OPPAPERS.

COM

Another area private security management can add value to a business is business continuity
planning. While continuity planning may be viewed by some executives as less important
than dealing with everyday business challenges (Barr, 2004), it is reasonable to assume that
companies without a continuity plan will experience more difficulty and potentially suffer
greater revenue loss than a similar company with a continuity plan; post-disaster. In addition
to minimizing losses as a result of a disaster, business continuity plans can be a point of
advertisement that could attract new clients. Though continuity plans are ideally developed
with the input from department subject matter experts, the security management element
should be the natural selection for focal point or centralization.

Disaster Recovery Planning

December 10, 2005

Introduction
Common natural disasters area a leading cause of data loss says Bud Stoddard,
AmeriVault President and CEO. Events such as the 8.3 earthquake that struck Hokkaido Japan
September 25, 2003, and the firestorm in San Diego just weeks ago are just two examples of
how natural disasters are devastating millions of unprepared businesses around the world.
These are not the only events that must be considered, however. The terrorist attacks against
the US on 9/11/01 and the biggest blackout in North American history in August 2003 are
examples of man-made disasters.
A 2002 U.S. Bureau of Labor study showed that 93 percent of companies that lose a
significant amount of data fold within 5 years. Another survey found that only 60% of
businesses have a credible disaster recovery plan that is up-to-date, tested, and executable.
But just any plan wont do. A business recovery plan is a live document, it need to change,
evolve, and mature, says Joe Richardson, executive vice-president of operations and
administration at CIT.
In this paper, we will explore the pros and cons of basic prevention, outsourced
prevention, and advanced prevention. We will also report on Implementation strategies, how
to choose a method, return on investment, planning, and testing. We have also included a case
study as an example of why disaster recovery planning is so important to businesses today.

Basic Prevention Off-Site Tape Back Up

We are going to share a few different ways to help insure that data is safe in case of a disaster.
Unforeseeable problems such as fire, floods, viruses, theft, or corruption are just a few of the
disasters that can a strike a business. And because data equals money, they need to have their
data protected, somehow, someway either backed up and/or replicated off site. According to
Rick Lacroix of EMC in Hopkinton, Mass. Information protection has taken on new
importance over the past several years and customers and companies of all sizes are looking
for ways to safeguard their information.
One way to preserve the safety of data is tape backup. There are several software and off-site
facilities that will provide a service to customers needing this protection and it is not unusual
for an enterprise to spend 25% of its information technology (I.T.) budget on disaster
recovery. Many companies have tape backup as their entire disaster recovery plan. For some
businesses this is all they need or can afford although this is the least costly of the options
presented in this report, it is a risky way of ensuring your data is safe. Unless the media is
moved off-site, a disaster has the potential to destroy your backup tape along with your
original data. Obviously, this is the least expensive way to protect your data, but one must
way the cost of storing data off-site as opposed to the importance of the lost data. Research
has shown that more than 80% of the businesses suffering from catastrophic data loss have
gone out of business within 12 months. This shows the importance of data and computers in
businesses of all sizes.

Outsourced Prevention Offsite data center

There are many alternatives to data recovery systems. No matter the size, all organizations
need to consider having some type of a data recovery system in case a disaster strikes.
According to Claude Brazell, U.S. program manager for business-recovery services at HP in
Santa Clara, Responsibility for disaster-recovery planning still falls to I.S. 99% of the Time.
The I.S. organization needs to evaluate and analyze the impact of a loss of company data.
This evaluation leads to a plan to protect the company information so that they will be able to
recover from a major disaster.
Offsite disaster recovery vendors offer many services and full security of their clients data.
On a recent visit to the SBC disaster recovery center in Irvine, we were able to see first hand
some of the different options offered to companies to meet their individual needs. For
example, options include office space rental so that a company would have somewhere to
work and address critical business issues in an emergency. Clients are allowed 24-hour access
to their data and technical support is on available around the clock. Back-up generators supply
power in case of emergency and the electricity runs through a power conversion system to
ensure its purity. The data center utilizes the latest in fire suppression technology; systems
constantly sample the air, monitoring for possible fire or flooding. Depending on severity,
either dry pipe suppression or temperature reducing measures will be enacted. SBC also
offers service in other geographical areas, allowing a company to distribute risk in multiple
areas. It is in a companys best interest to not keep all of their eggs in one basket and research
all options available in order to protect their business data. Prevention is better than cure.

Advanced Prevention Hot Site plus tape

All organizations main objective is to resume business as usual within a reasonable amount
of time. But why should a company invest in a costly disaster recovery plan? Nearly one in
three companies operate without a formal DR strategy in place according to Imation
Corporation. Natural disasters only account for three percent of incidences reported by BI-
Tech. However, since 9-11, the power outages across the nation, viruses, and many natural
disasters recently have changed many organizations opinion of having such a plan.

So how does an organization implement a strategy? First management with I.T. must work
together and agree that a hot site is necessary. The second is to determine a geographic area
for this location. The hot site must be equipped with servers, networking capabilities, tape
and disk storage. This steering committee must be held responsible for the follow through of
the DR plan. Frequent tests must be performed to ensure the integrity of the data, software,
and hardware. Lastly, document the plan and maintain a copy onsite and offsite the
organization.

How much would a plan cost to be implemented? There are several different types of
products that can be purchased such as firewalls and external tapes recorders which all vary in
cost. Equipment may also need to be purchased to activate the secondary site. In addition to
the hardware and software, communications such as cellular phones, satellite phones, and fax,
must be taken into account. A secondary power source, such as a diesel generator, is
necessary considering the purpose of the structure. There will be several on-going costs like
rental space and consulting.
Maintenance is crucial in a successful implementation of a DR plan. Updating software and
hardware, periodic testing of the system, procedures, and constant training of employees must
continually be visited. No one can predict what may happen but it is always safe of an
organization to be prepared for the worst case scenario.

Implementation Strategy

Specific disaster recovery strategies vary by company; the primary reasons are the differences
in reliance upon I.T. and the time required to recover in case of a disaster.

One measure of reliance is determining the I.T. operating budget as a percent of the total
operating budget. Another measure of reliance is to simply evaluate operations to determine
how long it can run without a given computer system. Tape recovery yields the longest
amount of time following a disaster, while a hot site would provide the fastest recovery time.

Some organizations spend a great deal of money on business continuity; the nature of the
problem prevents any organization from achieving a 100% foolproof solution. However,
there are diminishing returns when spending money on disaster recovery. A company can
gauge an appropriate amount by doing the following:

1. Listing disasters that might occur based on the geographic location of the I.T. systems,
proximity to major cities, and business type
2. Multiply the number of days of downtime based on a given disaster times average
revenue lost per day
3. Average those figures
4. Compare against costs of each proposed recovery method

Finances may limit a company to a given budget for disaster recovery; the method above
gives a rough idea on the costs of a disaster; since disaster recovery is effectively an insurance
policy, managers can weigh the return on investment for each method.

After choosing a given disaster recovery method, I.T. departments must plan for its
implementation. This plan should address the concerns of a business in the case of a disaster,
plus provide expectations for recovery given a disaster. A good plan should be tested at least
annually. Per Sarbanes-Oxley regulations, there are requirements for public companies to test
their disaster recovery plans. Testing, while painful, is a necessary part of a good plan. A
false sense of security can oftentimes do more damage than not having a plan.

Case Study: Cantor Fitzgerald and eSpeed

The World Trade Center is a complex of seven commercial buildings in New York City that
was demolished by a terrorist attack on September 11, 2001. Two companies in particular,
eSpeed and Cantor Fitzgerald, L.P., had operations on the 101, 103, 104 and 105 floors.
Approximately one thousand people are employed by the two companies at the World Trade
Center. The impact at the World Trade Center's North Tower took the lives of 733 Cantor
Fitzgerald LP staff, including 150 IT workers. The north tower impact also took out eSpeed's
operations on the 103rd floor, which included some 250 Compaq and Sun servers running
Windows NT, Alpha/OpenVMS and Solaris. Noviello (eSpeeds CIO) estimated that 1,000
workstations were destroyed. The floor was also the center of software development activity,
and many developers used more than one desktop system, all of which were lost.

Business: eSpeed provides business-to-business electronic marketplace services, primarily in

bond trading. The company operates a private trading network, connected to more than 700
financial institutions. Under a joint operating agreement, it also provides all technology
services for Cantor Fitzgerald.

Chief Information Officer: Joseph C. Noviello

Financials in 2000: $110.6 million in revenue, with a net loss of $60.4 million

Business: Cantor Fitzgerald, L.P. is a financial services firm with operating units that are
involved in a variety of market-based business initiatives including portfolio trading,
investment banking, financial spread betting, market advisory, energy brokerage, CO2
emissions trading and electronic trading technology. Cantor benefits institutional investors
and traders around the world.

eSpeed's systems were built on a dual architecture that replicated all machines, connections
and functionality at the World Trade Center and at a Rochelle Park site, with a third facility in
London. The mirror site and the World Trade Center were connected by a high-speed optical
line, over which eSpeed linked the storage area networks at each site. Sybase data-replication
software mirrored critical databases between the sites. Half of the company's Microsoft
Exchange e-mail servers were also located full-time in Rochelle Park. Systems alternated
between the trade center and the mirror site, with particular products running live for a month
at one location and then switching to the other; about half of the company's approximately 40
products were live at each location at any given time. "In that sense we had run our disaster-
recovery tests the day before," says Noviello.

No firms suffered worse fates on Sept. 11 than Cantor Fitzgerald and its electronic
marketplace unit, eSpeed. More than 700 employees of the two companies died in the
destruction of the World Trade Center's north tower, where Cantor and eSpeed shared their
headquarters and a vital computer center. Yet eSpeed was up and running when the bond
market reopened at 8 a.m. on Sept. 13, a little more than 47 hours after the disaster. That was
possible in part because of some lucky timing. But the rapid response was due to careful
planning and help from other companies. Their size was a factor, as well. Different people
had had lots of exposure to different systems.

Thanks to planning, the company can keep operating, even if something should happen to
Rochelle Park. In the future, its data center in London will serve as the mirror site. Going
forward, the company's systems should be even more resilient. We are learning a lot of
lessons as we are restoring the system, says Noviello, including how to automate more
aspects of bringing systems back up. "And we are not restoring our bad habits."

There's no luck to Cantor Fitzgerald's being in business today. It was a matter of planning and
hard work. "People plan for disaster recovery. No one ever plans for the loss of equipment,
facilities and resources. To bring up our systems in 47 hours demonstrates our planning
toward building concurrent systems," said Noviello, adding, we did not lose any data.

Conclusion
In summary, careful planning and diligence in plan execution are necessary to implement a
business continuity strategy. The expenses associated with carrying out DR plan vary with
each organization; as long as companies rely on computers, there will be a need to implement
a disaster recovery plan.

Bibliography
Cantor Fitzgerald - Forty-Seven Hours by Edward Cone and Sean Gallagher
http://www.baselinemag.com/article2/0,3959,675273,00.asp
Computer Weekly, 9/9/2003, Anthony Adshead.
http://encarta.msn.com, 1997-2003 Microsoft Corporation
http://interchange.novastor.com/datasheet/tapecopy.html
http://www.computerwork.com/securitytopics/security/recovery
http://www.horizons.bc.ca/support/disasters.html
http://www.simplesan.com/benefits/dr.htm.
http://www.swc.com/new/articles/disaster.html
Information Management Journal, November / December 2003.
Richardson,,Joe: Executive Vice President of Operations and Administration at
CIT.,The Secured Lender, Disaster Recovery Planning are you prepared?, Mark Elmerick.
Stoddard, Bud: AmeriVault President and CEO, Information Management Journal,
November / December 2003.
The Secured Lender, Disaster Recovery Planning are you prepared?, Mark
Elmerick.
World Trade Center, Microsoft Encarta Online Encyclopedia 2003

How to Create a Disaster Recovery Plan

January 31, 2006

A Primer on How to Create a Bullet-Proof Disaster Recovery Plan for the Entire Organization

Elizabeth M. Ferrarini,
She is a free-lance writer from Boston, Massachusetts. Reach her at iswive@aol.com

Minutes after the first of two planes plunged into the World Trade Centers Twin
Towers on September 11, 2001, Morgan Stanley Dean Witter, Inc., the largest tenant in the
World Trade Center, declared a disaster and rushed its disaster recovery plan into place with
the help of SunGard Recovery Solutions, a third-party disaster recovery service provider. At
the last time, about seven other tenants in the World Trade Center followed suit and contacted
SunGard.

The events of September have made disaster recovery planning rise to the top of every
organizations IT department priority list. Until the first attack on the World Trade Center in
1993, few companies had even invested in shared data backups. Raging Wire
Telecommunications, a California disaster recovery firm, estimates that the 1993 bombing put
half the 350 companies in the World Trade Center out of business because of the disruption.
Thanks to improvements in disaster recovery planning, more tenants of the recent World
Center disaster will be spared, according to Raging Wire. However, about 82 percent of all
companies still dont have adequate disaster recovery plans in place, according to Raging
Wire.
 Too often, its takes a catastrophic event to propel organizations to consider more
rigorous disaster recovery plans. After all, the purpose of a disaster recovery plan is to allow
an organization to recover in case of an unforeseen event, everything form a major systems
outage, such as a tornado demolishing a data center to a building fire destroying the facility
and everything in it. A study by the University of Texas found that 85 percent of businesses
depend totally or heavily on information technology systems to stay in business, and that a
loss of those systems would cost businesses up to 40 percent of their daily revenues.

A disaster can strike at any time. In fact, there are more than 35 types of disasters,
ranging from the most common power outages -- to the most catastrophic earthquakes. In
essence, a disaster includes any type of interruption of service that results from some force
beyond the organizations control. Disaster recovery provides systematic procedures for how
to react to and how to recover from that ominous external or internal force. Disaster recovery
planning, which complements business continuity and contingency planning, ensures the
ability of the organization to function effectively if an unforeseen event severely disrupted
normal operations.

The following template will help the key individuals in your organization to go
through the thought process for preparing a disaster recovery plan, whichs aimed at restoring
all critical business functions, rather than disparate functions such as the data center, alone.

Gather Information

Organize the Project

A successful initiative of this magnitude requires these things: support from senior
management associated with the organization, a dedicated disaster recovery team whose
members have knowledge of critical business systems, and a well thought out planning
strategy and testing strategy.

The disaster recovery coordinator, working with the appropriate team leaders, should
perform steps 3 to 7. Senior executives responsible for disaster recovery planning will
perform the first two steps.

1. Determine which senior executive(s) will have overall responsibility for disaster
recovery.

2. Have this executive appoint disaster recovery coordinator.

3. Appoint a disaster recovery team leader for each operational unit, such as server
backup or telephone system.

4. Convene disaster recovery planning team and sub-teams as appropriate.

5. Working with senior executives responsible for disaster recovery, the disaster
recovery coordinator should identify the following:
 Scope the areas to be covered by the disaster recovery plan
Objectives what is worked towards and what is the course of action that the
disaster recovery team intends to follow
Assumptions what is being taken for granted or accepted as true without proof?

6. Set project timetable and draft project plan, including assignment of task
responsibilities.

7. Obtain senior managements approval for scope, assumptions, and project plan.

Conduct Business Impact Analysis

The disaster recovery planning team should perform this step to identify which
business departments, functions, or systems are most vulnerable to potential threats, what are
the potential types of threat, and what effect would each identified potential threat have on
each of the vulnerable areas within the organization.

1. Identify functions, processes, and systems.

2. Interview information systems support personnel.
3. Interview business unit personnel.
4. Analyze results to determine critical systems, applications, and business
processes.
5. Prepare impact analysis on interruption on critical systems.

Conduct Risk Assessment

The disaster recovery planning team should work with the organizations technical and
security person to determine the probability of each functional business units critical systems
becoming severely disrupted and to document the amount of acceptable risk the business unit
can tolerate. For each critical system, provide the following information:

1. Review physical security, i.e. secure office, building access off hours.
2. Review backup systems and data security.
3. Review policies on personnel termination and transfer.
4. Identify systems supporting mission critical functions.
5. Identify vulnerabilities, such as physical attacks, or acts of God, such as floods.
6. Assess probability of system failure or disruption.
7. Prepare risk and security analysis.

Develop Strategic Outline for Recovery

The steps outlined here provide all of the components necessary to perform a recovery.
These steps will help pull together information about the operations of all systems, especially
those owned or managed by non-technical managers with help from technical support
personnel. Steps one through four mainly apply to functional business units that manage
technology systems to process critical functions. The disaster planning recovery team and the
functional business unit may wish to appoint other appropriate individuals to perform
subsequent tasks.

1. Assemble groups as appropriate for the following:

 Hardware and operating systems
Communications
Applications
Facilities
Other critical functions and business processes as identified in the Business
Impact Analysis step.

2. For each system/process above quantify the following processing requirements.

Light, normal, and heavy processing days

Transaction volumes
Dollar volume, if any
Estimated process time
Allowable delays (days, hours, minutes, etc.)

3. Detail all the steps in your workflow for each critical business functions. (For
example, for payroll processing include each step that must be complete and the
order in which to complete them

4. Identify systems and applications.

Component name and technical identification if any
Type (online, batch process, script)
Frequency
Run time
Allowable delay (days, hours, minutes, etc.)

5. Identify all vital records.

Name and description

Type (backup, original, master, history)
Where are they stored?
Source of item or record
Can the record be easily replaced by another source?
Backup and backup generation frequency
Number of backup generations available onsite and off-site
Location of backups
Media key, retention period, rotation cycle
Who is authorized to retrieve the backups?

6. Identify if a severe disruption occurred what would be the minimum requirements

or replacement of the critical function during the disruption.

Type (server hardware, software, research materials, etc.

Item name and description
Quantity required
Location of inventory, alternative, or off-site storage
Vendor/supplier

7. Identify if alternative methods of process either exist or could be developed,

 quantifying on processing (include manual processes).

8. Identify person(s) who support the system or the application.

9. Identify primary person to contact if system or application cannot function as

normal.

10. Identify secondary person to contract if system or application cannot function as

normal.

11. Identify all vendors associated with the system or application.

12. Document business unit strategy during recovery (conceptually how will the unit
function?).

13. Quantify resources required for recovery by time frame.

14. Develop and document recovery strategy, including priorities for recovering
system/function components, and recovery schedule.

Review On-site and Off-Site Backup and Recovery Procedures

The disaster recovery planning team should perform this task to provide for a current
backup of critical program and data that can be used in the even of a disaster. To this end, the
disaster recovery planning time can reduce downtime and speed recovery.

1. Review current records (operating systems, code).

2. Review current off-site storage facility or arrange for one.
3. Review backup and off-site backup storage policy or create one.
4. Present to functional business unit leader for approval.

Select Alternate Facility

The disaster recovery should perform the task of looking for a location, other than the
normal facility, used to process data and or conduct business, in the event of a disaster.

1. Determine resource requirements.

2. Assess platform uniqueness of unit systems (Macintosh, IBM, etc.)
3. Identify alternative facilities.
4. Review cost/benefit.
5. Evaluate and make recommendation.
6. Present to business unit leader for approval.
7. Make selection.

Plan Development and Testing

Develop Recovery Plan

 This document defines the resources, actions, tasks and data required to manage the
recovery in the event of an interruption. The plan is designed to assist in restoring the business
process within the stated recovery goals. The disaster recovery coordinator, assisted by the
disaster planning committee as needed, should perform these steps.

1. Objective This may have been documented in the Information

Gathering phase. Establish information for each business unit

2. Plan Assumptions

3. Criteria for invoking the plan

Document emergency response procedures to occur during and after an emergency is

declared for that business unit, and after the emergency check the building before allowing
individuals to enter.

Document procedures for assessment and declaring a state of emergency.

Document notification procedures for alerting unit all senior management executives,
disaster recovery team members, and business unit executives.

Document notification procedures for alerting business units personnel of alternate

location.

4. Role Responsibilities and Authority

Identify disaster recovery team and business unit personnel.

Recovery team description and charge
Recovery team staffing
Transportation schedules for media and teams

5. Procedures for operating in contingency mode

Process descriptions
Minimum processing requirements
Determine categories for vital records
Identify location of vital records
Identify forms requirements
Document critical forms
Establish equipment descriptions
Document equipment in the recovery site and in the business unit
Software descriptions
Software used in recovery and in production
Produce logical drawings of communication and data networks in the
business unit
Produce logical drawings of communication and data networks during recovery
Vendor list
Review vendor restrictions
Miscellaneous inventory
Communications needs production and in the recovery site
6. Resource plan for operating in contingency mode

7. Criteria for returning to normal operating mode

8. Procedures for returning to normal operating mode

10. Testing and Training

Document testing data

Complete disaster/disruption scenarios
Develop action plans for each scenario

11. Plan Maintenance

Document maintenance review schedule (yearly, quarterly, etc.)

Maintenance review action plans
Maintenance review recovery teams
Maintenance review team activities
Maintenance review/revise tasks
Maintenance review/revise documentation

12. Appendices for inclusion

Inventory and report forms

Maintenance forms
Hardware lists and serial numbers
Software lists and license numbers
Contact list for vendors
Contact list for all staff with telephone numbers for home, work
numbers, cell phone, and pager
Network schematic diagrams
Equipment room floor grid diagrams
Contract and maintenance agreements
Special operating instructions for sensitive equipment
Cellular telephone inventory and agreement

Test the Plan

Testing the plan enables the disaster recovery planning team to see how their recovery
plan and procedures work in practice. It enables everyone to get a reasonable assurance that a
plan will make the grade when it really counts in an actual disaster.

1. Develop test strategy.

2. Develop test plans.
3. Conduct tests.
4. Modify the plan as necessary.

On-going Maintenance
Maintain the Plan

Disaster recovery plans can have a shelf life between six to 12 months depending on
the changes in the organizations procedures, systems, and personnel. Having a program in
place to maintain the plan will ensure that everyone, especially the disaster recovery planning
team, will be ready if a real emergency occurs.

The senior management executive responsible for disaster recovery assisted by the
disaster recovery coordinator should oversee this step.

1. Review changes in the environment, technology, and procedures.

2. Develop maintenance triggers and procedures.
3. Submit changes for systems development procedures.
4. Modify unit change management procedures.
5. Produce plan updates and distribute.
6. Establish period review and update procedures.

Crisis communication
July 9, 2006

At some point in time, nearly any company can come face to face with a crisis situation which
involves communication or in many instances, miscommunication. In some cases this could
be rumor control and/or response, negative press or even breakdowns in crisis communication
response. Whatever the situation, even the smallest of communication crisis can overwhelm
even the strongest of companies.

Crisis communication involves winning as well as keeping the confidence and trust of
key factors (media, employees, management, shareholders, stakeholder, suppliers, etc) when
things suddenly happen to go arry. It is about developing strategic plans of action,
communication counseling and training in communications with key personnel so that each
company can anticipate and respond quickly and efficiently in the face of a crisis situation to
avoid undue harm to the organization as a whole.

In researching consulting firms which handle crisis for business, it was found that they
are many and varied in the types of services which they provide. For example, on a search at
MSN.com, typing in the phrase Crisis Communication Consulting Firm produced nearly
252,000 results. The same held true with the phrase Business Crisis Consulting Firms with
results of over 253,000 results. Granted, many of these are just references to firms or web
pages listing firms of this nature, it is still a very overwhelming number.

Dialing it down a little further, it can be found that there are several firms out there
that promote themselves in dealing with either communication crisis or business crisis, though
typically these firms will include both services. For example, 2C Consulting, Crisis and
Continuity Consulting Services (http://www.2c-consulting.com/services.htm), offers a vast
array of services to their clients which include: Risk Assessment, Crisis Management Plan
Development, Crisis Communication Management and Planning, Personnel Awareness
Training and Development, as well as Disaster Planning and Recovery. 2C is not alone in
their offerings, during research, as many as twelve such firms offering similar services were
found within three pages of internet search using the same parameters.
 It was also found during the research for the viability of a consulting firm of this
nature some additional areas of interest. In one such search, a link to a business consortium
was also located using the same parameters. This consortium, known as All Hands, is a
unique consortium of emergency management and business continuity consultants who are
working together to provide an outsourcing resource for both public and private sector
organizations. In their service offerings they too provide similar services as all the other crisis
communication or business crisis consulting firms, but also offer assistance in: Homeland
Security, Threats Assessments, Mitigation Planning, Policies and Procedures, Simulation,
Terrorism and many more. They appear to be a very comprehensive firm which has a vast
knowledge and skill base to pull from.

The overall analysis of need is that there is a great deal of choice out there for organizations
facing crisis communication issues, all of which offer many services beyond communication
though focusing on that element as well.