Work Area Recovery Strategy Decisions - Report Example

RPO and RTO

Question 1: Disaster Recovery

The case presented for ABC shows that a business recovery plan is an important document for every organization in the event of an unanticipated occurrence. It highlights the processes and steps for recovering and securing critical resources for business continuity. XYZ is a consultant procured to help ABC with the computer system and work area recovery plan. This paper on two perspectives; the operational impacts that a disruption may cause to ABC resources and the degree of criticality and the recovery strategies that will improve ABC’s Recovery Time Objectives and Recovery Point Objectives.

• List of Hardware/Software RTOs and RPOs

Software

Hardware

Platform

RTO

RPO

CAS

40 Midrange

4 hours

1 day

PCs

4 Mainframe

4 Hours

1 day

Workflow Routing

15 LAN

4 hours

1 day

• Technology Strategies

XYZ Consulting recommends that ABC uses continuous availability to duplicate essential data in the Jacksonville Technology Center to the hot site. Continuous availability is a disaster recovery method where data is replicated continuously from the primary site to hot site. In the case of a failure, the hot site automatically takes over the operation causing the lowest RTO and zero RPO. Continuous availability requires a hot site that resemble the primary site in equipment, operation and capability. Manual intervention is not required as the systems are automated to respond to disasters.

• Description of the Technology Strategy Adopted
• How the strategy works

A hot site is a viable disaster recovery site that allows a business to continue operations in spite of network or computer blackout in the main site. If the Jacksonville technology center becomes inoperable, the company can move its operations to a hot site. The hot site comprises of all the equipment including computer systems, networks, and working space to continue operations until the main site is restored.

Continuous availability is where data is continuously replicated in the hot site such that during a disaster, the system automatically failover to the hot site. The hot site for ABC will be located 75 to 100 miles away from Jacksonville, Mesa and San Antonio. The specific location of the hot site relative to the three locations is dependent on such factors as the business requirements, external environment and the requirement of the site to be outside the region

• Vendor/Internal strategy

On consideration for deciding on a vendor or an internal strategy is the cost factor. Considering the cost of setting up and managing versus the cost of renting a hot site, the latter is appropriate. An external vendor is suitable especially during the critical months of September to October when the fiscal year audit is done. For the other months, the company may be selective on what data needs to be included on the hot side.

However, caution needs to be exercised concerning data privacy and security in the hot site. Considering that the data handled is classified as identifiable information and guarded by appropriate controls such as HIPAA, the aspect of privacy and security is critical. The vendor should provide a detailed list of measures and controls used to secure data in their hot site.

• Justification for vendor/internal strategy

As indicated in the case, the RTO for PCs, CAS, and Routing workflow is four hours. The appropriate strategy is an alternate worksite that should be ready and operational in minutes. The hot site is a replica of the primary site and comprises of computers, telecommunication, communication, and environmental infrastructure required to continue operations just as the primary site. The primary site is linked with the hot site and synchronized for real time data transmission. Hence no single data will be lost as a result of a failure at the Jacksonville Technology Center.

• Evaluation of strategies not recommended for ABC

Several strategies are not appropriate for ABC. Basing on the RTO of the identified resources, it is not right to consider strategies with an RTO of more than 24 hours. These includes methods such as electronic vaulting, warm site, shell site, quick ship-purchase at the time of disaster, and reciprocal agreement. The only remaining options that offer RTO of less than 24 hours and are based on hot site are continuous availability and replication.

Remote Journaling

Remote journaling involves a process of copying changes in a database to a journal at specific times. During the time of a disaster, changes to the database are copied to a journal. Remote journaling will accommodate the low RPO requirement of four hours that are required at the Imaging Center in Jacksonville as well as other branches. However, it is not recommended because it exposes the data created and transmitted to the hot site at the time of failure or lose. Data held by ABC systems are sensitive and cannot be exposed at any given time as the company may face regulatory, reputational and legal action.

Replication

Replication is equally efficient as continuous availability but differs in the recovery data synchronization interval. A longer synchronization frame causes a higher probability of data loss and vice versa. The differentiating element is the manual recovery process at the primary site. The manual failover to redundant systems at the hot site is the disqualifying factor coupled with other issues such as high degree of human error, data corruption, and incorrect configuration. If data in the primary site is corrupted, replicated system would also be corrupted, rendering the recovery process useless. In order to solve data corruption instances, BCV need to be implemented. Replication is limited by cost. It is very expensive to set up and manage and hence could not be chosen for ABC.

Cold/Shell Site

This is a facility or room readied for a disaster. It may involve a truck with computing infrastructures such as LANs, cabling and electric that is kept on standby until the time of disaster. Hardware is not included in the cold/shell site and needs to be brought.

A cold/shell site would not work for Jacksonville Technology Center because it will not meet the RTO requirement of four hours. Since equipment and hardware need to be brought into the site, it will not be possible within the provided four hours.

Quick Ship Purchase

A quick ship purchase is where computer resources are procured at the point of the disaster. The Jacksonville Technology Center is identified and recovery process initiated.

The approach is not appropriate due to the low RTO requirement. The system needs to be up and running within four hours after the disaster. Quick ship purchase will not fit this requirement.

Reciprocal Agreement

A reciprocal agreement involves two companies or departments with the infrastructure capability that agree to use one another’s systems in case of a disaster. The data from the affected company/department is copied to the other to facilitate the continuation of operations.

A reciprocal agreement is not adequate for Jacksonville Technology Centre. Internally, the technology center possesses the resources that support other departments, and in the case of failure, other departments within ABC may not have the systems with adequate processing capacity. Externally, implementing a reciprocal agreement is difficult because it may not meet the RTO requirements of four hours.

• Wrap-up analysis

Continuous availability technique is regarded as the smartest approach to disaster recovery. Though it is the most expensive than other methods, it deliver zero RTO and RPO. ABC stands to incur huge amounts with this approach but is sure that it will not lose any data in case of a disaster. Continuous availability strategy is susceptibility to data corruption and requires Business Continuity Volume to minimize data corruption. Also, ABC needs to factor in a lot of disk space for the method.

Question 2: Work Area Recovery

• RTO for Work Area Recovery

The Jacksonville Regional Operations comprises of Customer Relations, Customer Phone Contact, Claim Payment Activities, and Utilization Management. The work area requirement for any recovery time objective duration remains constant. The number of seats required initially after at any given moment is constant at 311. The RTO of every department is four hours. The smaller RTO highlights the importance of the Jacksonville Regional Operations to ABC’s survival.

• Work Area Recovery Strategy

The work area recovery strategy recommended for ABC is to relocate to an alternate internal facility at the company. Once a disruption has been announced the services at the regional offices operations are shifted to another branch of ABC.

• Description of the strategy
• How the strategy will work

One of the work area business recovery options is relocating to an alternate internal facility at the company. The company should be located within a minimum of 35 miles from the primary disaster location. This option is chosen because of the minimal resource requirement and the small RTO. At the alternate facility, reconfiguration of the systems to accommodate new employees is conducted. The reconfiguration includes obtaining extra seats, setting temporary phone numbers or routing calls, and setting a connection to company resources.

Since the Jacksonville Regional Operations host critical resources with small RTO, the either of the other two regional offices should serve as an internal alternate facility. The alternate site can be carved out of the existing public spaces such as conference rooms. It is notable that 311 seat spaces with phones, fax machines, printers, and pre-wired cable for connecting PC‘s and LANs are required to support business functions. With a recovery time of only four hours, it is impossible to achieve this setting from scratch. As a result, the departments in the alternate region are juggled to give space for the affected regional operations. The juggling applies to departments with longer RTOs.

• Vendor/Internal strategy

An internal strategy is chosen over an external vendor. San Antonio is the preferred internal alternate facility. San Antonio is located a thousand miles away from Jacksonville Florida and takes 15 hours by road and few hours by air. Given the short RTO requirement, San Antonio will provide a short lead time between when operations are disrupted to when they are recovered and brought back to normalcy. The Regional Operations center in Jacksonville has 311 employees and it would be easier to transfer to San Antonio than to any other location.

• Justification of internal strategy

San Antonio regional office already possess appropriate resources regarding communication, computing, and network infrastructures and the process of re-arranging will be much easier than any other available option. The distance between Jacksonville and San Antonio is shorter than between Jacksonville and Mesa. It will be easy to transfer workforce to San Antonio within a day after emergency. Further, the internal strategy will safeguard data from privacy issues. Since ABC already has an access protocol, the rules that apply at Jacksonville Technology center also apply at San Antonio and other branches. Therefore, security incidences will be minimal.

• Evaluation of strategies not recommended for ABC

Some of the recommendation that is possible but was rejected includes working from home, setting up an external alternate site ATOD, and procuring an external vendor.

Working from home

For this option, employees are provided with the required resources in the form of laptops, phones, internet connectivity and support required to work from home. This option will make sure that operations continue as usual when disasters occur but expose data to security breaches. Working from home will not be appropriate because of security issues with the data, considering that they are protected by HIPAA regulations.

External Alternate site ATOD

An external alternate site ATOD will not meet the short RTO. An external vendor does not guarantee the specific location nor the standard in the facility and security of information and personnel.

Reciprocal Agreement

A reciprocal agreement is where two companies enter into an agreement to provide each other recovery workplace in case of an occurrence causing a disruption. For the case of ABC, the approach is not appropriate. ABC store personally identifiable information and a reciprocal agreement with another company mean that the privacy of client information may not be guaranteed.

Relocate to vendor facility

A company may enter into a contractual agreement with a vendor for the provision of an alternate work area in case of a disaster in the main site. For the case of ABC, the company will only need to make a call to the vendor informing of the disaster. However, the strategy is not appropriate because ABC has a large number of employees to transfer to the vendor site. The vendor site might not be able to accommodate all employees. Also, there is the challenge of configuring employees as required, for instance, separation of duties. The security requirements for data may not be meet at the vendor site.

• Wrap-up of analysis

The advantage with an internal alternate facility at either of the three branches is the absence of pre-configuration requirements. The facility is already operational and the only element to be switched is the company phone numbers that can be accomplished within five minutes. Further, ABC does not need additional investment in the internal alternative site apart from increasing bandwidth requirements and communication devices.