+ All Categories
Home > Documents > 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

Date post: 25-Dec-2015
Category:
Upload: noel-daniels
View: 351 times
Download: 1 times
Share this document with a friend
60
1 Copyright © 2013 Tech Mahindra. All rights reserved. 1
Transcript
Page 1: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

1Copyright © 2013 Tech Mahindra. All rights reserved. 1

Page 2: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

2Copyright © 2013 Tech Mahindra. All rights reserved.

2013

Tech Mahindra

Business Continuity ManagementBCP Educator Pack for Support Functions

Page 3: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

3Copyright © 2013 Tech Mahindra. All rights reserved.

Confidential © Tech Mahindra Limited – 2013

All rights reserved

The contents of this document are provided in confidence to client name

No part of this document may be reproduced, stored in a retrieval system or

transmitted in any form or by any means, electronic, mechanical, recording,

photocopying or otherwise without the prior permission of Tech Mahindra

Limited

Page 4: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

4Copyright © 2013 Tech Mahindra. All rights reserved.

BCM - Orientation Walk Thru

Need for BCP

BCM standard and Terminologies

Disaster Mgt and Org Structure – communication flow

Roles & Responsibilities

Test Conduct & Assessment

Exhibits – BIA and BCP

Page 5: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

5Copyright © 2013 Tech Mahindra. All rights reserved.

Concept of BCP

BCP (Business Continuity Plan) is- Business Continuity Plan is a documented collection of procedures and information that is

developed, compiled and maintained in readiness for use during a disaster to enable an organization to continue to deliver its critical activities at an acceptable predefined level.

A process to minimize the impact of a major disruption to normal operations. A process to restore normalcy to business as soon as possible after a crisis. It is phase of crisis management that follows immediate actions taken to protect life and

property.

Note- BCP is the Least Expensive Insurance any company can have.

Page 6: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

6Copyright © 2013 Tech Mahindra. All rights reserved.

Need for BCP in today’s world

The need for BCP in an organization arises-

– To identify the impact of potential loss, to formulate and implement viable recovery plans that ensure continuity of services.

– To minimize the loss of productivity in case of any calamity and to ensure faster resumptions of operations from alternate site.

– To ensure full commitment on the safety of employees, to protect company assets & to provide a high level of service to clients and users.

Note-

We live in a world where every minute of downtime can result in huge loss in business

Page 7: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

7Copyright © 2013 Tech Mahindra. All rights reserved.

ISO22301:2012 Standard for BCM

Why ISO22301 ?

ISO 22301 - Societal Security Business Continuity Management Systems, the world’s first international standard for Business Continuity Management (BCM), has been developed to help organizations minimize the risk of such disruptions.

Page 8: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

8Copyright © 2013 Tech Mahindra. All rights reserved.

ISO22301:2012 Standard for BCM

ISO 22301:2012 standard is :

- an upgrade from BS 25999 and is expected to become a leading Business Continuity framework worldwide. TechM is certified for BS25999 since 2009. - officially recognized and accepted worldwide internationally by national standards institutes in 163 countries. Whereas BS 25999 is officially recognized in UK only;  but implemented worldwide.  - puts a much greater emphasis on setting the objectives, monitoring performance evaluation and metrics – aligning BC to top management strategic thinking -The biggest similarity is that all core business continuity elements in BS 25999-2 are present in ISO 22301 too: business continuity policy, business impact analysis, risk assessment, business continuity strategy, business continuity plans, exercising and testing etc.

Page 9: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

9Copyright © 2013 Tech Mahindra. All rights reserved.

Key differentiators of ISO22301:2012 (earlier BS25999:2007)

Business Continuity Policy linkage with Organization objectives and Overall Organization Risk Management strategy.

Greater Emphasis on setting objectives , monitoring performance and Metrics.

Aligning BC to top management strategic thinking.

External and Internal Issues to be considered while determining the Scope of BCMS.

 Communicate Business Continuity Policy to Organization.

Page 10: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

10Copyright © 2013 Tech Mahindra. All rights reserved.

 

Top Management leadership shall be more demonstrable and active in BCM. 

BCM requirements to have procedures which identify Legal and Regulatory requirements.

 Documented Recovery procedures to restore and return business activities to normal state.

Key differentiators of ISO22301:2012 (earlier BS25999:2007)

Page 11: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

11Copyright © 2013 Tech Mahindra. All rights reserved.

Basic Terms Used in the ISO 22301 Standard

1. Maximum Acceptable Outage (MAO) – the maximum amount of time an activity can be disrupted without incurring unacceptable damage (also Maximum Tolerable Period of Disruption – MTPoD) : MAO: New term

2. Minimum Business Continuity Objective (MBCO) – the minimum level of services or products an organization needs to produce after resuming its business operations (~MOL) : : MBCO : New term

• Recovery Time Objective (RTO) – the pre-determined time at which an activity must be resumed, or resources must be recovered

• Recovery Point Objective (RPO) – maximum data loss, i.e., minimum amount of data that needs to be restored

Page 12: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

12Copyright © 2013 Tech Mahindra. All rights reserved.

Fitting Business Continuity in Overall Management

Business continuity is part of overall risk management in a company,

with overlapping areas of: Information Security

management IT management

Page 13: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

13Copyright © 2013 Tech Mahindra. All rights reserved.

Mandatory Implementation Steps for ISO 22301

1. Management support2. Identification of requirements3. Business continuity policy & objectives4. Support documents for management system5. Risk assessment & treatment6. Business impact analysis7. Business continuity strategy8. Business continuity plan9. Training & awareness10. Documentation maintenance to be continued …

Page 14: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

14Copyright © 2013 Tech Mahindra. All rights reserved.

Mandatory Implementation Steps for ISO 22301

11. Exercising & testing12. Post-incident reviews13. Communication with interested parties14. Measurement and evaluation15. Internal audit16. Corrective actions17. Management review

Page 15: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

15Copyright © 2013 Tech Mahindra. All rights reserved.Company Confidential15

BCM Overview

Page 16: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

16Copyright © 2013 Tech Mahindra. All rights reserved.

Interoperability in Continuity Terms:

1. Everyone speaking the same language2. Everyone adhering to the same standard3. Everyone employing the same broad processes4. Everyone able to be judge against common criteria.

Page 17: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

17Copyright © 2013 Tech Mahindra. All rights reserved.

Concept of Business Continuity Management (BCM)

Business Continuity Management (BCM) is a process to identify potential impacts that threaten an organisation and provides a framework for building resilience and the capability for an effective response which safeguards the interests of its key stake holders, reputation, brand and value creating activities.

Business Continuity Management involves managing the critical Business process for Functions, Projects IBU/SSU/CDU’s which can be maintained or restored in a timely fashion in accordance with the agreed SLA in the event of disruption arising from internal or external events.

The purpose of BCM is to minimize the financial, legal, reputational or other material consequences arising from disruption.

It involves achieving business continuity plan and incident management plan in the simplest, easiest way.

Page 18: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

18Copyright © 2013 Tech Mahindra. All rights reserved.

Tech Mahindra BCMS Process

RA- Risk AssessmentBC- Business Continuity

Page 19: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

19Copyright © 2013 Tech Mahindra. All rights reserved.

Business Continuity Management Flow

Incident

Disaster?

Activate appropriate DRP

Assessment of:Damage and

Likely resumption

duration

Recovery complete

Plan for Resumption

Resumption Complete

Yes

No

Phases Mgt ActionResponse Flowchart

Normal Operations

Emergency Response

Disaster Recovery

Resumption Phase

Monitor

Monitor and Report

Monitor and Report

Incident

Disaster?

Activate appropriate DRP

Assessment of:Damage and

Likely resumption

duration

Recovery complete

Plan for Resumption

Resumption Complete

Yes

No

Phases Mgt ActionResponse Flowchart

Normal Operations

Emergency Response

Disaster Recovery

Resumption Phase

Monitor

Monitor and Report

Monitor and Report

Page 20: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

20Copyright © 2013 Tech Mahindra. All rights reserved.

Company Confidential

20

BCM Organization Chart

Management Security Forum – COO Declares Disaster

Central DR team – BCM Manager, CISO, Location Security Managers

DIRECTION

STATUS

I NFO

Potential Disaster Management Team – TIM, CS, ISG

Location Disaster Management Team

Security Coordinators

TIM OIC CS ManagerLocation Security

Manager

PM/ BCL & IBU/SSU/CDU Heads

Sys Ad & Vendors

Suppliers/ Team ISG group

Page 21: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

21Copyright © 2013 Tech Mahindra. All rights reserved.

HR – Response activities

Company Confidential

Page 22: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

22Copyright © 2013 Tech Mahindra. All rights reserved.

TIM– Response activities

Company Confidential

Page 23: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

23Copyright © 2013 Tech Mahindra. All rights reserved.

CS – Response activities

Company Confidential

Page 24: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

24Copyright © 2013 Tech Mahindra. All rights reserved.

BCM Implementation

Organization Level BCM PolicyDisaster Management HandbookBusiness Continuity Management FrameworkIT and Non–IT DR plans

Location/Building LevelBusiness Impact Analysis Location BCPSupport Function Specific BCP.

Project/ Business Unit LevelProject/ Business Unit Specific BCP

Page 25: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

25Copyright © 2013 Tech Mahindra. All rights reserved.

Tech Mahindra Global BCM Framework

Page 26: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

26Copyright © 2013 Tech Mahindra. All rights reserved. Company Confidential

Scope of the BCM Framework

Sr Inclusions Brief Description

1 Projects Includes all Critical projects from each IDU and projects run by CSU’s

2 CSU All critical activity performed by the CSU to support Delivery

3 Functions Finance, HR,FMG,TIM, and RMG as the key functions in business operations considered

4 Corporate Applications All Critical applications supported by CIO function.

5 Corporate Services IT Services critical for operations – WAN, AD, E-mail Proxy, Firewall services as examples

Page 27: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

27Copyright © 2013 Tech Mahindra. All rights reserved.

Command Matrix Flow

COMMAND

MATRIX

CISO

Center Head

1st Person Responsible for

Disaster Declaration

2nd Person Responsible for

LOCAL Disaster Declaration with Appraisal to COO

Person Responsible

To Activate Disaster Recovery in Consultation of Members of Management

Security Forum

COO

Page 28: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

28Copyright © 2013 Tech Mahindra. All rights reserved.

BCM : Incident Timeline

Incident Management

Business Continuity

Business Recovery

Back to Normalcy

60%

20%10%

100%

BCPs Assess

Improvements

Internal Audit

Exercise

INCIDENTBusiness As Usual

RTO : 8 Hours

MBCO : 20% of Normal Operations

8 Hours

48 Hours 1 weekMAO

Page 29: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

29Copyright © 2013 Tech Mahindra. All rights reserved.

Baseline BCM Posture for TechM Centers

People Processes Technology

1. Offshore Split Teams

2. Onsite ~ Offshore Model

3. Named Critical Team Members

4. Skill Database for alternate Resourcing

BCM Baseline

1. Data Backup Procedure offered as a baseline for all customers

2. Onsite & Offsite backup tape vaulting

3. Documented SOP’s

1. Common LAN Redundancy & Communication Link

2. Dual ISP, Dual Path

3. Alternate Desktops, File & Print, Email & NAS available

4. Secure Computing at Warm Sites

29

Page 30: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

30Copyright © 2013 Tech Mahindra. All rights reserved.

Roles & Responsibilities

Key roles and responsibilities defined are related to

The Crisis Management/ Disaster Recovery(DR) Team

Damage Assessment & Prioritization Team

The BCM Manager - Responsibilities

The Location Security Manager/ Business Continuity Leaders

The Security Coordinator

The IDU Heads

The Critical team members

Page 31: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

31Copyright © 2013 Tech Mahindra. All rights reserved.

Crisis Management/ Disaster Recovery(DR) Team

• The CMT/DR team is a multi-layered cross functional team comprising of Centre head , Support Unit BC Leaders, Business Unit BC Leaders/Project Manager/Delivery Manager.

• The CMT/DR team would be activated depending upon nature and magnitude of impact to the business.

• The CMT/DR team will have appropriate representations depending upon the disruption at different levels namely at Building, City, Location or Country level and holds responsibility for managing the recovery effort.

• Manage Recovery of Technology such as desktops, network , applications and also to Manage financial aspects of Recovery, such as tracking disaster related purchasing, identifying disaster related costs etc.

• Their key responsibilities are tackles crisis on site, take appropriate decisions, communicate to internal & external customers, undertake RA and conduct BIA for their respective Business/ Function.

Page 32: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

32Copyright © 2013 Tech Mahindra. All rights reserved.

Damage Assessment & Prioritization Team

• TIM would assess the Technical Damage where as Facilities would assess the Building damage facilitated by ISG

• Custodian of the BIA assessment workbook in hard copy & soft form

• Identify projects rated “Critical” and “INCLUDE” in BCP/DR for recovery during an emergency

• Identify critical functions and services “INCLUDED” in BCP/DR for recovery during an emergency

• Coordinate with IDU & Function to ascertain the affected projects / business processes / activities

• Prioritize Recovery considering factors related to • Days Delivery• Criticality to business for legal deadlines• Other Strategic reasons

Page 33: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

33Copyright © 2013 Tech Mahindra. All rights reserved.

BCM Manager - Responsibilities

• Key Role is to Develop, Document & Maintain the BCM Framework & BIA for Functions, Corporate Services, Corporate Services, CSU & IDU

• Ensure Conduct of DR Drills as per the Global Drill Schedule

• Facilitate the complete operation to bring back business to recovery state

• Coordinate with cross functional DR Teams across the organization for relevant actions

• Inform CISO of the progress and status of the Disaster recovery process

• Escalate any identified bottleneck to CISO for necessary resolution with IDU heads or Function heads

• Track the happening & Report closure of the incident

• Prepare Management Review Presentation for STATUS INFO & Corrective Action Plans

Page 34: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

34Copyright © 2013 Tech Mahindra. All rights reserved.

Location Security Manager

• Lead the DR team at the Location to take the right direction for recovery & Facilitate the Damage Assessment with TIM & Facilities management groups

• Coordinate for Location based DR Drills with respective DR Teams

• Participate actively in the DR Drills conducted

• Keep BCM Manager informed of the location DR Status for global status update

• Inform Alternate Site Location Manager for necessary support & coordination requirements

• Identify owners to implement the continuity implementation plans for the location and track the same

• Overall Site coordination would be the prime responsibility

Page 35: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

35Copyright © 2013 Tech Mahindra. All rights reserved.

Security Coordinator

• Custodian of the Contact List of all Project Managers/ Business Continuity Leader who are identified as Critical in the IBU/SSU/CDU in the BIA

• Coordinate using the contact list all such Projects/ Business Units at site which are affected

• Inform IBU/SSU/CDU Heads about the actions taken at the IBU/SSU/CDU level in coordination with the Project Managers/ Business Continuity Leaders

• Collate and consolidate the Project/ Business Unit Damage Information Status at an IBU/SSU/CDU level and share the same with the IBU/SSU/CDU Head and BCM Manager.

• Overall Spokesperson for status information for the IBU/SSU/CDU continuity would be a key responsibility

Page 36: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

36Copyright © 2013 Tech Mahindra. All rights reserved.

IDU Heads

• Coordinate with Project managers prioritizing within the IDU

• Steer inputs to the Disaster Assessment & Prioritization Team to safe recovery

• Customer Communication and briefing thru e-mail or telephone

• Elimination of bottlenecks within the IDU if identified

• Attend to all escalations from the Project Managers & Security Coordinator for the IDU

• Authorize movement of people, alternate seating arrangement, alternate computing requirements for the IDU

• Maintain a Status of the IDU recovery to keep informedCustomersSenior Management

Page 37: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

37Copyright © 2013 Tech Mahindra. All rights reserved.

Critical Team Members

• Be aware of being identified as a Critical Team Member for your Function.

• Ensure that your contact details are updated with your Function Manager.

• Maintain your user names, passwords safely.

• Possess your secure-id cards safely to enable computation from home or alternate site

• Be prepared to travel to alternate site for operational continuity.

• Be prepared to work in shifts if required at the alternate site.

• When in DOUBT – ESCALATE to Your Function Manager for correct guidance

Page 38: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

38Copyright © 2013 Tech Mahindra. All rights reserved.

What’s in a BCP document?

Critical Processes

All Operational locations and Alternate locations

Contact Details

Documents

Tasks

Equipment & Suppliers

Vital Records

Critical Resources

Client

Vendor

Software's

Page 39: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

39Copyright © 2013 Tech Mahindra. All rights reserved.

Disaster Events Classified

IT Disaster Events :- Data Communication Failure (IPLC,VPN connectivity for data transfer) Voice Communication Failure(EPBAX failures, telecom operator failures) Denial of Service (DOS and DDOS and Virus Attack scenarios) Equipment Failures (Failure of RISC Servers, Routers, Firewall) Software Configuration Failures (failures due to Operating System crashes,

Application failures, RDBMS crash) Core IT Service Provider Failure (service disruption due to ISP, ASP, Telecom

Operator , Ocean Cable operators outages.)

Non IT disaster :- Natural Calamities (Fire, Earthquake, Flood ,Epidemics) Utility Related (No Public Transport, No Power) Human Related (War, Terrorist Attack, Civic Unrest)

IT/Non-IT disaster events and Incident sc

Page 40: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

40Copyright © 2013 Tech Mahindra. All rights reserved.

BCP Scenarios - Provisioning for Threat & Availability Scenarios

BUILDING PARTIALLY AVAILABLE

BUILDING NOT AVAILABLE

COUNTRY NOT AVAILABLE

CITY NOT AVAILABLE

NATURAL CALAMITIES

TECHNICALTHREATS

HUMANTHREATS

&

FAILURES

Page 41: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

41Copyright © 2013 Tech Mahindra. All rights reserved.

MBCO stands for Minimum Business Continuity Objectives

Minimum level of services and/or products that is acceptable to the organization to achieve its business objectives during a disruption.

MBCO (Earlier know as MOL)

Page 42: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

42Copyright © 2013 Tech Mahindra. All rights reserved.

RTO

RTO stands for Recovery Time Objective.

This is the level up to which the project can remain without delivering to the customer. No business loss occurs. Acceptable and agreed by the customer.

Page 43: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

43Copyright © 2013 Tech Mahindra. All rights reserved.

MAO stands for Maximum Acceptable outage.

MAO is the maximum period of time that an organization can tolerate the disruption of a critical business function, before the achievement of objectives is adversely affected

This is the level at which- All the requirements of the client are met. All Legal obligations are followed.

Note – MAO can never be less than the RTO.

MAO (Earlier known as MTPOD)

Page 44: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

44Copyright © 2013 Tech Mahindra. All rights reserved.

RPO

RPO stands for Recovery Point Objective

The measurement of the point in time to which data must be restored in order to resume processing transactions.

It is a measure of how much data can be lost in case disaster occurs.

Note- The RTO and RPO will significantly determine the cost of BCP/DR.

Page 45: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

45Copyright © 2013 Tech Mahindra. All rights reserved.

Periodic reviews/ updates

Update BCP once in a 6 months and as and when changes are required.

Update BCP as per review comments provided by ISG BCP team.

Update drill assessment report as per review comments provided by ISG BCP team.

Function Manager to maintain latest hard copy.

Function Manager along with critical team members to attend BCP related awareness sessions regularly.

Page 46: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

46Copyright © 2013 Tech Mahindra. All rights reserved.

Why DR drills are needed?

The DR drills are conducted in order to:-

Test if the resumption of operations are possible in case of disaster. Ensure that the associates are trained and are aware of their roles in the

implementation of BCP for their projects. Make sure that BCP is reviewed and updated to reflect the current operating

environment of the project. Provide confidence in the continuity of business processes at the time of

disaster Assess the actual preparedness of the individuals involved in the recovery

process.

Page 47: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

47Copyright © 2013 Tech Mahindra. All rights reserved.

What are different types of DR drills?

DR Drills are required to ensure the viability of BCP document. The different types of DR drills are:-

Call Tree drill Table Top drill Technical Environment rebuild drill for critical servers and desktops Data Restoration drill Fail Over drill Vendor Preparedness drill

Page 48: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

48Copyright © 2013 Tech Mahindra. All rights reserved.

What happens in a CALL TREE Drill

1. Call tree can be executed either In person at a conference room Over an E-mail Dial In Check

2. Calling the numbers listed in the Contact Directory for Crisis Management , critical resources mentioned in BCP and the concerned stakeholders.

3. Verification of the numbers4. Corrections if any5. Assessment prior to Closure

Wrong numbers Missing numbers Changed numbers Correct numbers

6. Circulate the contact list to team members on email and maintain as a drill evidence.

7. Close Drill and Update the Contact List on ISG Dashboard with results and Assessment.

Page 49: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

49Copyright © 2013 Tech Mahindra. All rights reserved.

What Happens in a Table Top Drill

All DR Team members gather, either on an audio bridge or in person in conference rooms looping [email protected] in the call invite.

A Disaster Event (IT or Non IT) and a Incident scenario is chosen. (Can refer attachment for selecting Disaster scenario and Incident Scenario). The Event can also be related to an IDU, Function, Project, Corporate Application, ODC or Location for Rehearsal.

PM to initiate the drill and action Plan is referred to as documented in BCP. Each DR Team Member calls out the critical tasks that he would perform At the End – Open Discussion on learning's / observations Assessment of the Preparedness would be documented in a standard format

by preparing the MoM for the drill. Observations/Problems faced while conducting the drill, need to be planned

and closed with appropriate action items before the closure date by identified owners in the project.

Continuity Improvement Plans will be the output Drill would be CLOSED Update ISG Dashboard with results and Assessment.

IT/Non-IT disaster events and Incident sc

Page 50: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

50Copyright © 2013 Tech Mahindra. All rights reserved.

What Happens in an Environment Rebuild Drill

Step-by-Step Drill process A Disaster Event (IT or Non IT) and a Incident scenario is chosen. (Can refer attachment for selecting Disaster

scenario and Incident Scenario). The Event can also be related to an IDU, Function, Project, Corporate Application, ODC or Location for Rehearsal.

Send Environment Rebuild Drill intimation email to:1. Critical team members in the project, DRP_location_list & [email protected]. RMG – for seat requirements at the alternate location3. TIM – send consolidated details including seat allocation details(received from RMG), software, hardware and

network connectivity requirements4. CS– for logistic arrangements like Physical access ,guest house, ticketing, to the alternate site etc.5. Check all the installations and connectivity requirements required for the resumption of critical processes of

the project.6. Test and confirm the connectivity of development/ testing/support applications is established (via Email).7. Maintain all the possible evidences of the drill. They can be drill related emails and possible screen shots where

ever required.8. The drill gets closed.

Post Drill activities9. Intimate TIM to un-install all the software from those machines which RMG had allocated for the drill, RMG to

release the seats immediately.10. Calculate the time from the initial mail till the completion and compare it with RTO (Recovery Time Objective)

mentioned in BCP document and the same time should be noted and update in BCP document. In case the Time calculated is less than the RTO mentioned in the BCP then the drill result is Fully Successful, else it is treated as Unsuccessful.

11. Send the drill completion email to critical team members, TIM, RMG and [email protected] with Drill Results.

12. Update the Drill Assessment with drill details on ISG dashboard through https://isg.techmahindra.com/dashboard/login.aspx .

13. Ensure to attach the final Drill closure email as an evidence/ reference for the drill.

IT/Non-IT disaster events and Incident sc

Page 51: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

51Copyright © 2013 Tech Mahindra. All rights reserved.

What happens in a Data Restore Drill ?

In an Onsite Data Restoration Drill

• Initiate the Drill with an email to TIM • Track the Restoration Process• Complete the Drill with Logs & Validation of Restored Data• Update Assessment Sheet • Close Drill• Share email with [email protected]

In an Offsite Data Restoration Drill

• A Critical Server is identified as per the BIA • An Offsite Data Restore will be planned• The tape is transported from Offsite to Onsite• Travel Time, Restoration Period would be tracked for data records • Logs will be maintained for verification of backed up data Vs Restored Data• Share email with [email protected]

Page 52: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

52Copyright © 2013 Tech Mahindra. All rights reserved.

What happens in a Fail Over Test

1. Drill will be conducted by TIM

2. Planning and scheduling would be as per schedules maintained

3. Primary equipment will be made PASSIVE

4. Secondary equipment will be made LIVE

5. Fail over will be tested

6. Pay Load monitoring would be a key activity to validate minimum operating levels maintained

7. Fail over time will be tracked to match Recovery Time Objectives

8. Infrastructure will be reverted back to Working State

9. Drill will be called off

10. Assessment would be conducted

11. Continuity improvement plans in regard to operating procedures, preparedness measures would be tracked and implemented

Page 53: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

53Copyright © 2013 Tech Mahindra. All rights reserved.

What happens in a Vendor Preparedness Test

1. An infrastructure element is identified

2. The Vendor is called upon for an alternate infrastructure

3. His response is tracked

4. The equipment replenishment time at site for recovery is tracked

5. SLA’s are monitored as agreed with Vendor

6. Gaps are identified

7. Recovery Time Objectives are assessed

8. Continuity Improvement Plans are documented

9. Implementation at target planned dates is tracked

10. Vendor is educated post drill in respect to Gaps in Response, SLA variances & Response Time Issues, Other Logistical issues

Page 54: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

54Copyright © 2013 Tech Mahindra. All rights reserved.

Project Readiness - Overall

Sr What to Know ? Reference Resource

1 RA & RTP of the Function ISG-TP002

2 BIA of the Function ISG-TP022 for CSISG-TP006 for other Functions

3 BCP/DR test plan hard copy Shared Drive of Function

4 BCP/DR drill evidences ISG Dashboard (DR Drill Schedule) and Shared Drive of Function

5 Location Business Continuity Plan Template.doc

ISG-TP009

6 ERP Incident Report document Shared Drive of Function

7 Global Contact list Refer BCM Framework on BMS

Page 55: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

55Copyright © 2013 Tech Mahindra. All rights reserved.

Project Readiness - Overall

Sr What to Know ? Reference Resource

8 Function specific Installation & configuration procedures

Shared Drive of Function

9 Route map, Mode of transport and Distance parameters document

ISG-TP023

10 Common group email id for ALERTS about Potential or DR Incidents

drp <building name> liste.g. drp gigaspace list

Page 56: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

56Copyright © 2013 Tech Mahindra. All rights reserved.

Important BCP Reference documents

56

Location BCP - Sharda Centre

Disaster Recovery Handbook

Non-IT Disaster Recovery Action Plan

IT Disaster Recovery Action Plan

Disaster Recovery handbook

Non-IT Disaster Recovery Action Plan

IT Disaster Recovery Action Plan

Location BCP- Sample

Page 57: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

57Copyright © 2013 Tech Mahindra. All rights reserved.

In case any BCP related queries please drop a mail to [email protected] mail id.

(or)

You can raise service request at : http://tim.techmahindra.com/tim/

Any queries on BCP??

Page 58: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

58Copyright © 2013 Tech Mahindra. All rights reserved.

Conclusion

Lets all at TechM join hands to understand the practicality of

BCP and to strive hard to make it a success.

No Plan is Complete Until Fully Tested

Page 59: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

59Copyright © 2013 Tech Mahindra. All rights reserved.

Disclaimer

Tech Mahindra Limited, herein referred to as TechM provide a wide array of presentations and reports, with the contributions of various professionals. These presentations and reports are for informational purposes and private circulation only and do not constitute an offer to buy or sell any securities mentioned therein. They do not purport to be a complete description of the markets conditions or developments referred to in the material. While utmost care has been taken in preparing the above, we claim no responsibility for their accuracy. We shall not be liable for any direct or indirect losses arising from the use thereof and the viewers are requested to use the information contained herein at their own risk. These presentations and reports should not be reproduced, re-circulated, published in any media, website or otherwise, in any form or manner, in part or as a whole, without the express consent in writing of TechM or its subsidiaries. Any unauthorized use, disclosure or public dissemination of information contained herein is prohibited. Unless specifically noted, TechM is not responsible for the content of these presentations and/or the opinions of the presenters. Individual situations and local practices and standards may vary, so viewers and others utilizing information contained within a presentation are free to adopt differing standards and approaches as they see fit. You may not repackage or sell the presentation. Products and names mentioned in materials or presentations are the property of their respective owners and the mention of them does not constitute an endorsement by TechM. Information contained in a presentation hosted or promoted by TechM is provided “as is” without warranty of any kind, either expressed or implied, including any warranty of merchantability or fitness for a particular purpose. TechM assumes no liability or responsibility for the contents of a presentation or the opinions expressed by the presenters. All expressions of opinion are subject to change without notice.

Thank youVisit us at www.techmahindra.com

Page 60: 1 Copyright © 2013 Tech Mahindra. All rights reserved. 1.

60Copyright © 2013 Tech Mahindra. All rights reserved.


Recommended