![A Risk-based Approach to Recovery & Continuity Management John P. Morency, CISA Research Director (978)-901-4123 [email_address]](https://image.slidesharecdn.com/risk-basedapproachtorecoveryandcontinuitymanagement-johnp-morency-100203074507-phpapp02/85/Risk-Based-Approach-To-Recovery-And-Continuity-Management-John-P-Morency-1-320.jpg)
Risk Based Approach To Recovery And Continuity Management John P Morency
- 1. A Risk-based Approach to Recovery & Continuity Management John P. Morency, CISA Research Director (978)-901-4123 [email_address]
- 2. Fact #1: “Disasters” happen more often than you think …. Source: SunGard Availability Services U.S. data Data Center Eqpt Failure, 483, 34% Weather-related disasters (e.g. hurricanes, floods, blizzards) 274, 20% Network Outage, 79, 5% Power Outage, 209, 14% Software, 27, 2% Terrorism, 176, 12% Building Damage, Gas/Water Break, 12, 1% Flood, 90, 6% Fire/Explosion, 47, 3% Bomb Threat/Evacuation, 27, 2% Earthquake, 19, 1%
- 3. Gartner Survey Findings: Last Time Continuity Plan was Exercised N=168 26% 28% 29% 16% 21% 23% 13% 20% 17% 20% 20% 17% 19% 25% 25% 16% 18% 17% 33% 18% 21% 35% 30% 36% 8% 10% 9% 13% 11% 7% 0% 20% 40% 60% 80% 100% Within the last six months Within the last year Within the last two years Never Not sure Disaster Recovery Work area/Workforce Continuity Business Resumption Contingency Planning Emergency/Incident Mgmt. Restoration Two-thirds of organizations have had to use their BCM/DR plans within the last two years.
- 4. Fact #2: Post-9/11 Surge in Business Continuity Regulations and Standards Consumer Credit Protection Act OMB Circular A-130 FEMA Guidance Document Paperwork Reduction Act FFIEC BCP Handbook Computer Security Act 12 CFR Part 18 Presidential Decision Directive 67 FDA Guidance on Computerized Systems used in Clinical Trials ANSI/NFPA Standard 1600 Sarbanes-Oxley Act of 2002 HIPAA, Final Security Rule FFIEC BCP Handbook Fair Credit Reporting Act NASD Rule 3510 NERC Security Guidelines FERC Security Standards NAIC Standard on BCP NIST Contingency Planning Guide FRB-OCC-SEC Guidelines for Strengthening the Resilience of US Financial System NYSE Rule 446 California SB 1386 Australia Standards BCM Handbook GAO Potential Terrorist Attacks Guideline Post-9/11 Pre-9/11 1991 - 2001 2002 2008 FPC 65 NYS Circular Letter 7 ASIS State of NY FIRM White Paper on CP NISCC Good Practices (Telecomm) Australian Prudential Standard on BCM HB221 HB292 BS25999 SS507 TR19 CA Z1600 Title IX – 110-53
- 5. Fact #3: DR is (Very) Important (source: 2008 Gartner Research Survey)
- 6. Business Context -- The IT Risk Pyramid Data accuracy, timeliness and consistency Financial reporting Regulatory compliance Opportunity capitalization Response to competitors Implementing major strategic change Knowledge Sharing Information Protection Attack Prevention Source: Westerman, G. "The IT Risk Pyramid: Where to Start with Risk Management"" MIT CISR Research Briefing, V (1D), Mar 2005 and Westerman, G. & Hunter, R.: IT Risk, Business Consequences, Harvard Business School Press, forthcoming. © 2006 MIT Sloan Center for Information Systems Research – Westerman "Controlling continuity risk not only improves business continuity, but also starts to improve access, integrity, and strategic change risks." Business Agility Availability & Continuity Accessibility Accuracy IT Risks Continuous application and data availability Management communication, coordination and orchestration Employee productivity
- 7. Remember: IT risk is business risk Consider IT risks in terms of the four A's — Access, Availability, Accuracy and Agility — and their consequences Fix the foundation: Plug the holes in the dike, consolidate the infrastructure and simplify applications, in that order Create risk governance structure and process; embed IT risk management into every business decision Create a risk aware culture — a culture that recognizes risk and can deal with it head-on Look forward Lead by example Seven Risk Management Principles
- 8. Recovery & Continuity Business Case “ The Balancing Act”
- 9. Two Fundamental Questions How to define Marginal (or Residual) Risk How to Quantify Affordability
- 10. Generic Risk Definition Framework
- 11. Assessment Starting Point – ISACA P1 Focus on: TBS
- 12. Application Risk Assessment – Part 1
- 13. Application Risk Assessment – Part 2 For each application, determine – What is the impact of downtime? Does increased downtime = increased impact ?
- 14. Risk-based BIA Model For each application, determine – What is the impact of downtime? Does increased downtime = increased impact ?
- 15. Affordability Analysis Part I: Leverage DR Spending Benchmark Data Source: Gartner November 2007 IT Spending Growth (%) - 2007 7 6 5 4 3 2 1 0 $1M $5M $10M State & Local Government Low End = $.51M High End = $1.2M Midpoint = $.9M 2007 IT Budget Growth Rate= 2.6% Federal Government Low End = $3.9M High End = $9.9M Midpoint = $6.9M 2007 IT Budget Growth Rate= 5.5%
- 16. Gartner IT Spending Benchmark DR Addressable Budget Source: Gartner November 2007
- 17. DRM Critical Success Factors (CSFs) RTO/RPO requirements are defined, documented and updated for production applications Recovery Data Center supports Tier 1 and Tier 2 RxO requirements Emergency communications are regularly tested Application Recovery management procedures support Tier 1 and Tier 2 RxO requirements Data Recovery management procedures support Tier 1 and Tier 2 RxO requirements Workarea Recovery procedures support Tier 1 and Tier 2 RxO requirements DR Plan Testing is performed at least twice a year DR plans are updated to address execution deficiencies encountered during testing Business Operations Restoration processes are defined and tested DR Program reports are published and distributed to senior management Definition: The actions that are needed in order to improve Disaster Recovery Predictability, Effectiveness and Efficiency Source: Gartner November 2007
- 18. Affordability Analysis Part II: Self Assessment Which CSFs are supported today? What is the current Maturity Level for each CSF? Which additional CSFs need to be supported? What is the target capability maturity level for each CSF? What are the associated improvement costs? By Budget Line Item Which continuity risks will be mitigated? By how much? How will improvement be measured? Source: Gartner November 2007
- 19. Defining Audit Ready Test Plans
- 20. Example - Objective # 4 Test Plan
- 21. Business Imperatives Beyond 12 months Implement failover, recovery and restoration automation pilots Align disaster recovery spending with risk management priorities Evaluate the use of data center automation software to improve DR execution efficiency and predictability Immediate - Ensure that DR Plan is current and relevant - Plan support for less-than-24-hour RTOs and RPOs - Increase the frequency and diversity of testing - Formalize DR and BC management responsibilities Next 12 months - Achieve a minimum of Stage 2 maturity if not already there - Evaluate the implementation of data replication pilots - Evaluate the implementation of server virtualization pilots - Improve recovery testing results and execution predictability
Editor's Notes
- #2: 2007 BCM Survey Results These materials can be reproduced only with written approval from Gartner. Such approvals must be requested via e-mail: vendor.relations@gartner.com. Conference Name Roberta J. Witty Month XX, 2007 Venue City, ST