2.6 Disaster Recovery Plan Policy

00:01

Hello and welcome to I t. Security policy on Cyber Harry. This is Porter module to disaster recovery policy with myself. Troy Lemaire

00:11

Learning objectives for this part of the module will be contingency plans,

00:15

plan, practice and plan review.

00:20

If we look at this policy, it is another Sands based template

00:23

on disaster recovery plan policy.

00:26

The overview talks about how disasters happen rarely, but management often exhort, ignored the disaster recovery planning process. It's important to realize that having contingency plan for a disaster gives a competitive advantage.

00:40

This policy requires management to financially support and diligently attend to disaster contingency planning efforts. Disasters are not limited to adverse weather conditions.

00:50

Any event that could likely cause an extended delay of service should be considered.

00:54

So in regards to what it's talking about here most of the time, if you are in a earthquake zone or a hurricane zone or Internet Tornado alley, then at that point, those are the main things that you look at. What often gets ignored, um, is something like if you are in the flight path of an airport, there's planes that are taking off and landing right above you.

01:14

At that point, on event that happens where plane crashes into your building

01:19

is possible. So therefore, you would want to make sure you have a plan in place for something like that. Also, if you have natural gas lines that are running in front of your building, then at that point that gas line could catch fire at some point and leave your building either unoccupied or leaving your building in a state where it has some type of physical damage, which

01:38

physically

01:40

affects the machines from operating in your organization. So you want to look at not just the main things that happened, but also the other things that are a little less likely to happen but should definitely be considered.

01:52

Purpose of this policy is the policy defines requirement of a baseline disaster plan to be developing implemented

01:59

scope is directed to the I T management staff That's accountable to ensure the plan is developed. Tested. It kept up to date.

02:06

Looking at contingency plan for disaster recovery. What is your computer emergency response plan? Who's to be contacted? When and how

02:14

was the succession plan?

02:15

How does the floor responsibility from normal staff

02:20

happen if they are unavailable to perform their duties

02:23

day to study detail the data stored on the systems, It's criticality and confidentiality, and then criticality of service list is listening. All the service is provided, and their order of importance

02:34

also explains the order of recovery in both short term and long term time frames.

02:38

Data Bake Backup and Restoration Plan detail. Which date is backed up? The media, where it saved where the media store and how often it's backed up.

02:46

And then equipment Replacement Plan described. What equipment is required to begin to provide Service is list the order in which it is necessary nowhere to purchase equipment

02:54

but both of those you're looking at making sure that you know what systems

03:00

we'll need to be recovered. And then what's the priority in if email is not the first priority, but you're building system is the first priority. We don't wanna make sure your staff focusing on the billy system before they would

03:10

concentrate on the email system.

03:13

Do you wanna put some type of category in there that list? What is the importance of each system?

03:20

And in mass media main It's who's in charge of giving information to the mass media and provide some type of guidelines on what day it is appropriate to be provided

03:28

after you create them. Plan. It's important to practice the plan to the extent possible,

03:32

and you should set aside time to test the implementation of the disaster recovery plan.

03:38

Good way to do this is table top exercises, and you can list here that you would want to conduct those on an annual basis or every two years or every six months, depending on your organization

03:49

and during the test. Issues may arise that fail in that process, and that's okay. That's why you're doing these testing plans because you'd rather them to fail inside of the test. Then, whenever it actually comes to the live environment where you would have, you know, a lot of consequences

04:05

and then the plan at a minimum should be reviewed and updated on it and the whole basis

04:10

you could change that. If it's on a every two years every six months, whatever is needed for your organization

04:16

looking at the compliance

04:18

in for a SEC, teams gonna verify compliance of the policy through different methods, and exceptions have to be approved in advance, and then an employee found to have violated policy may be subject to disciplinary action up to and including termination of employment.

04:36

Though in today summary we looked at disaster recovery policy and contingency plans and in accordance with that disaster recovery,

04:45

the plan, practice and the plan review.

04:48

So disaster recovery recap question

04:51

what should be in the succession plan

04:55

so you would want to look at described the flow of responsibility for what normal staff is unavailable to perform their duties.

05:02

What should be in the criticality of service is list,

05:05

and this is all the service is provided in their order of importance.

05:12

So, looking forward in the next lecture, we're gonna look at again. General policies were gonna actually look at the contingency policy, which is different from the disaster. Recovery policy will cover that a little more in the next piece.

05:26

Again. Questions, clarification. Reach me on Cyberia message. My user name is that Troy Lemaire