Hexistor BLOG

Maintenance and Updates

Your DR & BC plans are living documents that grow and change as your business grows and changes. Some of the common problems with Disaster Recovery and Business Continuity Plans are:

•Plans not up to date

•Communications

•Risk Event not identified

Maintenance (Keep your plans up to date)

DRP & BCP priorities can change as equipment, weather, or personal changes.

Validating and Implementing the Plans.

Now that the plans are written (part 3), and all departments have approved them. It's time to test them, the purpose is to see what's missing, redundant, and confusing. This will help create the final plans to implement in your business.

Validating the plans.

The time to get the plans right is during the test drills, it's too late for testing during an actual disaster.

In the beginning there will be a lot of testing. What this means is every department must put aside time to run through the practice shutdown drills. All employees must have a printed copy of the current plans. Most plans are a checklist of what to do before evacuating and re-starting the business.

The plan writers must be present for the testing, they will be watching and timing. Every time a checklist is found to be inaccurate it must be updated correcting the error. After the drill is over they should ask and answer questions from the employees. This will help create a smooth shutdown and evacuation flow during a real emergency. You must also practice your recovery plans. This will help determine the length of the recovery time need to get your business back up and running.

Writing the Continuity & Recovery Plans

Now that you have your risks identified from Part one & two, it's time to start writing your business continuity plans. Keep it simple, start with the basics. Who (which department) will be executing the plan? This is written with IT in mind, other departments will need their own plans.

Create a checklist for what to do when an equipment event happens. The goal of this list is to restore the business' service as quickly as possible. Keep in mind the information below the Impact Numbers. For these types of events you will need a minimum of 3 different checklists based on the Impact Number. Some equipment may require it's own checklist. The department that the checklist is being written for should be involved in the writing of the lists.

Impact Numbers 5 & 4 (Critical Business Equipment)

Requires immediate replacement of a part(s) or the whole computer. Your business should have replacement parts in it's inventory, a main vendor and a backup vendor, and a backup IT if your local IT is unavailable. In addition to online off-site backups this equipment requires on-site backups on hard drives for the fastest recovery.

Note: It's next to impossible to stock a duplicate of every piece of critical business equipment, this is why it is important to have a good connection with your vendors. Also review the Risk Number for this equipment, as it passes 7 it may be time to think about stocking those parts.

Identify the Risks that can Shutdown Your Business.

First, catastrophic events: nature happens,

What natural disasters have happen in or close to your area? Earthquakes, hurricanes, tornadoes, flooding, snow (ice) storms, etc.

Followed by man made disasters, which are harder to predict, but can include power outages, network outages, fires, gas leaks, train derailing, etc. You can learn from history, whatever has happened will happen again.

Second, inside event risks: Sooner or later every business will experience these events,

Why Businesses Need to Plan.

The most important asset for any business today is it's data. If a business looses it's data and it can not be completely and quickly recovered, it may be forced to shutdown. Over 50% of businesses never recover from this type of disaster. Most data losses will happen from business event risks or catastrophic events.

With the proper plans implemented your business will run smoothly, with a minimum of downtime during any disaster. Your insurance company may offer discounts when you have disaster and continuity plans implemented.

Two Types of Plans

Disaster Recovery Plans (DRP), plans created to handle catastrophic events. What is a catastrophic event? It is one or more natural or man made disaster that would cause a business to close and evacuate, flooding, hurricanes, earthquakes, fires, etc.

Business Continuity Plans (BCP), plans designed to handle event risks. What are event risks? Any type of internal business failure(s) that could cause a business to shutdown, even for a brief time. Event risks are not always hardware related, software updates and virus attacks can cause problems, but the number one overlooked risk is, human error. Note: Catastrophic events often create event risks.

Having DRP and BCP implemented at your business will help to keep your business safe and protected during any event with a minimized loss of downtime.

Business continuity planning (BCP) means that a business has a plan to follow when an event occurs that may stop it from operating. This could be anything from a minor interruption to a full blown disaster. The object of the plan is to keep the business safe and secure with a minimized loss of down time.

Most departments inside a business have a BC plan to follow when an event happens. These plans are called checklists, and they must be followed in order. This blog is for the IT department's BCP, to help create a checklist of what to do before and after the storm.

Once your location has become a hurricane watch or warning the threat to a suspension (shutdown) of your business is real. It's time to get out the checklist. Make sure everyone has a current copy and knows their assignments.

Caveat: This checklist is very basic. We know that every business is different. Use this information as a starting point to help create your own IT checklist for shutting down and restarting your business' computers. Once you have a checklist implemented you should run a full trial, making sure nothing has been forgotten and everyone knows what to do. Whenever you update or add any IT device, you should look at your checklist and update as necessary.

Before the Storm: Getting ready to secure your business' IT

Below is the national Institute of standards and technology's defination of Cloud Computing, http://csrc.nist.gov/groups/SNS/cloud-computing/

Authors: Peter Mell and Tim Grance

Version 15, 10-7-09

National Institute of Standards and Technology, Information Technology Laboratory

Note 1: Cloud computing is still an evolving paradigm. Its definitions, use cases, underlying technologies, issues, risks, and benefits will be refined in a spirited debate by the public and private sectors. These definitions, attributes, and characteristics will evolve and change over time.

Note 2: The cloud computing industry represents a large ecosystem of many models, vendors, and market niches. This definition attempts to encompass all of the various cloud approaches.

Hexistor has upgraded our resilient infrastructure with the addition of SAS 70 Type II/Tier III disaster recovery centers in four North American locations. The data centers are designed and constructed to deliver world-class physical security, power availability, and infrastructure flexibility and growth capacity.

The 100,000 square foot Tier III+ 2N+1, NEBS Level-3 building standards data center in Chicago's western suburbs is engineered with the highest level of redundant systems to deliver a 99.999% uptime service level agreement.

The SAS 70 audit independently verifies the validity and functionality of a data Center's control activities and processes. These control activities and processes are important to customers within the financial, healthcare, and insurance sectors, as well as to publicly traded companies who must validate the security of their financial and sensitive information controls. A yearly audit is performed to not only verify that procedures are in place and effective, but that they are maintained.

In addition to state-of-the-art data centers, customer data is stored on EMC/Avamar VMware Virtual Edition Data Stores. Avamar Data Store utilizes grid architecture, enabling linear performance and capacity increases by simply adding servers. To ensure a high availability, Avamar Data Store employs patented redundant array independent nodes (RAIN) technology to provide fault tolerance across the an Avamar grid -eliminating single points of failure.

The real to real challenge is not backup, but restoring your data for continuous business operations.

How long does it take you to restore data from your tapes system? - an hour - a day - a week

How long does it take you to recover from a failed server or all of your servers? -days -weeks

With Hexistor, Hybrid Cloud Data Protection

• File level restores are in seconds on demand over the Internet from data stored on disks offsite at secured disaster recovery sites.
• With bare metal restore servers are recovered in minutes from full disk images stored on onsite disks.