Transcript Slide 1
KEEPING PEOPLE AND INFORMATION CONNECTED® Name: Implementing a Business Continuity Capability Mark Horne Title: Consulting Solution Architect, Strategic Accounts Date: December 9, 2009 SunGard Research KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 2 Research Objectives SunGard Availability Services is interested in conducting research to evaluate the difference in perceptions between IT and business leadership relative to the impact of unplanned downtime on business success, and their strategies for disaster/unplanned outage risk mitigation. The information gathered from this research will identify disconnects between the two groups surveyed to develop initiatives designed to bridge gaps and educate and motivate proactive risk mitigation planning. SunGard commissioned Harris Interactive to conduct the research on their behalf in February, 2009. KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 3 Methodology Respondent Qualifications To qualify for this research, respondents had to meet the following criteria: – Business Qualified Respondents - Hold at least a Director level title and have associated responsibilities, such as budget and staff, in business areas. – IT Qualified Respondents - Hold at least a Manager level title and have associated responsibilities, such as budget and staff, in IT areas. – Work for companies with at least 50 employees. General Information A survey was administered in March 2009 – Data collection was conducted online – The survey took an average of 10 minutes to complete – There were 497 qualified respondents: 277 Business completes 220 IT completes SunGard was not identified as the sponsor of this research KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 4 Market Overview/Dynamics Most decision makers indicate their company has a Disaster Recovery plan in place. In fact, recovery plan deployment increased slightly in the past two years (ITDM 86% and BDM 81% compared to 2007:ITDM 77% and BDM 78%). But is it enough of an increase? Interestingly, the increase only represents a 10% increase over 2 years from an IT perspective and only 3% from a Business decision maker perspective. Considering the importance of Disaster Recovery in this day and age, one would expect that deployment growth should be a little higher. With 30% of IT decision makers giving their organizations a “C” rating or worse, the real market opportunity here appears to be in the realm of continuous improvement of existing plans (through plans testing, deficiency discovery and minimization, and implementation of improvements). While the economy has impacted IT budgets overall, respondents indicate the economy has not impacted their investment for Disaster Recovery (BDM 49% and ITDM 43%). One-third of ITDMs (33%) indicated investment in disaster recovery has become more important, significantly more so than the 18% of BDMs. Evidently, this may be a major disconnect between attitude and actions since ITDMs (42%) and BDMs (32%) identified insufficient funding as the largest challenge to developing recovery plans. KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 5 Elements of Business Success There is a distinct difference between perceptions of IT DMs and Business DMs relative to the importance of availability of networks, data systems and applications as well as with disaster recovery to the success of their business. Business DMs are significantly less likely to find these items very important. This is true in both the 2007 and 2009 studies. Attitudes in 2009 Availability of Network, Data, Systems, and Applications 86%* 83% 87% Customer Satisfaction 83% 78% Information Availability * 75% 78% Cost Containment Disaster Recovery/Business Continuity 74%* * 49% Regulatory Compliance 69% 68% Profitability 63% 68% 61% 72%* Revenue Generation 66% 62% Risk Mitigation IT * 65% Business Q600 Thinking specifically of your area of responsibility, please tell us how important each of the following items are to the success of your business. Base: Qualified Respondents; 2007 ITDM (n=351); 2007 BDM (n=176); 2009 ITDM (n=220); 2009 BDM (n=277) KEEPING PEOPLE AND INFORMATION CONNECTED® *Tested significant to 95% confidence © 2009 SunGard Availability Services LP. All Rights Reserved. | 6 Experience with Unplanned Outages About one-third of Business respondents cannot recall an outage. As can be expected, IT decision makers are more likely to be aware of outages. Respondents reporting outages within the past 0-3 months have seen a slight decline compared to 2007. 2009 - Last Outage 0 - 3 months ago 3 - 6 months ago 6 - 12 months ago 12 - 18 months ago 18 - 24 months ago Over 2 years ago Cannot recall an outage 2007 - Last Outage 12% 12% 10% 10% 3 - 6 months ago 14% * * 18 - 24 months ago 5% 5% 5% 35%* 8% 10% Cannot recall an outage 19% 21% 9% 7% Over 2 years ago 20% 19% 17% 11% 12 - 18 months ago 13% IT 11% 6 - 12 months ago 21% 5% 19% 20% 0 - 3 months ago 14% 17% IT Business 33% * Business Q610 (Q522) When the last time was your company experienced an unplanned outage or a disaster? Base: Qualified Respondents; 2007 ITDM (n=351); 2007 BDM (n=176); 2009 ITDM (n=220); 2009 BDM (n=277) KEEPING PEOPLE AND INFORMATION CONNECTED® *Tested significant to 95% confidence © 2009 SunGard Availability Services LP. All Rights Reserved. | 7 Tolerance of Unplanned Outages Over the last two years, about 3 of 5 Business respondents say the amount of tolerated downtime has grown shorter. Twothirds of IT respondents say the same. Tolerated Downtime – IT Tolerated Downtime – Business 30% 34% Significantly shorter 42% 27% Somewhat shorter Has not changed 31% 36% Q625 Generally speaking, how would you say the tolerated amount of “downtime” for business systems and processes (such as network, email, databases, telecommunications, etc.) has changed, if at all, over the last 2 years? Base: Qualified Respondents; ITDM (n=220); BDM (n=277) KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 8 Adequate Resources - IT About 7 in 10 IT respondents say their department has the resources and people in place to provide adequate support. This is on par with the 2007 study. 2007 Adequate Resources – IT 2009 Adequate Resources – IT 5% 6% Yes 25% No 23% Not sure 71% 72% Q630 (Q535) Does your department have the resources and people in place to provide the adequate levels of system, application, and data availability? Base Qualified 2007 IT Respondents (n=351); 2009 IT Respondents (n=220) KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 9 Adequate Resources - Business Nearly 8 in 10 Business respondents believe their company has the IT resources to provide adequate support. This is a slight increase from 2007. 2009 Adequate Resources – Business 2007 Adequate Resources – Business 9% 18% Yes 11% No 10% Not sure 72% 79% Q635 (Q540) Does your company have the IT resources and systems in place to provide the adequate levels of system, application, and data availability? Base Qualified 2007 Business Respondents (n=176); 2009 Business Respondents (n=277) KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 10 Costs of Prolonged Lack of Availability of Business Systems The biggest cost of an unplanned outage is the lost productivity followed by the impact on customer satisfaction, and lost data. IT respondents are significantly more likely to be concerned with lost revenue, impact on ability to maintain compliance with regulations, and loss of customers to competitors due to unplanned outages. Strongly/Somewhat Agree 81% 81% Lost Productivity Impact on Customer Satisfaction 77% 72% Lost Data 75% 69% Lost Revenue 66% 57% * Impact on Employee Morale and Satisfaction 65% 58% Impact on Ability to Maintain Compliance with Regulations 56% 42% * Loss of Customers to Competitors IT 52% 38% Business * Q640 Please indicate to what extent you agree that each of the following represents a significant “cost” or consequence to your business in the event of an unplanned outage or disaster that resulted in a prolonged lack of availability of business systems, applications and business information. Base: Qualified Respondents; ITDM (n=220); BDM (n=277) KEEPING PEOPLE AND INFORMATION CONNECTED® *Tested significant to 95% confidence © 2009 SunGard Availability Services LP. All Rights Reserved. | 11 Types of Disasters or Major Business Disruptions: SunGard Declaration Events SunGard: 100% success rate for customer recoveries (over 2,300 to date) Event Reasons - SunGard Only Terrorism 176 27 Software Power Outage 213 Network Outage 84 275 Hurricane/Weather Hardware Failure 500 Flood 90 Fire/Electrical, Explosion 52 Earthquake 19 Building Damage, Gas/Water Break 12 Bomb Threat/Evacuation 29 0 100 200 300 400 500 600 # of Disasters Source: SunGard Availability Services US data, September 2008 KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 12 BS25999 and BCM Lifecycle KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 13 BCM Lifecycle Understanding the Organization Exercising, maintaining and reviewing BCM Program Management Determining BCM Strategy Developing and Implementing BCM Response BS 25999:1 Figure 1 KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 14 BCM Lifecycle: Embedding BCM in the Organization’s Culture BS 25599:1 Section 10 “… To be successful, business continuity has to become part of the way that an organization is managed, regardless of size or sector.” Awareness and ongoing skills training More than “corporate culture,” this is “corporate policy” – Core Values KEEPING PEOPLE AND INFORMATION CONNECTED® Understanding the Organization Exercising, maintaining and reviewing BCM Program Management Determining BCM Strategy Developing and Implementing BCM Response © 2009 SunGard Availability Services LP. All Rights Reserved. | 15 BS 25999:2 – BCMS Lifecycle Continual improvement of the business continuity management system Interested Parties Interested Parties Establish Maintain and Improve Business Continuity Requirements and Expectations Implement and Operate Monitor and Review Managed Business Continuity BS 25999-2 Figure 1 KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 16 Implementation of a Solution and Continuity Program KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 17 Business Availability Recovery Process – End Game Tier-1 System / Application / Data Recovery Point Achievable (RPA) Crisis Management Immediate Response Life/Safety Notifications Last Offsite Backup Backup Offsite Event Activate Incident Mgmt. Plan Switch Platform Switch Applications Switch Data Restore System / Application / Data Restore Platform Restore Applications Restore Data Restore Network Restore Voice / Data Network Communication Restore Business Operations Damage Assessment Disaster Declaration Vital Records Relocate Business Operations Restore Business Process Process Backlog S Y N C H R O N I Z A T I O N Resume Business Operations Return Home Recreate Lost Transactions and Newly Stockpiled Transactions Primary Site Restoration Recovery Time Achievable (RTA) KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 18 Business Continuity Program Organization EXECUTIVE SPONSOR (CHAMPION) Direction PROGRAM MANAGER PROJECT MANAGERS TECHNICAL SPECIALISTS Consistent Projects Project Definition, Methods and Techniques Process Improvements Quarterly Updates Define & Improve the Process and Strategy KEEPING PEOPLE AND INFORMATION CONNECTED® Performance Results Plan & Manage the Process Execute the Process © 2009 SunGard Availability Services LP. All Rights Reserved. | 19 GETTING STARTING - SETTING UP A PROGRAM OFFICE Key StepsThe key steps to setting up an effective Availability Program Office (APO) are: Identify and define desired goals, objectives, business benefits and measurement methods for the APO Define governance structure Define the impact management process Define leadership and communications protocols Define risks and develop mitigation strategy Define Project Support Office and Centers of Excellence Define integration approach and methods KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 20 Business Continuity & Disaster Recovery Programmatic solutions focused on quickly mitigating risk in business critical areas spanning the breadth of business, technology and crisis management Assess Risk Business impacts BC/DR program Design Availability strategy Recovery strategy Build Business availability plans Technology availability plans Program Support & Management Testing plans Maintain Update plans On-going strategy & plan testing Business Continuity Management Software Implementation KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 21 Assessment / Capability Review Review Capability & Develop Action Plan Business / Technology Profile Client Issues: What are the strengths and weaknesses of our present program? Where should we focus our limited resources/dollars to get better return? Do we understand our business and technology environments Can we map business process to application to technology and understand those relationships Output: Assessment of: Management System and Organization Technology / Business Processes and Infrastructure Customer Requirements (RTO/RPO) Recovery Strategy (Alternate Facilities) Data Management Recovery Plans, testing, & maintenance Recommendations for Improvement KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 22 Program Roadmap and Critical Milestones August Sept. October November December January February Develop DR Plans/Procedures Develop Test Framework Develop Testing Strategy Test Planning, includes: ID Test Goals/Objectives/Success Criteria Standard Test Planning Activities (weekly) Implementation of Tier 1 Infrastructure (Includes Migration) Implementation of Tier 1 Applications in DR Landscape Unit Testing Acceptance 1/15/09 Infrastructure in Place 11/15/08 Change Leadership Planning Change Mgt Gap Analysis Organizational Analysis Change Mgt Process Development Test Report 2/28/09 Implement Change Leadership Action Plan Implement Communication Plan Pilot Analysis Change Mgt. Pilot Design Change Management Process Review Change Mgt Go Live 1/1/09 Pilot Change Mgt Go Live 10/1/08 Executive Signoff on Design 8/30/08 DR Testing Complete Feb 2009 Implementation Unit Testing DR Testing Implementation Plan Completed 9/15/08 KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 23 Risk Assessment / Business Impact Analysis Assess Information Technology Risks Analyze Business Impact/Needs Define Requirements • RTO/RPO • Sites • Platforms Client Issues: Are we really at risk? What are our business exposures? What are the alternatives for reducing those exposures? Review Risk Management Program Outputs: I. II. III. IV. V. VI. Executive Summary Core Business Processes Support Infrastructure Business Exposures Recovery Resource Requirements Recovery Alternatives KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 24 Business Continuity & Disaster Recovery Programmatic solutions focused on quickly mitigating risk in business critical areas spanning the breadth of business, technology and crisis management Assess Risk Business impacts BC/DR program Design Availability strategy Recovery strategy Build Business availability plans Technology availability plans Program Support & Management Testing plans Maintain Update plans On-going strategy & plan testing Business Continuity Management Software Implementation KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 25 Building a Business Resumption Solution “Behind the scenes” notification process/ resources & response capabilities need to be built Plans / procedures need to continually evolve in real-time with the project Different roles, responsibilities & functions than exist today; Additional resources may be required Service requires governance processes, tools & resources as well as recovery infrastructure & procedures Program management & integration enables ongoing efficiency & effectiveness; Long term role for program governance Recovery strategy drives detailed requirements & center design as well as long term cost effectiveness Well-defined, documented, philosophy & objectives provides a foundation for short & long term activities KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 26 Solution Design and Implementation Design Solution Implement Solution • Detailed Design Statement • Cost / Benefit Analysis • Management Approval • Project Workplans • Funding • Resources • Schedule Client Issues: Need “One-Time” Boost in Resources to Get Job Done Lack Experience Missing/Short on Critical Skills Outputs: Strategies for IT, Business, and Crisis mgmt for all recovery tiers Detailed Design Document Detailed Implementation Plan Cost Estimates and Budget Tracking Implemented Solution KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 27 Selecting a Recovery Provider When choosing a supplier of business recovery services, ask the following questions. The survival of your organization could depend on the supplier’s capabilities in these areas. ·Will your organization have access to dedicated, trained, experienced people to assist with recovery rehearsals and actual disaster recoveries? Does the supplier offer multiple hot sites? Are they secure? · Can the supplier guarantee annual business recovery rehearsal time? How far in advance do rehearsals have to be scheduled? · What is the upper limit on the number of other subscribers using the recovery system you will be using? (HP recommends no more than 30 subscribers per system.) · Can the company provide you with a dedicated facility, if needed? · If you upgrade to new technology at the home site, will the supplier allow hot site upgrades with no penalty? · Can you use the hot site for tests other than business recovery rehearsals, such as operating system upgrades? · What are the penalties if a rehearsal is not completed within the allotted time? · Will your organization receive preferential treatment for the delivery of new systems if disaster strikes? · How close geographically are the vendor’s other customers who subscribe to your configuration? KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 28 Key Considerations Availability Cost Criteria Risk Coverage Peer Comparisons RECOVERY COMPONENTS High Availability Infrastructure Tier 1 Network HA & End User Connectivity Services High Availability Services High Availability Technology Managed Services Traditional Recovery Facilities Environment Floor Space Bandwidth Equipment SGN Percentage of Total IT Expenses Charge back Cost Allocation Hardware - Disk Software – Ops/Monitor Services Design Implementation Expertise Operations Testing Services Recovery Configurations Includes Testing Testing Comprehensive Support Test Time KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 29 Business Continuity & Disaster Recovery Programmatic solutions focused on quickly mitigating risk in business critical areas spanning the breadth of business, technology and crisis management Assess Risk Business impacts BC/DR program Design Availability strategy Recovery strategy Build Business / Technology availability plans Testing plans Maintain Update plans On-going strategy & plan testing Program Support & Management Business Continuity Management Software Implementation KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 30 Recovery Plan Development Location - Physical Infrastructure Business Processes / Functions Notification Lists, Emergency Procedures, Inventory Lists Client Issues: Need “One-Time” Boost in Resources to Get Job Done Lack Experience ... Want Plan That Will Work Missing/Short on Critical Skills Want to Make Sure the Plan is Maintained Over Time Deliverables: IT, Business, and Crisis Mgmt Recovery Plans Incident Management Procedures Defined Business and IT processes within a actionable plan Identified and trained recovery resources KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 31 Management and Communications 1, 2 Executive Management Emergency Response Incident Command KEEPING PEOPLE AND INFORMATION CONNECTED® Incident Response 1 National Incident Management Systems (NIMS ICS) 2 Hospital Incident Command System (HICS) © 2009 SunGard Availability Services LP. All Rights Reserved. | 32 Validation Testing Client Issues: Develop Test Requirements • Scope & Objectives • Customer Requirements • Funding / Resources • Timetable Plan Tests What is the right amount of testing? What should we be spending in testing each year? What constitutes a successful test? What are other organizations doing? How can we test more efficiently? Perform Tests and Analyze Results Outputs: Assessment of the Cost , Quality and Overall Effectiveness of the Present Testing Program – (Testing Program) Improved Testing Capability including Testing Strategy Management Reporting & Metrics KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 33 Business Continuity & Disaster Recovery Programmatic solutions focused on quickly mitigating risk in business critical areas spanning the breadth of business, technology and crisis management Assess Risk Business impacts BC/DR program Design Availability strategy Recovery strategy Build Business availability plans Technology availability plans Program Support & Management Testing plans Maintain Update plans On-going strategy & plan testing Business Continuity Management Software Implementation KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 34 Continuous Improvement / Program Sustainment Client Issues: • Program Elements • Processes • People / Skills • Deliverables • Solution Deliverables: How do we maintain our program efficiently over time? Can we automate the maintenance process? How can we integrate DR into our day-to-day management processes, especially change management? What resources are required to do an effective job of improving our program over time? How do we maintain our focus on DR in light of our many other priorities? Updated Recovery Plan Documents Governance / Operational processes for Production Service Management Recommendations for Improvements to Lifecycle Processes Identification of Additional Resources – Funding or Personnel KEEPING PEOPLE AND INFORMATION CONNECTED® © 2009 SunGard Availability Services LP. All Rights Reserved. | 35 Supporting the End to End Process (Change Management – Quality Assurance) Project Manager Business Consultant Business Analyst Start 1. Gather DR ROM Estimate 2. Complete AIA and Requirements 3. Implement DR Design 4. Validate Manage Engagement - Business Case - Sponsorship Business Driver - Requirements - Analysis - Design - Approval - Install/Provision - POC - Development - Procurement - Integration - Final Solution - Burn in PLAN - Validation - Support - Pilot - Monitor - Rollout - Change Mgmt BUILD RUN Client Internal Production IT Process KEEPING PEOPLE AND INFORMATION CONNECTED® | 36 Configuration Management Process Incident Management Team Minutes from Meeting Systems Operations Team Copied via Email Meetings Various Support Teams Changes? Updates? Action Required? Changes Email Teams Change Triggers Form Requesting Additional Information Organizational Entities Disaster Recovery Information Recovery Strategy Recovery Plans Technology Profile KEEPING PEOPLE AND INFORMATION CONNECTED® Personnel Database Business Changes Application Changes Recovery Objectives Organizational Changes Network Changes Vault List Software and OS Upgrades Database and Hardware Changes Restoration Procedure Changes Changes in Disaster Declaration Authority Off-site Storage Access Off-site Storage Hardware/Inventory Recovery Site Changes Hot Site Changes Middleware or Utility Upgrades Changes to Standards Backups Procedures Modifications Resulting from Tests © 2009 SunGard Availability Services LP. All Rights Reserved. | 37 KEEPING PEOPLE AND INFORMATION CONNECTED® Thank You