Catching up....

I just realized I had not posted to this blog since......well, since I experiencced BCP first hand!  I lived through the Iowa Floods and experienced both wonderful and disasterous Business Continuity Plans.  I don't have a ton of time to go through the details -- but if you are interested in specifics, just let me know.  I did write about it on my other blog here, and then I had a Systems Management News article (here) about Disaster Recovery.

I wanted to point out a site that came across my radar recently that I really like. Their slogan sums it up nicely -- Business Continuity = People, Process and Technology.  Check out STL here.

Virtualization and Disaster Recovery

Just a quick link to a nice article on how Virtualization is/can be used as a DR tool. Check out the IT Business Edge article here.

DR Best Practices, and TSP

Just a quick link to a SearchCIO article on Disaster Recovery lessons learned and best practices. Besides being a good article, I learned a new term - Telecom Service Priority, which is

"an FCC program that directs telecommunications service providers (e.g., wireline and wireless phone companies) to give preferential treatment to users enrolled in the program when they need to add new lines or have their lines restored following a disruption of service, regardless of the cause."

Check out the article here

BCP and DR Basics

CSOonline.com has a pretty decent article about the basics of DR and Business Continuity. As I've mentioned, I've known about DR and BCP concepts, but still consider myself pretty green on the subject. The article has a paragraph about the difference between DR and BCP.

Given the human tendency to look on the bright side, many business executives are prone to ignoring "disaster recovery" because disaster seems an unlikely event. "Business continuity planning" suggests a more comprehensive approach to making sure you can keep making money. Often, the two terms are married under the acronym BC/DR. At any rate, DR and/or BC determines how a company will keep functioning after a disruptive event until its normal facilities are restored.

Check it out here

Disaster Management Conference

Just a quick link to a conference I learned about - the World Conference on Disaster Management. It will be held June 15-18, 2008 in Toronto, Canada.

Check out their website here

FFIEC BCP Booklet Update

The Federal Financial Institutions Examination Council has released an update to their 2003 booklet on Business Continuity Planning. The booklet "provides guidance to assist examiners in evaluating financial institution and service provider risk management processes to ensure the availability of critical financial services."

I have only skimmed over the 132 pages so far, but it seems to be a very nice publication. Since I had not read the 2003 version - it's all new to me. :)

Check it out here

CARVER Method

As I mentioned early off in this blog -- I 'think' I know BCP and DR concepts, but at a pretty intro/101 level. Well, tonight I learned about a (new to me) cool concept, and sure enough, it dates back to World War II. :)

I was reading a December post at SearchDataCenter.com about "avoiding DR pitfalls" and the author talked about the CARVER Matrix.

"CARVER is an old scheme dating back to World War II and stands for criticality, accessibility, recoverability, vulnerability, effect, recognizability. The idea is to list as many assets with descriptions as possible and rank them one to five in each point to help you determine the vulnerability of your data center as a system."

There is a white paper linked in there article that goes into the matrix deeper. Pretty cool method to apply and think about when writing DR and BCP documents and processes.

Recover from a non-disaster

Just a quick link to a good article over at SearchDataCenter.com. It is from Bill Peldzus and titled "Are you operationally ready to recover from a non-disaster?"

Check it out here

HP Videos

HP can sure make some cheezy videos with their marketing budget. I think the first one is a bit old, but I thought I would post it anyway. It is the XP24000 disk array and the HP research team is simulating a data center fail over for disaster recovery by blowing up the primary data center. Check out this video, complete with hollywood narration, here.

Looking for something a bit more silly? ok.....

Business Discontinuity

The Data Center Journal has a nice article on " Business Discontinuity – 5 Common Mistakes and How to Avoid Them". To summarize, the 5 mistakes are:

1. Appointing the Incident Management Team late
2. Assuming the incident will happen at 2am on a Sunday morning
3. Assuming muster points will be available
4. Trying to scare senior management into addressing BCM
5. Forgetting about the importance of employee awareness

check out the article here

Value of Business Continuity Planning

Twin Cities Business Magazine has a nice article on BCP and a couple of case studies. It profiles two companies and their approach to BCP and discusses BIA (business impact analysis).

The good news is that when companies are able to put a dollar value or ranking on the potential impact of various events on their business, they generally find that the number is far higher than the investment required to fund a business continuity plan.

Check out the article here

DediPower Selected to Host Crisis Pro

Just a quick link to a DataCentres.com article. It covers UK Managed Hosting provider DediPower being selected by Risk Analysis Services to host Crisis Pro - a business continuity program.

Check it out here

Virtualization Used for BCP

Virtualization continues in 2008 to be a hot topic, as blogs are full of posts about it, new products continue to emerge, mergers of virtualization-related companies take place, and studies dig into the technology.

A recent Computer Associates-sponsored, independent study surveyed 300 CIOs of large companies around the world. The published results have a ton of interesting statistics about virtualization and future uses and concerns for the technology. For BCP purposes -the two interesting statistics were:

1. 34% (worldwide) said that the current use of virtualization was to "Support business continuity disaster recovery".
2. That same response was listed by 45% of respondents for the planned use of virtualization use 18 months from now.

Slides can be found here

and an article about the study on the Contingency Planning and Management site here

Definitions - Part 2

Continuing the definitions...courtesy of DRJ.com:

RTO (Recovery Time Objective): The period of time within which systems, applications, or functions must be recovered after an outage (e.g. one business day). RTO’s are often used as the basis for the development of recovery strategies, and as a determinant as to whether or not to implement the recovery strategies during a disaster situation.

RPO (Recover Point Objective): The maximum amount of data loss an organization can sustain during an event.

I may go on with some other BCP and DR terms, but next on my agenda is to cover the difference between BCP and DR. I have frequently heard the terms used interchangeably and they aren't / shouldn't be.

To start -- here is a link to an InformIT Reference guide that does a good job of explaining the difference.

Definitions - Part I

As promised....here is some Lingo 101 for BCP and DR.

Since reading Disaster Recovery magazine is partially responsible for maintaining my interest in the disaster recovery industry, I thought I would reference them to help with defining some of the terminology. The following definitions come from their excellent glossary. Since my primary blog covers data centers I felt it was only appropriate to start with some DR terminology as it relates to how data centers can be used.
-----------------------------------------

Cold Site: an alternate facility that already has in place the environmental infrastructure required to recover critical business functions or information systems, but does not have any pre-installed computer hardware, telecommunications equipment, communication lines, etc. These must be provisioned at time of disaster.

Warm Site: an alternate processing site which is equipped with some hardware, and communications interfaces, electrical and environmental conditioning which is only capable of providing backup after additional provisioning, software or customization is performed.

Hot Site: An alternate facility that already has in place the computer, telecommunications, and environmental infrastructure required to recover critical business functions or information systems.

Welcome!

Welcome to my BCP (Business Continuity Planning) Links blog!!

BCP and DR (Disaster Recovery) have always been an interest of mine and something that I wanted to learn more about. I plan on this blog being my way to learn about BCP and DR concepts while (hopefully) pointing others interested in the topic to useful news, knowledge and trends in the industry.

So.....pardon the basics, but just in case any readers come across this and want to start with the VERY basic concept, let's turn to the encyclopedia(Wikipedia):

Business Continuity Planning:

an interdisciplinary peer mentoring methodology used to create and validate a practiced logistical plan for how an organization will recover and restore partially or completely interrupted critical function(s) within a predetermined time after a or extended disruption. The logistical plan is called a Business Continuity Plan

Disaster Recovery

the process, policies and procedures of restoring operations critical to the resumption of business, including regaining access to data (records, hardware, software, etc.), communications (incoming, outgoing, toll-free, fax, etc.), workspace, and other business processes after a natural or human-induced disaster.

To begin I may set out and try to find some other definitions of BCP and DR, just to see how other experts or trusted sources define the concept. After that I want to dig into some of the primary terminology used when discussing these two things; such as impact analysis, hot site, warm site, cold site, RTO (Recovery Time Objective) and RPO (Recovery Point Objective). Next I will most likely dig into the magazines, portals and other blogs on the topic and finally I may narrow my focus to data centers and wide area networks - as they relate to BCP.

I promise not to dwell on the basics for too long -- but please comment if there is something you are interested in learning more on that I maybe didn't spend a lot of time on. Writing this particular blog is my way of learning more on the topic and industry as well as discovering the vast amount of information out there.

-John