disaster recovery drill report sample

2021/05/21

Availability of company credit cards to pay for supplies and services required post-disaster 5.3 Legal Actions The company legal department and ERT will jointly review the aftermath of the incident and decide whether there may be legal actions resulting from the event; in particular, the possibility of claims by or against the company for regulatory violations, etc. What are you going to do about it? fillable The disaster recovery plan should be periodically tested in a simulated environment to ensure that it can be implemented in emergency situations and that the management and staff understand how it is to be executed. A formal risk assessment shall be undertaken to determine the requirements for the disaster recovery plan. 2.3.5 Recorded Messages / Updates For the latest information on the disaster and the organizations response, staff members can call a toll-free hotline listed in the DRP wallet card.

Report to the emergency response team. The report should be distributed to senior management, as appropriate. : Technical Specifications: Network Interfaces: Power Requirements; System Serial #: DNS Entry: IP Address: Other:HOT SITE EQUIPMENTProvide detailsSPECIAL APPLICATIONSASSOCIATED DEVICES KEY CONTACTSHardware VendorProvide detailsSystem OwnersProvide detailsDatabase OwnerProvide detailsApplication OwnersProvide detailsSoftware VendorsProvide detailsOffsite StorageProvide detailsNetwork ServicesProvide details BACKUP STRATEGY for SYSTEM TWODailyProvide detailsMonthlyProvide detailsQuarterlyProvide details SYSTEM TWO DISASTER RECOVERY PROCEDURE Scenario 1 Total Loss of Switch Provide details Scenario 2 Total Loss of Network Provide details ADDENDUM CONTACTS Support Systems Support system Critical network assets Critical interfacesCritical files to restoreCritical network services to restoreOther services Appendix B Suggested Forms Damage Assessment Form Key Business Process AffectedDescription Of ProblemExtent Of Damage _____________ Management of DR Activities Form During the disaster recovery process all activities will be determined using a standard structure; Where practical, this plan will need to be updated on a regular basis throughout the disaster recovery period; All actions that occur during this phase will need to be recorded. An event log shall be maintained by the disaster recovery team leader. The assessment should include: Loss of financial documents Loss of revenue Theft of check books, credit cards, etc. Objectives The principal objective of the disaster recovery program is to develop, test and document a well-structured and easily understood plan which will help the company recover as quickly and effectively as possible from an unforeseen disaster or emergency which interrupts information systems and business operations. The disaster recovery plan should cover all essential and critical infrastructure elements, systems and networks, in accordance with key business activities. ____________ Business Process/Function Recovery Completion Form The following transition form should be completed and signed by the business recovery team leader and the responsible business unit leader, for each process recovered. The strategy chosen is for a fully mirrored recovery site at the companys offices in _____. %PDF-1.5 % All staff must be made aware of the disaster recovery plan and their own respective roles. The format shown below can be used for recording the activation of the DR team once the work of the damage assessment and emergency response teams has been completed. UPSs also remotely monitored.Loss of communications network services 44Two diversely routed T1 trunks into building. Each member of the Disaster Recovery Team and the Business Recovery Team will be issued a CD and hard copy of this plan. Hot site staffing will consist of members of the disaster recovery team only for the first 24 hours, with other staff members joining at the hot site as necessary. Potential disasters have been assessed as follows: Potential DisasterProbability RatingImpact RatingBrief Description Of Potential Consequences & Remedial ActionsFlood34All critical equipment is located on 1st FloorFire34FM200 suppression system installed in main computer centers. Loss of cash 5.2 Financial Requirements The immediate financial needs of the company must be addressed. ; Decide which elements of the DR Plan should be activated; Establish and manage disaster recovery team to maintain vital services and return to normal operation; Ensure employees are notified and allocate responsibilities and activities as required. The following event log should be completed by the disaster recovery team leader to record all key events during disaster recovery, until such time as responsibility is handed over to the business recovery team. Hmf_:lrk4b jV}-3K]y$RVT0}4VnZru,)8]mvT&'g1C6{) e0vYfxChUtqu@kE%8h=0|0k]]!n )". In a DRP exercise no one passes or fails; everyone who participates learns from exercises what needs to be improved, and how the improvements can be implemented. The notification will request DRT members to assemble at the site of the problem and will involve sufficient information to have this request effectively communicated. > T V M N O P Q R S bjbj[[ 9 9 ; [ J Z Z Z n n n 8 2" d n Q 0 8 8 8 8 TU B [ b] $ ! Z J^ M U @ J^ J^ 8 8 j_ j_ j_ J^ t 8 Z 8 j_ J^ j_ j_ 0 f 4 8 fLQ ^ R $ ! 0 Q @ *_ @ H 4 Z 4 J^ J^ j_ J^ J^ J^ J^ J^ j_ J^ J^ J^ Q J^ J^ J^ J^ J^ J^ J^ J^ J^ J^ J^ J^ J^ : IT Disaster Recovery Plan Template By Paul Kirvan, CISA, CISSP, FBCI, CBCP Revision History revisiondatenamedescriptionOriginal 1.0 Table of Contents TOC \o "1-4" \h \z HYPERLINK \l "_Toc241554706"Information Technology Statement of Intent PAGEREF _Toc241554706 \h 5 HYPERLINK \l "_Toc241554707"Policy Statement PAGEREF _Toc241554707 \h 5 HYPERLINK \l "_Toc241554708"Objectives PAGEREF _Toc241554708 \h 5 HYPERLINK \l "_Toc241554709"Key Personnel Contact Info PAGEREF _Toc241554709 \h 6 HYPERLINK \l "_Toc241554710"Notification Calling Tree PAGEREF _Toc241554710 \h 7 HYPERLINK \l "_Toc241554711"External Contacts PAGEREF _Toc241554711 \h 8 HYPERLINK \l "_Toc241554712"External Contacts Calling Tree PAGEREF _Toc241554712 \h 10 HYPERLINK \l "_Toc241554713"1 Plan Overview PAGEREF _Toc241554713 \h 11 HYPERLINK \l "_Toc241554714"1.1 Plan Updating PAGEREF _Toc241554714 \h 11 HYPERLINK \l "_Toc241554715"1.2 Plan Documentation Storage PAGEREF _Toc241554715 \h 11 HYPERLINK \l "_Toc241554716"1.3 Backup Strategy PAGEREF _Toc241554716 \h 11 HYPERLINK \l "_Toc241554717"1.4 Risk Management PAGEREF _Toc241554717 \h 11 HYPERLINK \l "_Toc241554718"2 Emergency Response PAGEREF _Toc241554718 \h 12 HYPERLINK \l "_Toc241554719"2.1 Alert, escalation and plan invocation PAGEREF _Toc241554719 \h 12 HYPERLINK \l "_Toc241554720"2.1.1 Plan Triggering Events PAGEREF _Toc241554720 \h 12 HYPERLINK \l "_Toc241554721"2.1.2 Assembly Points PAGEREF _Toc241554721 \h 12 HYPERLINK \l "_Toc241554722"2.1.3 Activation of Emergency Response Team PAGEREF _Toc241554722 \h 12 HYPERLINK \l "_Toc241554723"2.2 Disaster Recovery Team PAGEREF _Toc241554723 \h 13 HYPERLINK \l "_Toc241554724"2.3 Emergency Alert, Escalation and DRP Activation PAGEREF _Toc241554724 \h 13 HYPERLINK \l "_Toc241554725"2.3.1 Emergency Alert PAGEREF _Toc241554725 \h 13 HYPERLINK \l "_Toc241554726"2.3.2 DR Procedures for Management PAGEREF _Toc241554726 \h 14 HYPERLINK \l "_Toc241554727"2.3.3 Contact with Employees PAGEREF _Toc241554727 \h 14 HYPERLINK \l "_Toc241554728"2.3.4 Backup Staff PAGEREF _Toc241554728 \h 14 HYPERLINK \l "_Toc241554729"2.3.5 Recorded Messages / Updates PAGEREF _Toc241554729 \h 14 HYPERLINK \l "_Toc241554730"2.3.7 Alternate Recovery Facilities / Hot Site PAGEREF _Toc241554730 \h 14 HYPERLINK \l "_Toc241554731"2.3.8 Personnel and Family Notification PAGEREF _Toc241554731 \h 14 HYPERLINK \l "_Toc241554732"3 Media PAGEREF _Toc241554732 \h 15 HYPERLINK \l "_Toc241554733"3.1 Media Contact PAGEREF _Toc241554733 \h 15 HYPERLINK \l "_Toc241554734"3.2 Media Strategies PAGEREF _Toc241554734 \h 15 HYPERLINK \l "_Toc241554735"3.3 Media Team PAGEREF _Toc241554735 \h 15 HYPERLINK \l "_Toc241554736"3.4 Rules for Dealing with Media PAGEREF _Toc241554736 \h 15 HYPERLINK \l "_Toc241554737"4 Insurance PAGEREF _Toc241554737 \h 15 HYPERLINK \l "_Toc241554738"5 Financial and Legal Issues PAGEREF _Toc241554738 \h 16 HYPERLINK \l "_Toc241554739"5.1 Financial Assessment PAGEREF _Toc241554739 \h 16 HYPERLINK \l "_Toc241554740"5.2 Financial Requirements PAGEREF _Toc241554740 \h 16 HYPERLINK \l "_Toc241554741"5.3 Legal Actions PAGEREF _Toc241554741 \h 16 HYPERLINK \l "_Toc241554742"6 DRP Exercising PAGEREF _Toc241554742 \h 16 HYPERLINK \l "_Toc241554743"Appendix A Technology Disaster Recovery Plan Templates PAGEREF _Toc241554743 \h 17 HYPERLINK \l "_Toc241554744"Disaster Recovery Plan for PAGEREF _Toc241554744 \h 17 HYPERLINK \l "_Toc241554745"Disaster Recovery Plan for PAGEREF _Toc241554745 \h 19 HYPERLINK \l "_Toc241554746"Disaster Recovery Plan for Local Area Network (LAN) PAGEREF _Toc241554746 \h 21 HYPERLINK \l "_Toc241554747"Disaster Recovery Plan for Wide Area Network (WAN) PAGEREF _Toc241554747 \h 23 HYPERLINK \l "_Toc241554748"Disaster Recovery Plan for Remote Connectivity PAGEREF _Toc241554748 \h 25 HYPERLINK \l "_Toc241554749"Disaster Recovery Plan for Voice Communications PAGEREF _Toc241554749 \h 27 HYPERLINK \l "_Toc241554750"Appendix B Suggested Forms PAGEREF _Toc241554750 \h 29 HYPERLINK \l "_Toc241554751"Damage Assessment Form PAGEREF _Toc241554751 \h 29 HYPERLINK \l "_Toc241554752"Management of DR Activities Form PAGEREF _Toc241554752 \h 29 HYPERLINK \l "_Toc241554753"Disaster Recovery Event Recording Form PAGEREF _Toc241554753 \h 29 HYPERLINK \l "_Toc241554754"Disaster Recovery Activity Report Form PAGEREF _Toc241554754 \h 30 HYPERLINK \l "_Toc241554755"Mobilizing the Disaster Recovery Team Form PAGEREF _Toc241554755 \h 31 HYPERLINK \l "_Toc241554756"Mobilizing the Business Recovery Team Form PAGEREF _Toc241554756 \h 31 HYPERLINK \l "_Toc241554757"Monitoring Business Recovery Task Progress Form PAGEREF _Toc241554757 \h 32 HYPERLINK \l "_Toc241554758"Preparing the Business Recovery Report Form PAGEREF _Toc241554758 \h 32 HYPERLINK \l "_Toc241554759"Communications Form PAGEREF _Toc241554759 \h 33 HYPERLINK \l "_Toc241554760"Returning Recovered Business Operations to Business Unit Leadership PAGEREF _Toc241554760 \h 33 HYPERLINK \l "_Toc241554761"Business Process/Function Recovery Completion Form PAGEREF _Toc241554761 \h 33 Information Technology Statement of Intent This document delineates our policies and procedures for technology disaster recovery, as well as our process-level plans for recovering critical technology platforms and the telecommunications infrastructure. It is likely that during the recovery process, overall responsibility may have been assigned to the business recovery process lead. hb```f Y ,`q`#LxRMPT+[^cuhq``? $En}p'.y- Description of Emergency:Date Occurred:Date Work of Disaster Recovery Team Completed: Name of Team MemberContact DetailsContacted On (Time / Date)By WhomResponseStart Date RequiredRelevant Comments (e.g., Specific Instructions Issued) ___________ Mobilizing the Business Recovery Team Form Following an emergency requiring activation of the disaster recovery team, the business recovery team should be notified of the situation and placed on standby. Description of Emergency:Date Occurred:Date Work of Business Recovery Team Completed: Name of Team MemberContact DetailsContacted On (Time / Date)By WhomResponseStart Date RequiredRelevant Comments (e.g., Specific Instructions Issued) ____________ Monitoring Business Recovery Task Progress Form The progress of technology and business recovery tasks must be closely monitored during this period of time. KEY BUSINESS PROCESSBACKUP STRATEGYIT Operations Fully mirrored recovery siteTech Support - Hardware Fully mirrored recovery siteTech Support - Software Fully mirrored recovery siteFacilities ManagementFully mirrored recovery siteEmail Fully mirrored recovery sitePurchasing Fully mirrored recovery siteDisaster Recovery Fully mirrored recovery siteFinance Fully mirrored recovery siteContracts Admin Fully mirrored recovery siteWarehouse & Inventory Fully mirrored recovery siteProduct Sales Fully mirrored recovery siteMaintenance Sales Fully mirrored recovery siteHuman Resources Off-site data storage facility Testing Fully Mirrored Recovery site -Fully mirrored recovery siteWorkshop Fully Mirrored Recovery site -Fully mirrored recovery siteCall CenterFully mirrored recovery siteWeb Site Fully mirrored recovery site 1.4 Risk Management There are many potential disruptive threats which can occur at any time and affect the normal business process. A separate form should be used for each recovered business process. The information given to all parties must be accurate and timely. : Technical Specifications: Network Interfaces: Power Requirements; System Serial #: DNS Entry: IP Address: Other:HOT SITE EQUIPMENTProvide detailsSPECIAL APPLICATIONSASSOCIATED DEVICES KEY CONTACTSHardware VendorProvide detailsSystem OwnersProvide detailsDatabase OwnerProvide detailsApplication OwnersProvide detailsSoftware VendorsProvide detailsOffsite StorageProvide detailsNetwork ServicesProvide details BACKUP STRATEGY for SYSTEM TWODailyProvide detailsMonthlyProvide detailsQuarterlyProvide details SYSTEM TWO DISASTER RECOVERY PROCEDURE Scenario 1 Total Loss of Network Provide details Scenario 2 Total Loss of HW Provide details ADDENDUM CONTACTS Support Systems Support system Critical network assets Critical interfacesCritical files to restoreCritical network services to restoreOther services Disaster Recovery Plan for Remote Connectivity SYSTEM OVERVIEW EQUIPMENTLocation: Device Type: Model No. Note: A priority sequence must be identified although, where possible, activities will be carried out simultaneously. E F n o p q $a$gd # $a$ $a$ q r s t u v w x y z { | } ~ &. AFj0X}i %R"mg1+X._w\@:i pXea`. . How did it happen? The report will also contain an assessment of the impact to normal business operations.

Each member of senior management will be issued a CD and hard copy of this plan to be filed at home. Fire and smoke detectors on all floors. WAN redundancy, voice network resilience Probability: 1=Very High, 5=Very Low Impact: 1=Total destruction, 5=Minor annoyance 2 Emergency Response 2.1 Alert, escalation and plan invocation 2.1.1 Plan Triggering Events Key trigger issues at headquarters that would lead to activation of the DRP are: Total loss of all communications Total loss of power Flooding of the premises Loss of the building 2.1.2 Assembly Points Where the premises need to be evacuated, the DRP invocation plan identifies two evacuation assembly points: Primary Far end of main parking lot; Alternate Parking lot of company across the street 2.1.3 Activation of Emergency Response Team When an incident occurs the Emergency Response Team (ERT) must be activated. 3.3 Media Team ____________________________________________ ____________________________________________ ____________________________________________ 3.4 Rules for Dealing with Media Only the media team is permitted direct contact with the media; anyone else contacted should refer callers or in-person media representatives to the media team. Groups of Persons or Organizations Affected by DisruptionPersons Selected To Coordinate Communications to Affected Persons / OrganizationsNamePositionContact DetailsCustomersManagement & StaffSuppliersMediaStakeholdersOthers ____________ Returning Recovered Business Operations to Business Unit Leadership Once normal business operations have been restored it will be necessary to return the responsibility for specific operations to the appropriate business unit leader. }4h J Name Of Business ProcessCompletion Date of Work Provided by Business Recovery TeamDate of Transition Back to Business Unit Management (If different than completion date) I confirm that the work of the business recovery team has been completed in accordance with the disaster recovery plan for the above process, and that normal business operations have been effectively restored. The contents of the report shall include: A description of the incident People notified of the emergency (including dates) Action taken by the business recovery team Outcomes arising from actions taken An assessment of the impact to normal business operations Problems identified Suggestions for enhancing the disaster recovery and/or business continuity plan Lessons learned Communications Form It is very important during the disaster recovery and business recovery activities that all affected persons and organizations are kept properly informed. Activity Name:Reference Number:Brief Description: Commencement Date/TimeCompletion Date/TimeResources InvolvedIn Charge __________________ Disaster Recovery Event Recording Form All key events that occur during the disaster recovery phase must be recorded. The disaster recovery plan is to be kept up to date to take into account changing circumstances. The report will also contain an assessment of the impact to normal business operations. Description of Disaster:Commencement Date:Date/Time DR Team Mobilized: Activities Undertaken by DR TeamDate and TimeOutcomeFollow-On Action Required Disaster Recovery Team's Work Completed: Event Log Passed to Business Recovery Team: _________________ Disaster Recovery Activity Report Form On completion of the initial disaster recovery response the DRT leader should prepare a report on the activities undertaken. endstream endobj startxref 4125 0 obj <>/Filter/FlateDecode/ID[<35FCC891D2EBAF458897B7D259D8A695><437157FFB5828140AC2468B128288816>]/Index[4115 19]/Info 4114 0 R/Length 64/Prev 225986/Root 4116 0 R/Size 4134/Type/XRef/W[1 2 1]>>stream In the event of an actual emergency situation, modifications to this document may be made to ensure physical safety of our people, our systems, and our data. 1.2 Plan Documentation Storage Copies of this Plan, CD, and hard copies will be stored in secure locations to be defined by the company. Employees who cannot reach staff on their call list are advised to call the staff members emergency contact to relay information on the disaster. Whenever changes are made to the plan they are to be fully tested and appropriate amendments should be made to the training materials. I confirm that above business process is now acceptable for normal working conditions. The Business Recovery Team (BRT) will consist of senior representatives from the main business departments. The report should contain information on the disruptive event, who was notified and when, action taken by members of the BRT together with outcomes arising from those actions. These can include: Cash flow position Temporary borrowing capability Upcoming payments for taxes, payroll taxes, Social Security, etc. ?BM( ___________ Preparing the Business Recovery Report Form On completion of business recovery activities the BRT leader should prepare a report on the activities undertaken and completed. Plan exercising ensures that emergency teams are familiar with their assignments and, more importantly, are confident in their capabilities. Tornado5Electrical storms5Act of terrorism5Act of sabotage5Electrical power failure34Redundant UPS array together with auto standby generator that is tested weekly & remotely monitored 24/7. It is also very important that only authorized personnel deal with media queries. A master protected copy will be stored on specific resources established for this purpose. 2.3.2 DR Procedures for Management Members of the management team will keep a hard copy of the names and contact numbers of each employee in their departments. The plan should also be validated by simulating the circumstances within which it has to work and seeing what happens. Successful DR plans launch into action smoothly and effectively when they are needed. Recovery Tasks (Order of Priority)Person(s) ResponsibleCompletion DateMilestones IdentifiedOther Relevant InformationEstimatedActual1.2.3.4.5.6.7. 4 Insurance As part of the companys disaster recovery and business continuity strategies a number of insurance policies have been put in place. DW8@GG+foao=^7;1 =+e&R *0:k"tidh` h``h`````b6$ 2.3.7 Alternate Recovery Facilities / Hot Site If necessary, the hot site at SunGard will be activated and notification will be given via recorded messages or through communications with managers. Appendix A Technology Disaster Recovery Plan Templates Disaster Recovery Plan for SYSTEM OVERVIEW PRODUCTION SERVERLocation: Server Model: Operating System: CPUs: Memory: Total Disk: System Handle: System Serial #: DNS Entry: IP Address: Other:HOT SITE SERVERProvide detailsAPPLICATIONS (Use bold for Hot Site)ASSOCIATED SERVERS KEY CONTACTSHardware VendorProvide detailsSystem OwnersProvide detailsDatabase OwnerProvide detailsApplication OwnersProvide detailsSoftware VendorsProvide detailsOffsite StorageProvide details BACKUP STRATEGY FOR SYSTEM ONEDailyProvide detailsMonthlyProvide detailsQuarterlyProvide details SYSTEM ONE DISASTER RECOVERY PROCEDURE Scenario 1 Total Loss of Data Provide details Scenario 2 Total Loss of HW Provide details ADDENDUM CONTACTS File Systems File System as of Minimal file systems to be created and restored from backup: Filesystem kbytes Used Avail %used Mounted on Other critical files to modifyNecessary directories to createCritical files to restoreSecondary files to restoreOther files to restore Disaster Recovery Plan for SYSTEM OVERVIEW PRODUCTION SERVERLocation: Server Model: Operating System: CPUs: Memory: Total Disk: System Handle: System Serial #: DNS Entry: IP Address: Other:HOT SITE SERVERProvide detailsAPPLICATIONS (Use bold for Hot Site)ASSOCIATED SERVERS KEY CONTACTSHardware VendorProvide detailsSystem OwnersProvide detailsDatabase OwnerProvide detailsApplication OwnersProvide detailsSoftware VendorsProvide detailsOffsite StorageProvide details BACKUP STRATEGY for SYSTEM TWODailyProvide detailsMonthlyProvide detailsQuarterlyProvide details SYSTEM TWO DISASTER RECOVERY PROCEDURE Scenario 1 Total Loss of Data Provide details Scenario 2 Total Loss of HW Provide details ADDENDUM CONTACTS File Systems File System as of Minimal file systems to be created and restored from backup: Filesystem kbytes Used Avail %used Mounted on Other critical files to modifyNecessary directories to createCritical files to restoreSecondary files to restoreOther files to restore Disaster Recovery Plan for Local Area Network (LAN) SYSTEM OVERVIEW SERVERLocation: Server Model: Operating System: CPUs: Memory: Total Disk: System Handle: System Serial #: DNS Entry: IP Address: Other:HOT SITE SERVERProvide detailsAPPLICATIONS (Use bold for Hot Site)ASSOCIATED SERVERS KEY CONTACTSHardware VendorProvide detailsSystem OwnersProvide detailsDatabase OwnerProvide detailsApplication OwnersProvide detailsSoftware VendorsProvide detailsOffsite StorageProvide details BACKUP STRATEGY for SYSTEM TWODailyProvide detailsMonthlyProvide detailsQuarterlyProvide details SYSTEM TWO DISASTER RECOVERY PROCEDURE Scenario 1 Total Loss of Data Provide details Scenario 2 Total Loss of HW Provide details ADDENDUM CONTACTS File Systems File System as of Minimal file systems to be created and restored from backup: Filesystem kbytes Used Avail %used Mounted on Other critical files to modifyNecessary directories to createCritical files to restoreSecondary files to restoreOther files to restore Disaster Recovery Plan for Wide Area Network (WAN) SYSTEM OVERVIEW EQUIPMENTLocation: Device Type: Model No.