*David Danher – Principal Consultant, Data Management Consulting, TD*
The Macmillian Dictionary defines the term “fit for purpose”, as something being “good enough to do the job it was designed to do”. With the lack of Disaster Recovery (DR) standards, how can we measure if an IT DR programme is good enough to do the job it was designed to do? How can we draw some conclusions from business continuity standards? The below diagram sets out how two business continuity management standards (the British Standards Institution’s BS 25999 and the Business Continuity Institute’s Good Practice Guidelines) can apply to DR methodology, through five phases.
1. Understanding the organisation’s business compiles policy and framework documents, and invokes a Business Impact Analysis (BIA), and a Threat and Vulnerability Assessment.
2. Organisation’s disaster recovery strategies review technical options addressing the gap between business expectation and current state.
3. Developing and implementing the organisation’s DR solution and plan, implements the preferred option, and compiles the DR plan (DRP).
4. Exercising, maintaining, and reviewing organisations DR programme, exercises the plan and incorporates DR checklists/ processes into change and project management.
5. Annual reviews to embed a DR culture into the organisation. As we will see through some of Thomas Duryea’s clients, disaster recovery that is “fit for purpose” depends upon particular requirements, and may consist of implementing all, or some of the five phases.
The examples below will demonstrate that even with differing business and budgetary requirements, organisations can implement an incremental and scalable DR methodology to ensure their unique goals are met (i.e. fit for purpose).
**Golden Plains Shire Council**
Golden Plains Shire Council (GPSC) is a municipality of approximately 20,000 residents situated between Geelong, Ballarat, and Melbourne. It offers access to city services, and a mix of country lifestyle. GPSC has a tradition of wool and grain growing, and animal farming. Wine production is an emerging industry. GPSC’s business did not fully appreciate DR requirements and as a result of financial constraints, GPSC provided DR capability via five replication technologies. Issues with this included sustainability, complexity, service restoration, and business ownership. A BIA was conducted highlighting the recovery requirements of the business could not be met with the existing solutions; financial investment was required; and business continuity workarounds needed reviewing. The business also began to understand that DR was not solely “IT’s problem”. GPSC investigated technical solutions and is currently working to increase their DR capability. Independently to the BIA process, GPSC compiled a DR policy and framework, and as their DR capability increases, amendments to their DRP are being done. By undertaking all phases of the DR methodology (although not in strict order) GPCS have progressed from having some disjointed and complicated technical replication, and providing unknown DR capability, to having a defined DR stake in the ground – with support and understanding of the business to move forward and deliver a DR solution that’s fit for purpose.
Service Stream provide solutions in the telecommunications and utilities sectors in areas of construction and design, asset management services, contact centre activities, logistics, and technology solutions. The Communications division (SSC) is dedicated to the support of telecommunication networks, providing communication services matched specifically to their clients’ needs. SSC needed to establish a DR capability, however the DR policy and framework were not immediately required, as these would be adopted by the whole organisation at a later date. An abridged BIA was undertaken, which provided recovery requirements, restart order, and assisted in the determination of the technical solution. SSC established their DR capability utilising VMware’s Site Recovery Manager (SRM), which provided the required rapid return to service. The DRP was written and validated via an exercise, involving starting and validating all applications and data within the Vmware DR “bubble” environment. SSC have scheduled quarterly exercises, and by undertaking selected phases of the methodology, they have ensured their DR capability is fit for their purpose.
**Royal District Nursing Service**
Royal District Nursing Service (RDNS) has a staff of approximately 1,400, providing 24×7 home nursing and healthcare, with over 1.7 million client visits, and more than 550,000 hours of care per annum. This enables people to remain in their own homes, providing them with more independence, choice, and control in relation to their healthcare. RDNS operate two data centres with core IT capabilities replicated between them providing DR capability. Implementation of new IT infrastructure provided the opportunity to review DR processes which were incorporated into existing BC documentation. RDNS implemented a new DR programme, where the initial focus was documentation and a DR policy and framework were created. A DRP (including existing recovery procedures), was created for both data centres, allowing them to be amended as technical DR capability increased. An abridged BIA was undertaken using process recovery requirements captured in the (business continuity) BIA. Where these were unavailable, IT local knowledge was substituted to determine business
requirements. This resulted in minor amendments, to the deployed solution to closer align it to business requirements. By following all phases of the methodology in strict order, RDNS, have delivered a DR capability that is fit for purpose.