Business Continuity and Disaster Recovery Roadmap

John A GreenTexas Department of Motor VehiclesDisaster Recovery and Business Continuity Planner5/10/2017

Goals of this Presentation

o Why conduct a Business Impact Analysis (BIA)

o What is in a BIA and what other processes does it drive

o Who should be involved in the inputs and the analysis

o When should it be conducted and reviewed

o Where in the cycle do the Continuity of Operations Plan (COOP) and Disaster Recovery Plan get developed

o How are the BIA, COOP and Disaster Recover Plan used

Texas Department of Motor Vehicles

o Background:o The TxDMV mission is “to serve, protect and advance the

citizens and industries in the state with quality motor vehicle related services.

o ”o WHY TxDMV -> Mission Essential Functions

• TEF 5: Maintain Law and Order. Focus• TEF 6: Ensure Availability of Emergency Services• TEF 7: Maintain Economic Stability. Focus

• Standards solution MS-ISAC crosswalk NIST to FEMA

Texas Department of Motor Vehicles

o Background:o TEF is (SORM)

• Standards solution MS-ISAC crosswalk NIST to FEMA

Business Impact AnalysisBackground

o TxDMV is committed to ensuring that essential business functions will be continued:

• Provide for the safety of the citizens of Texas• Provide Law Enforcement accurate and timely information• Provide for the motor vehicle industries to conduct business

• Dealers• Vehicle owners

• Provide for the motor carrier industries to conduct businesso The Business Impact Analysis should Identify:

• Priority of Business Functions• Systems Impact ranking• Critical information resources • Risks• RPO• Cost of Downtime for Business • Recovery Time Objective (RTO) for Disaster Recovery

Identify Agency Essential Functions

Texas Essential Functions

FEMA National Essential Functions

DMV Vision & Mission

Identify Risks to Agency Opperations

Working sessions with

POC from DMV Divisions

SORM Data

COOP Round Table

Texas Admin Code

Texas Occupations Code

Texas Transportation Code

US Labor Code

Vernon’s Civil Statute

Texas Government Code

FEMA Data

Identify Impacts to Agency for

Interruption of Functions

Working sessions with

POC from DMV Divisions

Identify Agency

Statutory Requirements

Gartner BPA

BPA Responses from Divisions

Revenue Data

LE & Public Safety Functions

Create Mitigation Strategies

Identify Alternate Work Site &

Establish MOA

Identify Divisions & Personnel

Supporting Agency Functions

Identify Recovery Time Obectives

Business Impact

Analysis

Working sessions with

POC from DMV Divisions

Agency Statutory Requirements

Agency Contract Requirements

Working sessions with

POC from DMV Divisions

Working sessions with OGC, FAS, and

Exec

Validate Business Impact

Analysis

Prioritize Agency Function Recovery

Working sessions with

Exec Team

Business Continuity

Plan

Validate Business

Continuity Plan

Identify Additional IT Resources Needed

to support BCP

Identify DCS Systems Needed to

Support BCP

Working sessions with

SMEs & IT

DCS CMDB

Create Policy and Process for

Succession, HR, and Purchasing

Working sessions with OGC, HR, FAS,

and Exec

Identify Systems / Applications

Supporting Agency Functions

Working sessions with

SMEs & IT

Disaster Recovery

Plan

Identify Recovery Point Objectives

Working sessions with

SMEs & ITAgency Rule Requirements

Engineering, Evaluation,

and Purchasing

Offsite Backup Phone System

Backup Power Generator

Uninterrupted Power Supplies

Additional HV/AC

Business Continuity and Disaster Recovery Planning Process

INPUTS help tell the Story, Mission Essential Functions, Code, Laws

More Analysis Inputs: Risks, Policies and Priorities

The BIA in turn is validated and provides Inputs into the Continuity Of Operations Plan (COOP)

Completed Business Impact Analysis (sanitized)

Agency Functions Registration & Titling Permitting Industry Licensing Industry Credentialing Enforcement & Hearings Vital Records HR, Payroll Purchasing &

AccountingABTPA Grant Fund

AdministrationCustomer Service (Call

Center, etc.)Texas Essential Functions TEF 4, 5, 6, 7 & 8 TEF 4, 5, 6, 7 & 8 TEF 7 & 8 TEF 7 & 8 TEF 1 & 5 TEF 1 & 4 TEF 1 TEF 1 & 7 TEF 5 & 6Statutory Compliance Transportation Code 501, 502,

504, 621, 645, and 681; Admin Code 43 TAC 217

Transportation Code 621, 622, 623, ; Admin Code 43 TAC 219

Occupations Code 2301; Trans Code 503

Transportation Code 643, 644 & 646; Admin Code 43 TAC 218

Occupations Code 2301Occupations Code 2305; Admin Code 13 TAC 6; Government Code 441 & 552

Gov Code 551, 552, 572, 605, 654, 656, 659, 2113; Labor Code 21, 22, 501; 29 U.S.C. 8, 206, 621-34

Government Code 2101, 2103, 2155

VCS Art. 4413(37) Government Code 681

Average Daily RevenuePrimary Mission Essential Function Divisions VTR, RSC MCD, RSC MVD MCD ENF, OAH FIN/ADM FIN/ADM, HR FIN/ADM ABTPA CRD, VTR, MCD, IT, RSCMission Essential Function Divisions IT, EXEC IT, EXEC IT, EXEC IT, EXEC IT, EXEC, CRD OGC, IT, EXEC IT, EXEC, Civil Rights IT, EXEC IT, EXEC EXEC, GSCLower Priority Function Divisions OGC, IA, GSC, HR, FIN, CRD OGC, IA, GSC, HR, FIN, CRD OGC, IA, GSC, HR, FIN, CRD OGC, IA, GSC, HR, FIN, CRD OGC, IA, GSC, HR, FIN IA, GSC, HR, FIN OGC, IA, GSC, HR, FIN OGC, IA, GSC, HR OGC, IA, GSC, HR, FIN OGC, IA, HR, FINRecovery Time Objective (RTO) Hours Hour Day Day Day Day Day Day Day DaySupporting Systems:

Really big ApplicationReally big Application

Another Really Large AppWeb based App

CC ProcessingPretty Big Application

Imaging ApplicationStorage Application

Web stuffPurchasing

HRPayrollGrants

Internet/Intranet SitesPhone/email

Call CenterFile Shares

Law EnforcementImpacts:

Revenue Generation 1-5 1-5 1-5 1-5 1-5 1-5 1-5 1-5 1-5Public Safety 1-5 1-5 1-5 1-5 1-5 1-5 1-5 1-5 1-5

Legal & Regulatory 1-5 1-5 1-5 1-5 1-5 1-5 1-5 1-5 1-5Service Delivery 1-5 1-5 1-5 1-5 1-5 1-5 1-5 1-5 1-5

Security Controls 1-5 1-5 1-5 1-5 1-5 1-5 1-5 1-5 1-5Agency Reputation 1-5 1-5 1-5 1-5 1-5 1-5 1-5 1-5 1-5

Personnel 1-5 1-5 1-5 1-5 1-5 1-5 1-5 1-5 1-5Public/Dealer Satisfaction 1-5 1-5 1-5 1-5 1-5 1-5 1-5 1-5 1-5

Impact Rating 8-40 8-40 8-40 8-40 8-40 8-40 8-40 8-40 8-40

High Impact TimeframesRegistration March; Titling November-December End of the month

Beginning & End of each Month

= Mandatory System to perform the function= Major System needed to perform the function

= Improves performance of the function

Business Impact Analysis Results

Business Impact AnalysisBackground

o EXPLAIN BIA o TEF Vs National

o What area ourso Every Depart/Divisions input

o How many DR plans o How many COOPo Org Chart o POC for IT , Business, DCS, Org Charto Exercise once a year, lots of resourceso How often report to , metrics, audit o BIA once every other year, DR exercise once/year, Table Top v full DREo DRE labor intensive o Table Top with *all* divisionso Scheduleo Fire, Water, events

BCP /COOP to Disaster Recovery Plan

An Aside: Identified Risks addressed in parallel

D/R Class RTO RPO Replicated or Tape Recovery

Production Storage Tier

Recovery Storage Type/Tier

Available at: CDC/LDC

Production Server

Recovery Site

Recovery Server

Data Type (Recommended Use)

Exercise Frequency

Class P 1 hour 1 hour Replicated to Fast Storage

Tier 1 Includes Fast Replication

CDC Only Platinum Alt CDC Hot Standby All Data Annual Recovery

Class 1 72 hours 6 hours Replicated to Fast Storage

Tier 1 Includes Fast Replication

CDC Only Gold / Silver Alt CDC Comparable to Production

All Data Annual Recovery

Class 2A 7 days 48 hours Non-Replicated, Media Based Recovery to Fast Storage

Tier 2 Tier 2 CDC Only Gold / Silver Alt CDC Comparable to Production

All Data Annual Table Top or Recovery

Class 2B 14 days 48 hours Non-Replicated, Media Based Recovery to Fast Storage

Tier 2 Tier 2 CDC & LDC Gold / Silver Alt CDC & LDC

Comparable to Production

All Data TRG Review Exercise every two years

Class 3 21 days 48 hours Acquired at time of disaster (ATOD)

Tier 2 ATOD CDC & LDC Gold, Silver, or Bronze

Alt CDC ATOD All Data Annual Enterprise Table Top

Class 4 Low Priority Best Effort Non-Replicated, Media Based Recovery to Fast Storage

Tier 2 / Tier 3 Low Priority CDC & LDC Gold, Silver, or Bronze

Alt CDC Best Effort All Data N/A

Class 5 7 days 48 hours Replicated to Slow Storage

Replicated Tier 3

Includes Slow Replication

CDC Only Gold, Silver, or Bronze

Alt CDC Comparable to Production

non-Transactional

Data Only. Customer

assumes the risk that the

application will provide

acceptable performance on

slower disk

Annual Table Top Exercise or Regular

Class 6 14 days 48 hours Non-Replicated, Media Based Recovery from Fast to Slow Storage

Tier 2 Tier 3 CDC Only Gold, Silver, or Bronze

Alt CDC Comparable to Production

TRG Review Exercise every two years

Statewide Data Center Disaster Recovery RTO/RPO….ad hoc Class 8….Explain words

D/R Class RTO RPO Replicated or Tape Recovery

Production Storage Tier

Recovery Storage Type/Tier

Available at: CDC/LDC

Production Server

Recovery Site

Recovery Server

Data Type (Recommended Use)

Exercise Frequency

Class P 1 hour 1 hour Replicated to Fast Storage

Tier 1 Includes Fast Replication

CDC Only Platinum Alt CDC Hot Standby All Data Annual Recovery

Class 1 72 hours 6 hours Replicated to Fast Storage

Tier 1 Includes Fast Replication

CDC Only Gold / Silver Alt CDC Comparable to Production

All Data Annual Recovery

Class 2A 7 days 48 hours Non-Replicated, Media Based Recovery to Fast Storage

Tier 2 Tier 2 CDC Only Gold / Silver Alt CDC Comparable to Production

All Data Annual Table Top or Recovery

Class 2B 14 days 48 hours Non-Replicated, Media Based Recovery to Fast Storage

Tier 2 Tier 2 CDC & LDC Gold / Silver Alt CDC & LDC

Comparable to Production

All Data TRG Review Exercise every two years

Class 3 21 days 48 hours Acquired at time of disaster (ATOD)

Tier 2 ATOD CDC & LDC Gold, Silver, or Bronze

Alt CDC ATOD All Data Annual Enterprise Table Top

Class 4 Low Priority Best Effort Non-Replicated, Media Based Recovery to Fast Storage

Tier 2 / Tier 3 Low Priority CDC & LDC Gold, Silver, or Bronze

Alt CDC Best Effort All Data N/A

Class 5 7 days 48 hours Replicated to Slow Storage

Replicated Tier 3

Includes Slow Replication

CDC Only Gold, Silver, or Bronze

Alt CDC Comparable to Production

non-Transactional

Data Only. Customer

assumes the risk that the

application will provide

acceptable performance on

slower disk

Annual Table Top Exercise or Regular

Class 6 14 days 48 hours Non-Replicated, Media Based Recovery from Fast to Slow Storage

Tier 2 Tier 3 CDC Only Gold, Silver, or Bronze

Alt CDC Comparable to Production

TRG Review Exercise every two years

Glossary