Notes accompany this presentation. Please select Notes Page view. These materials can be reproduced only with written approval from Gartner. Such approvals must be requested via e-mail: [email protected]. Gartner is a registered trademark of Gartner, Inc. or its affiliates. A Risk-based Approach to Recovery & Continuity Management John P. Morency, CISA Research Director (978)-901-4123 [email protected]m
21
Embed
Risk Based Approach To Recovery And Continuity Management John P Morency
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Notes accompany this presentation. Please select Notes Page view. These materials can be reproduced only with written approval from Gartner.Such approvals must be requested via e-mail: [email protected] is a registered trademark of Gartner, Inc. or its affiliates.
A Risk-based Approach to Recovery & Continuity Management
FPC 65FPC 65NYS Circular Letter 7NYS Circular Letter 7
ASISASISState of NY FIRM White Paper on CPState of NY FIRM White Paper on CPNISCC Good Practices (Telecomm)NISCC Good Practices (Telecomm)
Australian Prudential Standard on BCMAustralian Prudential Standard on BCMHB221HB221HB292HB292
BS25999BS25999SS507SS507TR19TR19
CA Z1600CA Z1600
Title IX – 110-53 Title IX – 110-53
Fact #3: DR is (Very) Important (source: 2008 Gartner Research Survey)
Business Context -- The IT Risk Pyramid
• Data accuracy, timeliness and consistency• Financial reporting
• Regulatory compliance
• Opportunity capitalization• Response to competitors
• Implementing major strategic change
• Knowledge Sharing• Information Protection
• Attack Prevention
• Continuous application and data availability
• Management communication, coordination and orchestration
• Employee productivity
Source: Westerman, G. "The IT Risk Pyramid: Where to Start with Risk Management"" MIT CISR Research Briefing, V (1D), Mar 2005 and Westerman, G. & Hunter, R.: IT Risk, Business Consequences, Harvard Business School
"Controlling continuity risk not only improves business continuity, but also starts to improve access, integrity, and strategic change risks."
Business Agility
Availability & Continuity
Accessibility
Accuracy
IT R
isks
1. Remember: IT risk is business risk
2. Consider IT risks in terms of the four A's — Access, Availability, Accuracy and Agility — and their consequences
3. Fix the foundation: Plug the holes in the dike, consolidate the infrastructure and simplify applications, in that order
4. Create risk governance structure and process; embed IT risk management into every business decision
5. Create a risk aware culture — a culture that recognizes risk and can deal with it head-on
6. Look forward
7. Lead by example
Seven Risk Management Principles
Recovery & Continuity Business Case
“The Balancing Act”
Two Fundamental Questions
• How to define Marginal (or Residual) Risk
• How to Quantify Affordability
Generic Risk Definition Framework
Assessment Starting Point – ISACA P1
Focus on:
TBS
Application Risk Assessment – Part 1
Application Risk Assessment – Part 2
For each application, determine –
• What is the impact of downtime?
• Does increased downtime = increased impact ?
Risk-based BIA Model
For each application, determine –
• What is the impact of downtime?
• Does increased downtime = increased impact ?
Affordability Analysis Part I:Leverage DR Spending Benchmark Data
Source: Gartner November 2007
IT S
pe
nd
ing
Gro
wth
(%
) -
20
07
7
6
5
4
3
2
1
0
$1M $5M $10M
State & Local Government
Low End = $.51M
High End = $1.2M
Midpoint = $.9M
2007 IT Budget Growth Rate= 2.6%
Federal Government
Low End = $3.9M
High End = $9.9M
Midpoint = $6.9M
2007 IT Budget Growth Rate= 5.5%
Gartner IT Spending Benchmark DR Addressable Budget
Source: Gartner November 2007
DRM Critical Success Factors (CSFs)
1. RTO/RPO requirements are defined, documented and updated for production applications
2. Recovery Data Center supports Tier 1 and Tier 2 RxO requirements
3. Emergency communications are regularly tested
4. Application Recovery management procedures support Tier 1 and Tier 2 RxO requirements
5. Data Recovery management procedures support Tier 1 and Tier 2 RxO requirements
6. Workarea Recovery procedures support Tier 1 and Tier 2 RxO requirements
7. DR Plan Testing is performed at least twice a year
8. DR plans are updated to address execution deficiencies encountered during testing
9. Business Operations Restoration processes are defined and tested
10. DR Program reports are published and distributed to senior management
Definition: The actions that are needed in order to improve Disaster Recovery Predictability, Effectiveness and Efficiency
Source: Gartner November 2007
Affordability Analysis Part II:Self Assessment
• Which CSFs are supported today?
• What is the current Maturity Level for each CSF?
• Which additional CSFs need to be supported?
• What is the target capability maturity level for each CSF?
• What are the associated improvement costs?
- By Budget Line Item
• Which continuity risks will be mitigated? By how much?
• How will improvement be measured?
Source: Gartner November 2007
Defining Audit Ready Test Plans
Example - Objective # 4 Test Plan
Business Imperatives
• Beyond 12 months- Implement failover, recovery and restoration automation pilots- Align disaster recovery spending with risk management priorities- Evaluate the use of data center automation software to improve DR
execution efficiency and predictability
• Immediate- Ensure that DR Plan is current and relevant- Plan support for less-than-24-hour RTOs and RPOs- Increase the frequency and diversity of testing- Formalize DR and BC management responsibilities
• Next 12 months- Achieve a minimum of Stage 2 maturity if not already there- Evaluate the implementation of data replication pilots- Evaluate the implementation of server virtualization pilots- Improve recovery testing results and execution predictability