This is an analysis of BIA and recommendation for BCDR Strategy.  REQUIRES expert understanding of RTO and RPO ability to accurately calculate same based one the provided data.  Also REQUIRES the ab

Homework #3 -

Use this as a guideline to ensure that you DOCUMENT AND ANSWER ALL OF THE ISSUES BELOW:

1. FORM # 58
   
   

2. DEPARTMENT NAME: Legal

1. LIST HARDWARE/SOFTWARE AND RTOS AND RPOS INDICATED.

1. RECOMMENDED STRATEGY AND STRATEGY NAME

Accessibility to key applications and data remains imperative to ensure Legal Department efficacy and the survival of the business in dynamic and highly competitive environments. 

Given the mission-critical nature of the Legal Department and the suggested Recovery Objective Time (RTO) of 1 Week, Recovery Point Objective (RPO) of 1 day, and minimal tolerance for data loss, this evaluator endorses the “Warm Site Electronic Vaulting” approach to recovery and data.

1. DESCRIBE YOUR STRATEGY BY DOCUMENTING THE FOLLOWING:

1. How Will Strategy Work:

Electronic Vaulting is a backup strategy involving the electronic transfer of data to a backup site using batch transmission. A copy of the data stored at the primary site is forwarded electronically to an offsite server at an alternate location.

The warm site provides restoration capabilities. Warm site hardware, communications interfaces, operating system, applications, and connectivity mimicking that of the productions site, albeit on a smaller scale, are established in advance at an alternate location. Software installation commences at the time of disaster (ATOD), so there may be some lag time, hence the one-week RTO.

Batch transmissions executed daily after the end of each business day provide a 1-day RPO.

1. Vendor/Internal Strategy:

This student recommends that the client employ a disaster recovery as service (DraaS) solution, using an external vendor to house and maintain Warm Site operations and to perform backups.

1. Justify Vendor/Internal Strategy:

The core functions of the company IT department embrace governance (operational parameters for work units, business rule integration, and subject matter domain expertise), infrastructure (telephony, hardware, networks), and functionality (application development, data maintenance, and user support). The use of a third-party vendor will permit the IT department to maintain a dedicated focus on these core functions. Warm Site Electronic Vaulting eliminates time spent to manage tape backups and associated offsite storage complications.

A third-party vendor offers specialized expertise beyond the current time-constrained capabilities of the company IT department. The vendor will provide data encryption, in-flight and at rest, to maintain an extra measure of security for confidential Legal Department data.  The vendor will also implement automatic systems to monitor data health. The vendor can also deliver a copy of Legal Department data to a system on which the department could resume operations if needed (additional cost may apply).

The cost of these services is negligible as compared to the advantages gained. This strategy accommodates the Legal Department RTO and RPO requirements sufficiently and without excess.

1. STRATEGIES NOT RECOMMENDED AS COMPARED TO RECOMMENDED STRATEGY:

1. Evaluate Strategies NOT Recommended:

We performed in-depth analyses and evaluations offering consideration for other BCDR strategies before delivering our recommendation.

Continuous Availability (with Hot site):

This approach offers the shortest timeframe for the restoration of hardware and software, an RPO of 0. The replication of data occurs continuously from the primary site to the hot site, and failover occurs automatically upon detection of an anomaly. This approach, the most costly, comes with susceptibility to data corruption.

Continuous Availability is the costliest approach and far exceeds the need of the Legal Department with an RPO of 1 day.

Replication/High Availability (with Hot site):

This strategy provides near-constant data synchronization, delivering RPO and RTO of 24 hours or less, mitigating data loss to the extreme. However, the manual failover to redundant systems at the hot site does affect the RTO and issues with the failover process could result in loss of transmission at the predetermined intervals of synchronization. Manual failovers are subject to human error. Furthermore, corruption of the primary systems may cause corrupted replication.

Replication/High Availability is a very reliable but costly approach, and that far exceeds Legal Department needs and specified requirements.

Remote Journaling (with Hot site):

This strategy is typically employed to support database systems, offering an RTO and RPO of 1 day or less. The journaling process performs error checking and registers only changes made to the database designated for copying or mirroring to the hot site. Error checking ensures database integrity. Possibility for data loss exists during transmissions executed at the time of a disaster. This option does not provide immediate restoration.

Though remote journaling does meet the Legal Department RTO requirement, it exceeds the RPO needs thereby rendering this option inconsistent and unnecessarily expensive.

Cold Site:

The Cold Site is a blank facility devoid of the hardware and software. Cold sites do come prepared with installed electricity and cabling, raised floors, and appropriate HVAC infrastructure. At the time of failure, the client must acquire the hardware, software and install both. Furthermore, the client also holds responsibility for establishing a means to restore backed-up data. This option necessitates an agreement with the facility owner/provider.

The Cold Site approach proves unviable as an option for mission-critical business functions like those within the Legal Department. The RTO may be extended up to two weeks, an unacceptable duration for the Legal Department with an RTO of one week. The cost of this option is typically minimal as one pays only for the facility long term, but one may be subject to paying a premium in cases of regional disasters. Furthermore, this strategy may be difficult to execute at the time of disaster due to the complexities of procurement processes, hardware availability during crises, and geographical implications.

Quick Ship—Purchase at Time of Disaster:

This high-risk strategy necessitates that all hardware and software shipping occur at the time of disruption, and the facility is also ATOD. The client must establish an agreement with a hardware vendor in advance. This setup offers no opportunity for the testing of recovery procedures. The organization may encounter difficult securing equipment, as many companies within the disaster zone may likely compete for same.

RTO presents as extremely high at two weeks or more, beyond the range of acceptability for the Legal Department.

Reciprocal Agreement:

The Reciprocal Agreement is typically a verbal arrangement established between two organizations or two internal departments located within a proximity of 75 to 100 miles from the respective primary site. The agreeing entities maintain similar environments, hardware, and software environments while having surplus capacity and processing time. They agree to use one another’s specified systems ATOD and to recover at the other organization’s facility and to support critical business functions during disruptions.

While there are no up-front costs associated with this strategy, we do not recommend this approach for the Legal Department for several reasons, specifically the following:

• Data confidentiality concerns arising from shared environments

• Legal concerns associated with difficulties enforcing verbal agreements

• The absence of RTO/RPO guarantees in this scenario

• Potential interference with operations

7. WRAP-UP OF ANALYSIS

1. Advantages and Disadvantages of Warm Site Electronic Vaulting

Advantages of Warm Site Electronic Vaulting include

• Meets the Legal Department RPO and RTO requirements within reasonable expense

• Alleviates the IT department from burdens associated with time spent on tape backup procedures

• Replaces tape backups and eliminates tape transportation

• Eliminates offsite tape storage issues

Disadvantages of Warm Site Electronic Vaulting include :

• The batch data transmission process may cause data loss

• Data restoration requires specific hardware

• Additional bandwidth requirements may apply

• Increased RTO because data restoration depends on the vault location, data volumes, and transmission speeds

• Requires researching vendors

• Requires a vendor contract and SLA

The importance of meeting the RPO/ RTO, tolerance for data loss, and cost considerations drive this analysis and conclude that Warm Site Electronic Vaulting is the most appropriate strategy for the Legal Department.