Disaster Recovery Plan Template by Janco

DISASTER RECOVERY BUSINESS CONTINUITY PLAN TEMPLATE
by Janco Associates

The template is IS0 27000 Series, COBIT, Sarbanes Oxley, PCI-DSS, and HIPAA
compliant.

The plan is structured to attain the following objectives:
1. Recover the physical network within the Critical Time Frames established and
accepted by the user community;
2. Recover the applications within the Critical Time Frames established and
accepted by the user community; and
3. Minimize the impact on the business with respect to dollar losses and
operational interference.

This Disaster Recovery Plan (DRP) can be used as a Disaster Planning template
for any size of enterprise. The Disaster Recovery template and supporting material
have been updated to be Sarbanes-Oxley and HIPAA compliant. The Disaster
Planning Template comes as both a Word document and a static fully indexed
PDF document. The DRP/BCP Template includes:

* Disaster Recovery Plan and Business Continuity Template (WORD and PDF)
* Business and IT Impact Analysis Questionnaire
* Work Plan
* Disaster Recovery / Business Continuity Audit Program
* Pandemic Planning Checklist

Preparation for Disaster Recovery / Business Continuity in light of SOX has two
primary parts. The first is putting systems in place to completely protect all
financial and other data required to meet the reporting regulations and to archive
the data to meet future requests for clarification of those reports. The second is to
clearly and expressly document all these procedures so that in the event of a SOX
audit, the auditors clearly see that the DRP exists and will appropriately protect
the data.

The DRP template is over 200 pages and includes everything needed to customize
the Disaster Recovery Plan to fit your specific requirement. The electronic
document includes proven written text and examples for the following major
sections of a disaster recovery plan:
* Plan Introduction
* Business Impact Analysis - including a sample impact matrix
* DRP Organization Responsibilities pre and post disaster - DRP / BCP
checklist
* Backup Strategy for Data Centers, Departmental File Servers, Wireless
Network servers, Data at Outsourced Sites, Desktops (In office and "at home"),
Laptops and PDA's.
* Recovery Strategy including approach, escalation plan process and decision
points.
* Disaster Recovery Procedures in a check list format
* Plan Administration Process
* Technical Appendix including definition of necessary phone numbers and
contact points
* Job Descriptions
- Disaster Recovery Manager
- Manager Disaster Recovery and Business Continuity
- Pandemic Coordinator
* Work Plan to modify and implement the template. Included is a list of
deliverables for each task. (Risk Assessment and Vulnerability Assessment)

There is a extensive section that shows how a full test of the DRP can be
conducted. It includes
* Disaster Recovery Manager Responsibilities
* Distribution of the Disaster Recovery Plan
* Maintenance of the Business Impact Analysis
* Training of the Disaster Recovery Team
* Testing of the Disaster Recovery Plan
* Evaluation of the Disaster Recovery Plan Tests
* Maintenance of the Disaster Recovery Plan

- - - - - - - - - - -

“The DRP Template saved me about 6 months of work!” - Bob Rifenbury,
MCSE/CCNA Lauch Testing Lab

“I have received and I began using the template immediately. IT IS GREAT! Made
this process a snap for me. Cut my documentation time down from weeks to
hours! This document has made, what began to be an overwhelming process turn
into a snap!” - Kelly Keeler, Martin's Point Health Care.

- - - - - - - - - - -

TABLE OF CONTENTS

1.0 PLAN INTRODUCTION
1.1 Mission and Objectives
1.2 DRP Scope
1.3 Authorization
1.4 Responsibility
1.5 Key Plan Assumptions
1.6 Disaster Definition

2.0 BUSINESS IMPACT ANALYSIS
2.1 Scope
2.2 Objectives
2.3 Critical Time Frame
2.4 Application System Impact Statements
1. Essential
2. Delayed
3. Suspended
2.5 Summary Conclusion

3.0 RECOVERY STRATEGY
3.1 Approach
3.2 Escalation Plans
3.3 Decision Points
PLAN 1
PLAN 2
PLAN 3

4.0 DISASTER RECOVERY ORGANIZATION
4.1 Recovery Organization Chart
4.2 Disaster Recovery Team
4.3 Recovery Team Responsibilities
Recovery Management
Senior Recovery Manager Responsibilities
Pre-Disaster
Post-Disaster
Recovery Manager Responsibilities
Pre-Disaster
Post-Disaster
Damage Assessment and Salvage Team
Damage Assessment and Salvage Team Responsibilities
Pre-Disaster
Post-Disaster
Physical Security
Pre-Disaster
Post-Disaster
Administration
Pre-Disaster
Post-Disaster
Hardware Installation
Pre-Disaster
Post-Disaster
Systems, Applications and Network Software
Pre-Disaster
Post-Disaster
Communications
Pre-Disaster
Post-Disaster
Operations
Pre-Disaster
Post-Disaster

5.0 DISASTER RECOVERY EMERGENCY PROCEDURES
5.1 General
5.2 Recovery Management
5.3 Damage Assessment and Salvage
5.4 Physical Security
5.5 Administration
5.6 Hardware Installation
5.7 Systems, Applications & Network Software
5.8 Communications
5.9 Operations

6.0 PLAN ADMINISTRATION
6.1 Disaster Recovery Manager
6.2 Distribution of the Disaster Recovery Plan
6.3 Maintenance of the Business Impact Analysis
6.4 Training of the Disaster Recovery Team
6.5 Testing of the Disaster Recovery Plan
6.6 Evaluation of the Disaster Recovery Plan Tests
6.7 Maintenance of the Disaster Recovery Plan

7.0 APPENDIX
COMPANY Sales Offices
Recovery Team Phone/Address List
Vendor Phone/Address List
Off-Site Inventory
Hardware/Software Inventory
People Interviewed
Preventative Measures
Sample Application Systems Impact Statement

- - - - - - - - - -

EXCERPTS FROM DISASTER RECOVERY PLAN TEMPLATE
Copyright © Janco Associates, Inc.

1.0 PLAN INTRODUCTION

“COMPANY recognizing their operational dependency on computer systems,
including the Local Area Network (LAN), Database Servers, Internet, Intranet and
e-Mail, and the potential loss of revenue and operational control that may occur in
the event of a disaster; authorized the preparation, implementation and
maintenance of a comprehensive disaster recover plan.

“The intent of a Disaster Recovery Plan is to provide a written and tested plan
directing the computer system recovery process in the event of an interruption in
continuous service resulting from an unplanned and unexpected disaster. The
Disaster Recovery Plan preparation process includes several major steps as
follows:
- Identify Systems and Applications currently in use.
- Analyze Business Impact of computer impact and determination of critical
recovery time frames.
- Determine Recovery Strategy
- Document Recovery Team Organization
- Document Recovery Team Responsibilities
- Develop and Document Emergency Procedures
- Document Training & Maintenance Procedures.

“These steps were conducted and this document represents the completed effort in
the preparation of the COMPANY Disaster Recovery Plan.

- - - - - - - - - -

1.5 KEY PLAN ASSUMPTIONS

“The following assumptions have been established as the basis for the
development of the Disaster Recovery Plan:
- The plan is designed to recover from the "worst case" destruction of the
COMPANY operating environment. The worst case excludes any non-data
processing function that may be in close proximity to the data center or
workstations.
- Although the plan is designed for worst case, inherent in the plan strategy is
the ability to recover up to the most minor interruption, which is perhaps a more
likely situation.
- The plan is base upon a sufficient number of center staff not being
incapacitated to implement and affect recovery. Therefore, the level of detail of the
plan is written to a staff experienced in the Company’s computer services.
Development, testing and implementation of new technologies and applications are
suspended so that all resources are available to recover existing critical production
processing.
- Off-site inventory and equipment acquired through vendors is considered to be
the only resource with which to recover computer processing. Items at the original
site are not expected to be salvageable and used for recovery. This includes items
stored in any on-site security location.
- An alternate site (backup computer facility) in which to establish recovery of
computer processing is necessary. Time frame requirements to recover computer
processing are significantly less than estimated times to repair/reconstruct a data
center on an emergency basis.
- The computer facilities of the alternative site is not within the scope of this plan
and is assumed not to be impacted by any disaster which may interrupt computer
operations at COMPANY offices.

2.1 SCOPE

“The scope of the Business Impact Analysis is the COMPANY operating
departments supported by data center facilities located at _____________. This
network encompasses the following information technology services:
- General business applications, such as word-processing, spreadsheet and
database applications
- e-Mail
- File servers supporting all business operations
- Gateway to the host applications and other sites

“To determine the maximum time frame allowable, the following COMPANY
operating departments were interviewed (See Appendix - People Interviewed):
- Information Technology
- Sales
- Marketing
- Credit
- Finance
- Human Resources
- Manufacturing
- Distribution
- Customer Service
- Accounting
- Investor Relations

4.3.5 HARDWARE INSTALLATION

“The Hardware Team is responsible for site preparation, physical planning, and
installation of data processing equipment to meet the required processing capacity
of COMPANY in the event of a disaster. This includes responsibility for ordering
and installing hardware for both the alternative site and the permanent site.

“Pre-Disaster
- Understand role and responsibilities within the Disaster Recovery Plan
- Work closely with Recovery Management Team to reduce possibility for
disaster in data center (See Preventative Measures in Appendix)
- Train employees in emergency preparedness
- Participate in Disaster Recovery Plan tests as required
- Maintain current system and LAN configuration in off-site storage

“Post-Disaster
- Verify with alternative site the pending occupancy requirements
- Inspect the alternative site for physical space requirements
- Interface with Software, Communications and Operations Team members on
space configuration of alternative site
- Coordinate transportation of salvageable equipment to alternative site
- Notify Administration Team of equipment required
- Ensure installation of ___ temporary terminals connected to alternative site
mainframe
- Plan the hardware installation at the alternative site
- Install hardware at the alternative site
- Plan, coordinate transportation of and install hardware at permanent site, when
available”

- - - - - - - - - -

OPTIONAL Update Service Available: $399.00 Additional at time of order for
12-month subscription.
Includes a minimum of one update.
*** Specify at time of order. ***
- - - - - - - - - -
200+ pages. Microsoft Word format
Distributed by e-mail.
CD-ROM distribution also available - add $10.00
Order #DR639.
Special Order Item.
- - - - - - - - - -