disaster Declaration

Disaster Declaration

Last OffsiteBackup

EventEvent

Recovery Time Achievable (RTA)

Restore Business Process

Restore Business Process

Relocate Business

Operations

Relocate Business

Operations

Restore System / Application / Data

Restore Business Operations

Restore Voice / Data Network Communication Restore Voice / Data Network Communication

Restore Network

Business Availability Recovery Process – End Game

Primary Site RestorationPrimary Site Restoration

Crisis Management

Recovery Point Achievable (RPA)

Process Backlog

Process Backlog

Recreate Lost Transactions and Newly Stockpiled Transactions

SYNCHRONI

ZATI

ON

SYNCHRONI

ZATI

ON

Vital Records

Tier-1 System / Application / Data

Switch Applications

Switch Applications

Switch Data

Switch Data

Switch Platform

Switch Platform


Business Continuity Program Organization

ConsistentProjects

PerformanceResults

Define & ImproveDefine & Improvethe Process and the Process and

StrategyStrategyPlan & ManagePlan & Manage

the Processthe ProcessExecuteExecute

the Processthe Process

Project Definition,Methods and Techniques

ProcessImprovements

PROGRAMMANAGER

PROJECTMANAGERS

TECHNICALSPECIALISTS

EXECUTIVE SPONSOR(CHAMPION)

QuarterlyUpdates

Direction


GETTING STARTING - SETTING UP A PROGRAM OFFICE

Key Steps-The key steps to setting up an effective Availability Program Office (APO) are:

Identify and define desired goals, objectives, business benefits and measurement methods for the APO

Define governance structure

Define the impact management process

Define leadership and communications protocols

Define risks and develop mitigation strategy

Define Project Support Office and Centers of Excellence

Define integration approach and methods


Business Continuity & Disaster Recovery

Programmatic solutions focused on quickly mitigating risk in business critical areas spanning the breadth of business, technology and crisis management

Update plans On-going

strategy & plan testing

Business availability plans

Technology availability plans

Testing plans

Availability strategy

Recovery strategy

Risk Business

impacts BC/DR

program

Assess Design Build Maintain

Program Support & Management

Business Continuity Management Software Implementation


Assessment / Capability Review

ReviewCapability &

Develop Action Plan

Client Issues:

What are the strengths andweaknesses of our present program?

Where should we focus our limited resources/dollars to get better return?

Do we understand our business and technology environments

Can we map business process to application to technology and understand those relationships

Output:

Assessment of: Management System and Organization Technology / Business Processes and Infrastructure Customer Requirements (RTO/RPO) Recovery Strategy (Alternate Facilities) Data Management Recovery Plans, testing, & maintenance

Recommendations for Improvement

Business / Technology

Profile


Pilot Analysis

Program Roadmap and Critical Milestones

August Sept. October November January February

Change MgtGap Analysis

Design Unit Testing DR Testing

Executive Signoff on

Design 8/30/08

Change ManagementProcess Review

December

Implementation

Change MgtProcess Development

Change Mgt. Pilot

Pilot Change Mgt Go Live 10/1/08

Change Mgt Go Live 1/1/09

Implementation of Tier 1 Applications in DR Landscape

Implementation of Tier 1 Infrastructure(Includes Migration) Unit Testing

Acceptance 1/15/09

Implementation Plan Completed

9/15/08

Change LeadershipPlanning

Implement Change Leadership Action PlanImplement Communication Plan

Organizational Analysis

Test Planning, includes: ID Test Goals/Objectives/Success Criteria Standard Test Planning Activities (weekly)

Develop Test FrameworkDevelop Testing Strategy

Develop DR Plans/Procedures

Test Report 2/28/09

DR Testing

Complete Feb 2009

Infrastructure in Place11/15/08


Risk Assessment / Business Impact Analysis

AssessInformationTechnology

Risks

AnalyzeBusiness

Impact/Needs

DefineRequirements

• RTO/RPO• Sites• Platforms

Review RiskManagement

Program

Outputs:

I. Executive SummaryII. Core Business ProcessesIII. Support InfrastructureIV. Business ExposuresV. Recovery Resource RequirementsVI. Recovery Alternatives

Client Issues:

Are we really at risk? What are our business exposures? What are the alternatives for

reducing those exposures?








Testing plans


Recovery strategy

Risk Business

impacts BC/DR

program





“Behind the scenes” notification process/ resources & response capabilities need to be built

Different roles, responsibilities & functions than exist today; Additional resources may be required

Plans / procedures need to continually evolve in real-time with the project

Service requires governance processes, tools & resources as well as recovery infrastructure & procedures

Program management & integration enables ongoing efficiency & effectiveness; Long term role for program governance

Recovery strategy drives detailed requirements & center design as well as long term cost effectiveness

Well-defined, documented, philosophy & objectives provides a foundation for short & long term activities

Building a Business Resumption Solution


Design Solution

• Detailed Design Statement• Cost / Benefit Analysis• Management Approval

Implement Solution

• Project Workplans• Funding• Resources• Schedule

Solution Design and Implementation

Outputs:

Strategies for IT, Business, and Crisis mgmt for all recovery tiers Detailed Design Document Detailed Implementation Plan Cost Estimates and Budget Tracking Implemented Solution

Client Issues:

Need “One-Time” Boostin Resources to Get Job Done

Lack Experience Missing/Short on Critical Skills


Selecting a Recovery Provider

When choosing a supplier of business recovery services, ask the following questions. The survival of your organization could depend on the supplier’s capabilities in these areas.

·Will your organization have access to dedicated, trained, experienced people to assist with recovery rehearsals and actual disaster recoveries?

Does the supplier offer multiple hot sites? Are they secure?·Can the supplier guarantee annual business recovery rehearsal time? How far in advance do rehearsals have to be scheduled?·What is the upper limit on the number of other subscribers using the recovery system you will be using? (HP recommends no more than 30 subscribers per system.)·Can the company provide you with a dedicated facility, if needed?·If you upgrade to new technology at the home site, will the supplier allow hot site upgrades with no penalty?·Can you use the hot site for tests other than business recovery rehearsals, such as operating system upgrades?·What are the penalties if a rehearsal is not completed within the allotted time?·Will your organization receive preferential treatment for the delivery of new systems if disaster strikes?·How close geographically are the vendor’s other customers who subscribe to your configuration?


Availability Cost Criteria

High AvailabilityInfrastructure

Tier 1

Network HA &End User

Connectivity Services

High AvailabilityTechnology

ManagedServices

TraditionalRecovery

Testing

HighAvailabilityServices

Comprehensive Support Test Time

Recovery Configurations Includes Testing

Design Implementation Expertise Operations Testing Services

Hardware - Disk Software – Ops/Monitor Services

Bandwidth Equipment SGN

Facilities Environment Floor Space

RECOVERYCOMPONENTS

Key Considerations

Risk Coverage

PeerComparisons

Percentage ofTotal IT Expenses

Charge back

Cost Allocation






Business / Technology availability plans

Testing plans


Recovery strategy

Risk Business

impacts BC/DR

program





Recovery Plan Development

Location - PhysicalInfrastructure

Business Processes /Functions

Notification Lists,Emergency Procedures,

Inventory Lists

Deliverables:

IT, Business, and Crisis Mgmt Recovery Plans Incident Management Procedures Defined Business and IT processes within a actionable plan Identified and trained recovery resources

Client Issues:

Need “One-Time” Boost inResources to Get Job Done

Lack Experience ... Want PlanThat Will Work

Missing/Short on Critical Skills Want to Make Sure the Plan is

Maintained Over Time


Management and Communications 1, 2

1 National Incident Management Systems (NIMS ICS)2 Hospital Incident Command System (HICS)

ExecutiveManagement

EmergencyResponse

IncidentResponse

IncidentCommandIncident

Command


Validation Testing

Develop Test Requirements

• Scope & Objectives• Customer Requirements• Funding / Resources• Timetable

Plan Tests

Perform Tests andAnalyze Results

Outputs:

Assessment of the Cost , Quality andOverall Effectiveness of the Present Testing Program – (Testing Program)

Improved Testing Capability including Testing Strategy Management Reporting & Metrics

Client Issues:

What is the right amountof testing?

What should we be spendingin testing each year?

What constitutes a successful test?What are other organizations doing?

How can we test more efficiently?








Testing plans


Recovery strategy

Risk Business

impacts BC/DR

program





Continuous Improvement / Program Sustainment

• Program Elements• Processes• People / Skills• Deliverables• Solution

Deliverables:

Updated Recovery Plan Documents Governance / Operational processes for Production Service Management Recommendations for Improvements to Lifecycle Processes Identification of Additional Resources – Funding or Personnel

Client Issues:

How do we maintain our program efficiently over time? Can we automate the maintenance process?

How can we integrate DR into ourday-to-day management processes, especially change management?

What resources are required to do an effective job of improving our programover time? How do we maintain our focuson DR in light of our many other priorities?


Supporting the End to End Process (Change Management – Quality Assurance)

PLAN PLAN BUILD BUILD RUN RUN

Client Internal Production IT ProcessClient Internal Production IT Process

- Requirements

- Analysis

- Design

Start 1. Gather DR

ROM Estimate

2. Complete AIA and

Requirements

3. Implement DR Design

Manage4. Validate

Business ConsultantBusiness Analyst

Project Manager

- Approval

- POC

- Procurement

- Final Solution

- Install/Provision

- Development

- Integration

- Burn in

- Validation

- Pilot

- Rollout

- Support

- Monitor

- Change Mgmt

Business

Driver

Business

Driver

Engagement

- Business Case

- Sponsorship


Organizational Entities

Email Changes

RecoveryStrategy

Recovery PlansTechnology

Profile PersonnelDatabase

DisasterRecovery

Information

Change Triggers

Business Changes Application Changes Recovery Objectives Organizational Changes Network Changes Vault List Software and OS Upgrades Database and Hardware Changes Restoration Procedure Changes Changes in Disaster Declaration Authority Off-site Storage Access Off-site Storage Hardware/Inventory Recovery Site Changes Hot Site Changes Middleware or Utility Upgrades Changes to Standards Backups Procedures Modifications Resulting from Tests

Minutes fromMeeting

Copiedvia Email

Form RequestingAdditional

Information

IncidentManagement

Team

SystemsOperations

Team

VariousSupportTeams

Meetings

Teams

Changes?Updates?

Action Required?

Configuration Management Process

KEEPING PEOPLE AND INFORMATION CONNECTED®

Thank You

keeping people and information connected ® implementing a business continuity capability name:mark...

Documents

sungard research slide

business qualified respondents

business areas

research methodology

business success

general information

disaster recovery bdm

disaster recovery plan