Bazaar Ceramics Studio - Research Paper Example

disaster recovery plan work Company Profile Company Background Bazaar Ceramics Studio was established 20years ago as a small collective, operating in the picturesque township of Hahndorf, South Australia. In the first 7 years of its existence it operated as a co-operative with each member of the co-operative responsible for designing, throwing, glazing and firing their own work. A gallery director was employed to look after the gallery and all aspects of marketing. It has expanded over the years to meet demand. When Kim Hayward bought the business, the business moved into larger premises in Stepney, Adelaide. The production staff increased and currently includes a production manager, 2 full time ceramic designers and 6 production potters. Bazaar Ceramics has a wide range of products to meet the needs of clients both nationally and internationally. The studio produces exquisite one off sculptural pieces for the individual and corporate collector. Objectives and Overview IT systems have become increasingly critical to the smooth operation of a company, and arguably the economy as a whole, the importance of ensuring the continued operation of those systems, or the rapid recovery of the systems, has increased. This plan aims averting larger losses in the event that the businesses does not continue to operate due the risk occurring. The objective of this plan is to document critical resources and personnel requirements to protect the company if all or parts of its operations or computer services are interrupted by an outage or disruptive event.  Information such as; critical business processes, technology components required, manual work-around procedures, identified alternate recovery sites, and key personnel contact information will be documented.  Business Processes Vital. The business process areas under this category would include: accounting and finance, and sales. The hardware under this category includes: Cables, Router/Switch, PCs, Printer, and phone and fax machine. The software and data would include: MYOB and MYOB Data file. These functions cannot be performed by manual means or can be performed manually for only a very brief period of time. In applications classified as vital, a brief suspension of processing can be tolerated, but a considerable amount of "catching-up" will be needed to restore data to a current or usable form. Sensitive. The business areas under tis category would be purchasing and human resource management. The hardware would include: Cables, Router/Switch, PCs, Printer and the software and data would be the same as in the critical business process. These business processes can be performed, with difficulty but at tolerable cost, by manual means for an extended period of time. Sensitive applications also require "catching-up" once restored. Noncritical. This includes the administration areas not involving IT. The hardware required would be as in the sensitive business process above and the software and data would include MYOB + MS Word and MS Access and data would as in the above process but will also include: associated document, template and database files. These applications may be interrupted for an extended period of time, at little or no cost to the company and require little or no "catching-up" when restored. RISKS Possible disasters that can affect Bazaar ceramics include: 1. Natural Calamities. For example, floods, earthquakes, tornadoes, snowfall, hurricanes, tsunamis. This can lead to destruction of business premises. 2. Link and Power Failure or Malfunction. These can lead to serious business losses - e.g. Telecommunication link failure, power failure, network failure. This affects business software and data. 3. Criminal and Disruptive Activities. For example, hacking, cyber terrorism, denial of service attacks. Since the company’s information about customers and information about employees will be disrupted. Most of this information will be contained in its website hence this risk can be an annoying inconvenience or can put this company out of business. This is a threat the company’s software and data. 4. Civil Unrest. For example, rallies, strikes, riots, looting. This can lead to great losses of the company’s hardware including its products and buildings. Analysis of risks 1. Natural Calamities. For example, floods, earthquakes, tornadoes, snowfall, hurricanes, tsunamis can lead to destruction of business premises. This risk has a low probability of occurrence but in case of occurrence it would have devastating impact on the operation of the company and might even lead to the closure of the business. 2. Link and Power Failure or Malfunction. These can lead to serious business losses for example, Telecommunication link failure, power failure, network failure. This affects business software and data. There is a high probability of this risk occurring and the impact to the business would vary depending on the extend of failure or malfunction. 3. Criminal and Disruptive Activities. For example, hacking, cyber terrorism, denial of service attacks. The company’s information about customers and information about employees will be disrupted. Most of this information will be contained in its website hence this risk can be an annoying inconvenience or can put this company out of business. This is a threat the company’s software and data. There is high probability of the risk occurring. 4. Civil Unrest. For example, rallies, strikes, riots, looting. This can lead to great losses of the company’s. There is a low probability of this risk occurring but in case it occurs impact to the business operation will be devastating. Prioritisation of risks & rationale Acceptable risks Criminal and disruptive activities for example, hacking, cyber terrorism, denial of service attacks. This group of risks is acceptable because the likelihood of occurrence is high and its effects can be mitigated and should be mitigated so as to protect the company’s vital information should be mitigated because the company’s trade secrets and other vital information can be stolen and used by others. Link and Power Failure or Malfunction ; this can lead to serious business losses - eg. Telecommunication link failure, power failure, network failure. There is a high probability of the risk occurring hence mitigation is necessary to protect the company’s data. Natural calamities and civil unrest risks although they have a high impact but there is less likelihood of mitigation because if they happen they would destroy the whole business and the damage is uncertain. Disaster Prevention There are various ways of disaster prevention. These include: Facility Protection This may involve the following: Fire Detection & Suppression Systems- the company need to put in place regulations contained in the National Building Code of Australia (BCA). The company should also have fire detectors which will aid in fire prevention. Physical Security and Protection This would involve securing the company’s building, particularly those parts that contain vital hardware or data, can help prevent theft of vital equipment and data Power Protection and Continuity It seems that the more we rely on something, the bigger the consequences when that thing fails. In a modern business environment, we rely on electricity to power machines that are used in our business processes. The supply of electricity involves a vast amount of complicated infrastructure and technology. Any failure in the power 'network' can lead to a number of problems in the supply of power. The company should therefore use Uninterruptible Power Supply, standby generators and surge arrestors. Water Detection Water can be present as a result of plumbing leaks, air conditioning leaks, water cooling leaks or sprinkler system malfunction. Water leaks can cause electrical equipment to malfunction. Some equipment may not function at all after being damaged by water. Systems Protection Protecting the company’s I.T. Systems should be a major concern for the Managers and Network Administrators. It seems that if criminals can't break into your buildings, they will try to enter electronically. Some of the strategies you can use to protect I.T. Systems will be firewalls, Password authentification, Intrusion Detection Encryption, Public Keys, vulnerability Testing, User Anti-Virus Software, Operating System and Application Software patching/updating Data Protection/Preservation Installation of a back- up system. This because Hard drives has a bad habit of failing. So, making a back up copy of the company’s critical data is important. DISASTER RESPONSE To make this plan functional, each member of the business unit (department) must be trained in their respective recovery responsibilities, overall company emergency management procedures (Crisis Management) and Disaster Recovery (Technology) Plans.  Each member shall have in possession an electronic copy or printed plan that is not located at the work site.  This copy can be kept at employee’s home, in the offsite storage location, another facility. The procedure for disaster response should for everybody to respond to the disaster. The company should also put in place a list of who will be responsible for purchase, replacement, upgrade, maintenance, installation, configuration and customization of DR hardware and software. Who will be responsible for disaster prevention procedures for example security patrols, data backup Disaster Recovery The company should to come up with a list of employees who will be do what and when they will do it in the event of recovering from a disaster. These would be teams that carry out procedures related to disaster recovery, for example, restoring data from backups, replacing a hard drive and damage assessment team.  Declaring a Disaster The company should classify the disasters, (dividing them into hazards and events). In every disaster we should have an employee who is responsible to declare. This employee is the one who has the responsibility of declaring this kind of disaster. There is also an employee who is responsible to coordinate. This employee is the one who coordinates the implementation of the relevant procedures and ensures there is no overlap or contradiction DISASTER PLAN UPDATE This disaster plan should be updated yearly by the management and all other stakeholders of the company should be informed of any changes. The plan can also be updated due to occurrence of an event which was not foreseen before hence not included in the earlier plan. Disaster Plan Testing This plan should be tested every six months by the relevant people appointed by the management of the company. Reference Bazaar Ceramics. About Company, Accessed on 16th March 2011 from http://tle.tafevc.com.au/toolbox/items/024e1e56-0ea6-a7be-4d9c-9a7bbc5ff0e5/1/ViewIMS.jsp Read More