6.5 Disaster recovery and business continuity planning and auditing

So today, we are from Group 10.

We will continue to present on Chapter 6

under Subtopic 6.5:

Disaster Recovery and Business

Continuity Planning and Auditing.

Assalamu Alaikum,

and hi, everyone.

We are from BlueTech.

In this video, we will present about

disaster

recovery and business continuity

planning and auditing.

First, of course, my name is Intan Sanwa

Binti Mahasi,

matric number 268061, and

I'm the first presenter. I will present

the definition,

purpose, and the main aspects of BRP.

Alright, I will proceed for the

definition part.

Disaster. What is disaster? Disaster is

disruptions that cause critical

information resources to be inoperative

for a period of time.

Disaster can be caused because of

environmental conditions,

system failure, or equipment failure,

or disaster can also be man-made. Any

incident that can takes more than

a suitable amount of time

to recover, or if it has more than an

acceptable range

of consequences, can be called a

disaster.

The examples of disaster are weather,

terrorism, disruption in expected services,

human error, and so on.

Disaster can be short or may last for a

long time,

but when an organization is ready for

any adversity, it strives hard and survives.

Disruption can lead to lost revenue,

brain damage,

and dissatisfied customers. And the

longer the recovery time,

the greater the adverse business impact.

Therefore, a good disaster recovery plan

should enable rapid recovery from

disruptions,

regardless of the source of the

disruptions.

The business continuity plan includes,

first, the disaster recovery plan, that is

generally the plan to be followed

by the business units to recover a harmed

or demolished

facility, or business functionality,

or an operational facility. Then, the

operation

plan, that is to be followed by the

business units

to get by while recovery is taking place.

Everything is the same as in the case of

the business continuity planning

or disaster recovery plan, with the

exception

that the continuity of the information

system processing is threatened.

Information system processing is one

operation

of many that keeps the organization not

only alive but also successful,

thus it is of strategic importance.

Thus, the event to be controlled is such

a disruption, that the objective

of the control measure is to survive an

interruption of the information system

processing.

Throughout the planning process of

business continuity,

the overall plan of the organization

should be taken into consideration.

All its plans must be consistent with

and support the corporate business

continuity plan.

This means that, especially those

information processing systems,

must have them more elaborated and ready

to start reserve processing facilities

that support key operations.

Next, the purpose and main aspects of DRP.

The purpose of DRP is to enable a business

to continue

offering critical services in the event

of a disruption

and to survive even a disastrous

interruption of

its activities. Next is the main aspects

of BRP

that business continuity planning has to

take into consideration.

First, the market and strategic goals of

the corporation.

Second, the strategic business processes.

Third, those key operations that are most

necessary to the survival

of the organization and the human or

material resources supporting them.

In the business continuity plan, it

includes

the disaster recovery plan to recover a

facility rendered

inoperable, including relocating

operations

to a new location, and the restoration

plan that is used to return operations

to normal, whether in a restored or

new facility, which is only after

mitigating the effect of your disruption

by restarting the business applications

involved.

That's all for my part. I will pause for

the next presenter.

Thank you.

Assalamu Alaikum, my name is Nur Athirah Haziqah Binti Mohd Said

and my matric is number is 264828. And I will

continue to present the objective of

Disaster Recovery Planning.

So, the first objective is to minimize

interruptions to the normal operations.

Which means by having this disaster

recovery planning,

we can minimize any problems of

disruptions that might be happen

later on to the normal operations. The

second objective is to limit the extent

of disruptions and damage.

Why limit the extent of disruptions and

damage? Because by having this DRP,

we can ensure that the disruptions does

not spread to any unrelated things,

so we can limit it. The third objective

is to minimize the economic impact of

the interruption.

For example, as nowadays, during this

COVID-19 pandemic,

when a company has this disaster

recovery planning, so the company has a

backup plan on how the company will

operate normally as usual.

Maybe in terms of meeting, they can do an

online meeting

so it can minimize the

economic impact due to the interruptions.

This is because they can continue

operate the company as usual

and the economic growth will not be

affected. The fourth objective is to

establish alternative means of operation

in advance.

Which means by having this DRP, it can

provide a planning with effective medium

of solutions globally,

if anything happens later on. The fifth

one

is to train personnel with emergency

procedures. For example,

when cyberattacks suddenly happen. So

when a company is applying this DRP,

the personnel knows the action to be

taken after the cyberattacks happen.

It's something like early preparation.

The management also

should regularly train the employees

about how to prepare

for a data breach or to avoid a data

breach in the first place.

The last one is to provide for smooth

and rapid restoration of service.

So when having this disaster recovery

planning, it can provide a smooth and rapid

restoration because this DRP continues

offering critical services in the event

of the

disruptions and to survive

even early disastrous,

interruptions

to its activities. So the next one is

the components of disaster recovery

planning.

So the next one is the components of

disaster recovery planning. The first one

is to

create a disaster recovery team. This

team will be responsible for developing,

implementing, and maintaining the DRP. All

employees should be informed of and

understand the

Disaster Recovery Planning and their

responsibility

if any disaster occurs. When having

this DRP team, the management will refer

straight to this team

easily when any disaster occurs, as this

team will be responsible

to inform and give understanding to all

employees about

what action that should be taken when

any disasters

occurs. So the second one: identify and

access disaster risk.

The Disaster Recovery team should

identify and assess

the risks to organization. Also, assist the

team in identifying the recovery

strategies and resources

required to recover from disasters

within a predetermined and acceptable

timeframe.

Which means after the DRP team

identified a risk,

then they will provide a planning with

effective medium of solution

globally, if anything happen later on.

So the third one is determine critical

applications,

documents, and resources. The plan should

focus on

short-term survivability, such as

generating cash flows and revenues,

rather than on a long-term solution of

restoring the organization's

full functioning capacity. The

organization must recognize

some processes that should not be

delayed if possible, for example, like

processing of payroll.

In simple words, I can say that when they

want to build a DRP,

so it should focus on short-term

planning to ensure that the company

survive rather than planning a long-term,

long-term planning. All the

important documents must not be delayed,

such as the processing of payroll.

The fourth one is specify backup and

off-site storage procedures.

All critical equipment, applications, and

documents

should be backed up.

What needs to be backed up?

Such documents like the latest

financial statements,

tax returns, inventory records, customer

and vendor listings.

Critical supplies required for daily

operations like checks and also the

purchase orders.

All critical supplies and a copy of the

DRP should be stored at

an off-site location. Which means,

which

locate all the backup data away from the

client's main premises.

So the last one is to test and maintain the

DRP.

The organization routinely test the DRP

to evaluate

the procedures documented in the plan

for effectiveness and appropriateness.

The recovery team should regularly

update the DRP

to accommodate for changes in business,

processes,

technology, and evolving disaster risks. So

basically,

test of DRP is important to establish if

the recovery objectives are achievable.

Maybe to improve any recovery processes

and to familiarize,

start with the recovery processes. This

test will be explained more details by

the next presenter.

Assalamu Alaikum, and hi, everyone. My name

is Norzawana Binti Zaini,

matric number 259065. So, I will continue the

presentation regarding the disaster

recovery testing. Okay,

so the purpose of DRT, Disaster

Recovery Testing is to discover flaws in

your Disaster Recovery Plan,

so you can resolve them before they

impact your ability to restore

operations. In other words, Disaster

Recovery Testing

allows you to identify potential errors

and issues

and develop solutions, so that in a real

disaster

your business will be able to

reestablish critical operations.

Okay, there are about five types of

Disaster Recovery Testing,

including walkthrough test, cutover

test, paper test,

simulation, and parallel test. Let us

start with the first one: walkthrough

test.

In this test, several business and

technology experts

in the organization will gather to walkthrough

the DRP

to discuss each step in the DRP, so that

they can

identify issues and opportunities for

making the

DRP more accurate and complete.

Next, cutover test. A cutover test is

to test recovery systems built

to take over the full production

workload in case of disaster.

Primary systems are

disconnected during the test. Next, paper

test.

In a paper test, members of the DRT team

read

and testify recovery plan documents, such

as

DR policies, procedures, timelines,

benchmark, and checklist. A hard copy of

documents should

be stored in a secure offline

environment and a digital copy in the

cloud.

Simulation is a simulated disaster in

which teams

must go through their documented

recovery plans to identify whether

emergency response

plans adequate. Another idea is to

hold the simulation

on a day that is not

announced ahead of time, so that

respondents

possibly be less prepared to respond.

This is a very real simulation

because, in fact,

anyone do not know when the catastrophe

may

occur. This is very important actually

for the teams

to practice the DRP in real life to make

sure that it's sufficient for DRT,

disaster recovery like fire drill,

for example. Parallel test. In a parallel

test,

recovery systems are tested to

make sure that in case of disaster, they

can perform

real business transactions supporting

key processes and applications.

Meanwhile, primary systems continue to

run the

full production workload.

Okay, so next, why does a DRP require

testing?

The reason is because to exercise the

recovery processes and procedures.

Next, to familiarize staff with the

recovery process

and documentation. Verify the

effectiveness of the recovery

documentation.

Verify the effectiveness of the recovery

site.

Establish if the recovery objectives are

achievable.

Identify improvements required to the DR

strategy,

infrastructure, and recovery processes.

Hi, Assalamu Alaikum, my name is Nur Shahirah Binti

Mohd Shuhir. My matric number is 261056.

I will continue within its subtopics,

which are Recovery Time Objective,

RTO and Recovery Point Objective, RPO.

I will also explain the differences

between these two recovery objectives.

Now, let's start with RTO.

So, what is recovery time objective?

Recovery Time Objective,

RTO, is the duration of time and a

service level

within which a business process must be

restored

after a disaster in order to avoid any

unacceptable consequences

associated with a break in continuity. In

other words, the RTO is the answer to the

question:

How much time did it take to recover

after notification of business process

disruption? In addition, RTO designates

the variable amount of data that will be

lost

or will have to be re-entered during

network downtime.

RTO also designates the amount of "real time"

that

can pass before the disruption begins to

seriously and

unacceptably impede the flow of normal

business

operations.

For example, if RTO is 24 hours, it means

the organization determined that

the business can maintain operations for

that amount of time

without having its normal data and

infrastructure available.

So if the data and infrastructure are

not recovered within 24 hours,

the business could suffer irreparable

harm.

Now, let's move to the next recovery

objective.

The next recovery objective is Recovery

Point Objective

or RPO. I will discuss briefly about RPO

in the next slides.

What is RPO? RPO is a measurement of the

maximum tolerable amount of data to lose.

In other words, RPO measures how much

data you can afford to lose

as the result of a disaster. RPO can help

the organization to measure how much

time

can occur between last data backup and a

disaster without

causing serious damage to the business.

On top of that,

RPO is very useful for an organization

to determine how often to perform data

backups.

So most businesses back up data at fixed

intervals of time, such as

once every hour, once every day, or

infrequently as once every week.

Example of RPO is: If the last available

good copy of data upon an outage

is from 18 hours ago and the RPO for the

business is 20 hours

then the organization is still within

the parameters of the Business

Continuity Plan's

RPO. In other words, it answers the

question

of: Up to what point in time could a

business process

recovery proceed tolerably given the

volume

of data loss during the interval?

So Recovery Time Objective, RTO, and

Recovery Point Objective, RPO,

are two of the most important parameters

of a disaster recovery or data

protection plan.

These are objectives that can guide

enterprises to choose an optimal cloud

backup and disaster

recovery plan. The RPO or RTO along with

the business impact analysis

provides the basis for identifying and

analyzing viable strategies

for inclusion in the business continuity

plan. Viable strategy options include any

which

would enable resumption of a business

process

in a timeframe at or near the RPO or

RTO.

At first glance, these two terms appear

to be quite similar;

however, there are some differences

between these two recovery objectives.

Now, let's differentiate these two

recovery objectives in the next slide.

The first difference between RTO and RPO

is

RTO has a broader purpose, as it focuses

more on downtime

of services, applications, and processes.

This is because RTO sets the boundaries

for the whole business

continuity management while RPO focuses

solely on the issue of

backup frequency. Other than that RTO's

concerned with applications and systems.

The measurement includes data recovery

but primarily

describes time limitations on

application downtime.

On the other hand, RPO only is concerned

with the amount of data that is lost

following a failure event. Furthermore,

RTO looks forward in time where it

focuses on the amount of time the

organization need

in order to resume the operations while

RPO

looks back in time where it focuses on

the amount of time or data that the

organization are willing to lose. That's

all from me. I will pass to the next

presenter.

Okay, next I'm going to explain on the

types of disaster recovery plan.

There are a variety of disaster recovery

plans actually

but I'm going to focus on the two types

while the other types

will be covered by my other teammates

later and the DR recovery plan.

Okay, the first type that I'm going to

cover is called Virtualization Disaster

Recovery.

It is actually a way to decrease the

amount of time

or reduce the time needed to perform a

full

restoration after they have been hit by

a disaster.

So, what does it mean by virtualization?

Virtualization, by definition, it is the

process

of creating a virtual version of a

system,

or a software, or even an entire working

environment rather than creating a

physical

replica. It can eliminate the need to

recreate a physical server when

something goes wrong.

How? By creating a multiple simulated

environments

or dedicated resources using a single

hardware system.

It also helps you split a single system

into multiple distinct environments

called virtual machines.

The physical system on which the various

virtual machines are created is

called the host

and the virtual machines are called guest.

Okay, next is Network Disaster Recovery.

A Network Disaster Recovery plan is a

set of policies and procedures that

ensure a network is reinstated to

its normal working operations after it

goes offline

or is disrupted after a

disastrous event.

It is a type of disaster recovery plan

that is specifically designed for

Internet

and external network infrastructure of

an organization.

Network Disaster Recovery plan generally

requires

listing this tab which should be

undertaken in order to restock network

connectivity,

identifying people responsible for

conducting natural disaster recovery,

assessing possible consequences of a

natural failure,

last, but not least, determining the best

strategies to mitigate them.

The main purpose of Network Disaster

Recovery is to ensure that

business services can be delivered to

customers

despite a disruption in network

connectivity.

However, disasters come in different

forms and sizes

which makes it hard

to predict what their impact would be,

which network

components would be affected, and how

many resources

would be required to restore network

connectivity.

Therefore, the best strategy for ensuring

a successful

natural disaster recovery is by

preparing for the worst case scenarios

in advance and finding the ways to

mitigate their impact.

Possible causes of nature failures,

include human errors

and network attacks. Human errors, we can

say that

sometimes network connectivity problems

might be the result of mistakes made by

employees when working with network

equipment

or manually configuring network

components without an adequate grasp

of knowledge while natural attacks

is a network services that can get

disrupted

after a cyberattack whose aim is to

prevent the organization

to deliver its services by forcing it to

shut down.

The next one is IT Disaster Recovery

Plan.

So, the next one is IT Disaster Recovery

Plan.

An information technology disaster

recovery plan should be developed in

conjunction with the business continuity

plan.

Business continuity plan is a process a

company undergoes to create a prevention

and recovery system from potential

threats, such as natural disasters or

cyberattacks.

BCP is designed to protect personnel and

assets

and make sure that they function quickly

when disaster occurs. Priorities and

recovery time objectives

for information technology should be

developed during the business impact

analysis.

Which means the company must know the

reason

why they want to develop the disaster

recovery plan.

Technology recovery strategies should be

developed to restore hardware,

applications, and data in time to meet

the needs

of the business recovery. In simple

words,

the management must provide a planning

with effective strategies or solutions

globally, if anything happen later on to

ensure that the company can

run smoothly as normal.

So, the next part is the information

technology recovery strategies.

Basically, these strategies should be

developed for IT systems,

applications, and data. IT resources

required to support time-sensitive

business functions

and processes should also be identified.

The recovery time for an IT resource

should match the recovery time

objective for the business functions or

process

that depends on the IT resource.

The next one is components. What

components related to this IT of

disaster recovery planning?

The first one is computer room

environment, which is

secured computer room with climate

control. If I'm not mistaken,

climate control is a temperature control

which fitted the computer room

environment.

Maybe the temperature is not too low and

not too high.

The second one is hardware. For example,

like networks,

servers, desktops, laptop, computers, and

also the wireless devices.

The third one is connectivity to a

service provider for example like fiber,

cable, wireless, and etc. The first one is

software applications, for example, like

electronic data, interchange electronic

mail,

enterprise resource management, and also

office productivity.

The next one is data and restorations.

Data restore is the process of

copying backup data from secondary

storage

and restoring it to its original

locations or new locations. So, the next

part is developing an IT disaster

recovery plan.

The first one is compiling an inventory

of hardware,

software applications, and data which is

gathering the hardware like laptop or PC,

which comes with wifi connectivity and

also

software needed, like, maybe cloud or any

other important software needed.

The second one is ensure that all

critical information

is being backed up. Critical information is

something like

latest financial statements, tax returns,

inventory records,

customer and vendor listings, and also

critical supplies that required for

daily operations like

checks and purchase orders is being

made up by using this

IT disaster recovery plan.

The third one is identify critical

software applications and data

and the hardware required to run them.

Maybe in terms of software, like

maybe in terms of software needed like

electronic mail network,

servers, or maybe like wifi to ensure

that it has connectivity to a service

provider.

The fourth one is using standardized

hardware that will help to replicate and

reimage

new hardware. The next one is to ensure that

copies of program software are available

to enable

re-installation on replacement

equipment.

The next one is to document the IT disaster

recovery plan

as part of the business continuity plan.

Because

business continuity requires a

company

to keep operations functional during the

event

and immediately after and immediately

after.

While disaster recovery focuses on how

you respond

after the event has completed and how a

company

would return to normal operation.

The next one is to test the plan

periodically to make sure that it works.

This test is also to ensure that it works

and to identify improvements required

to the IT DRP strategy infrastructure and

recovery processes. Okay, last but not

least, we're going to talk about audit

program for the DRP.

The objective is to evaluate documented

processes and procedures

for IS' Disaster Preparedness

compliance

and to ensure the continuance of key

business functions in the event of a

disruption.

The scope of this audit included: To

ascertain the existence and

effectiveness of the current IS disaster

recovery

plan and its alignment with the

enterprise business continuity plan,

policies, and procedures. Next, to evaluate

IS function's preparedness in the event

of a process disruption.

Last, but not least, to determine

compliance with applicable federal laws

and regulations.

There are many audit programs for the DRP

actually but

I only listed about five audit programs,

including audit

and validate the adequacy of the back up

data.

Well, actually it does not matter how

good your disaster recovery plan

is if your data is out of date and is in a

location

also affected by the disaster or has

become corrupted.

Next, audit and validate the testing of

the Disaster Recovery Plan.

Companies need to make sure the recovery

plan actually works

in an emergency, regularly conduct data

fight drills to test

every possible scenario from basic power

failures

to catastrophic events that could result

in multiple months of devastation.

Next, audit and validate passwords are

available to the Disaster

Recovery Plan Team. Password protection

is a key goal for data security.

Companies need to store

system passwords in at least two

geographically separate

secure locations. Make sure that more

than IT

staff, more than one IT staff person

has access to all password code.

Change this password promptly if a key

person leaves the company.

Next, audit and validate the Disaster

Recovery Plan is up to date.

Once a plan is created, it

needs to be

revised at least

on a quarterly basis. Last, but not least,

audit and validate there is physical

documentation of the Disaster

Recovery Plan. After creating a plan,

ensure that every process is well

documented,

describe the location of all system

resources needed to accomplish the

recovery,

store the documentation at multiple

locations,

paper and electronic, and verify that all

key personnel have easy access to the

manuals.

So, that's all from us. Thank you.