Disaster recovery planning instructions for IT

Systems within the Alfa Laval Group

Disaster recovery planning instructions for IT Systems within the Alfa Laval Group .............. 1
Executive Summary ................................................................................................................... 3
Overview .................................................................................................................................... 3
Major Goals of the Plan ............................................................................................................. 4
1 Local IT Management responsibilities ............................................................................... 4
2 Local management responsibilities .................................................................................... 4
3 How to - process ................................................................................................................. 4
Appendix .................................................................................................................................... 6
Example – fictive Alfa Laval site ............................................................................................... 6
IT Services inventory. ................................................................................................................ 6
Risk Assessment/Business Impact Analysis (BIA) .................................................................... 7
Processes/procedures .................................................................................................................. 8
Action steps in event of a major disaster: .................................................................................. 8
Initially: .................................................................................................................................. 8
Plan Step 1:............................................................................................................................. 8
Plan Step 2 – Restore Temporary Communications to ERP .................................................. 9
Plan Step 3 – Restore Temporary Network Services ............................................................. 9
Plan Step 4 – Re-establish Communications Full Operation ................................................. 9
Plan Step 5 – Re-establish Network Full Operation .............................................................. 9
Plan Step 6 – Re-establish Desktop / Laptops Full Operation ............................................... 9
Matrix of responsibilities and communication plan ................................................................. 10
Matrix of responsibilities: .................................................................................................... 10
During an Emergency: ......................................................................................................... 10
After an Emergency: ............................................................................................................ 10
Contacts .................................................................................................................................... 10
Global IT Services ............................................................................................................ 11
Disaster recovery test ............................................................................................................... 11
Test simulation ................................................................................................................. 11
Testing Plan ...................................................................................................................... 11

1
Testing report ................................................................................................................... 11

2
Executive Summary
This document serves as a help for IT responsible at Alfa Laval sites regarding how to plan
for IT disaster recovery. A disaster recovery plan should be done for each individual IT
system and incorporated into an overall disaster recovery plan for the complete Alfa Laval
entity.

This document provides a guide for preparing an IT disaster recovery. The IT responsible
should create a disaster recovery plan to meet the local business disaster recovery
requirements and to comply with internal policies. This document is split in two parts.

• The first part describes the general instructions to follow when creating a disaster
recovery plan
• The appendix is an example disaster recovery plan concerning a fictive Alfa Laval
site.

The IT disaster recovery plan is a part of the overall company disaster recovery plan.

The disaster recovery plan must be written in a way so that all services can be restored by
personnel outside the normal IT operations.

Local management is responsible and must approve the plan.

Overview
IT Disaster recovery plans and other forms of emergency planning are preparations for critical
events. The planning begins by considering what services that are in operation and how
important these are to the business.

The benefits of developing a comprehensive IT disaster recovery plan include:

• Minimizing potential economic loss
• Reducing disruptions to operations
• Minimizing decision-making during an event
• Reducing reliance on certain key individuals
• Protecting the assets of the organization
• Minimizing legal liability
• Safeguard Alfa Laval customer relations

IT disasters may result from:

• Fire
• Power Grid Failure
• Quarantine of area
• Telephone Failure
• Equipment Failure (eg servers, communication equipment)
• Computer Viruses / Corrupted Data
• Key Employees not available

3
The decision to implement IT disaster recovery procedures has been taken at Corporate IT.
This can be found in the Alfa Laval IT Security Policy.

On ALround – Corporate Functions/IT/Policies & Guidelines

Major Goals of the Plan

The major goals in case of an emergency are:

• To safeguard customer relations

• To minimise service downtime.
• To minimise the economic impact of service downtime.
• To establish alternative means of operation in advance.
• To provide for smooth and rapid restoration of service.

1 Local IT Management responsibilities

Local IT management is responsible for the following actions:

• Create an inventory of IS/IT services

• Perform a business impact analysis together with local management
• Creating the Disaster Recovery plan
• Communicate to all IT personnel so that they are aware of the disaster recovery plan.
• Identify contacts that are critically dependent upon the IT function.
• Decide on initial and subsequent tests of the workability of the plan and of costs
associated with it.
• Test the plan on a regular basis and when the plan has been changed
• Decide on periodic revision of the plan as required.
• Assessment of damages and invoke relevant parts of the disaster recovery plan.
• Recovery of affected services

2 Local management responsibilities

The MD is overall responsible for the business impact analysis and the disaster/recovery plan.
That it is maintained and regularly tested.

3 How to - process

This section shows what steps that needs to be taken when creating the Disaster recovery
plan.

4
Inventory IS/IT services: Services that are IT related must be inventoried so that a complete
map can be analysed.

Perform Business Impact Analysis(BIA): Create a spreadsheet out of these services and
define the impact, the consequences and max time to restore for the respective service. This
must be done together with local management.

Gain approval for BIA: Agree with the service owners that the BIA is sufficient for the
business needs.

Create processes, procedures and external agreements: All details regarding restoration of
services must be defined and routines created. If the service is depending on external
providers then this must also be identified and documented.

Analyse cost for processes, procedures and external agreements: All involved cost must
be identified and documented.

Gain approval for cost with MD: The complete BIA together with corresponding costs must
be discussed and agreed with the MD. Any deviation must be analysed and agreed together
with the respective service owner.

Create contact info/communication plan and matrix of responsibilities: All contact

information necessary to invoke the disaster recovery plan must be documented as well as

5
plan on how to distribute information when a disaster occurs. Besides this a matrix of
different responsibilities must be defined.

Inform/educate all involved parties: Everything defined and decided must be

communicated to all involved parties including the service owners. All necessary education
must be done at this stage.

Disaster recovery test: The disaster recovery test must be performed at least once a year and
also if major changes to the disaster recovery plan has been made.

All new services must follow the above chain of actions so that the disaster recovery plan is
complete at all times.

Appendix
Example – fictive Alfa Laval site
The below attached document describes each step that you need to take to create a disaster
recovery plan. Please note that the Disaster recovery plan and procedures may vary a lot
depending on the site size and the business performed at the site. There is a big difference if
the site is a Global distribution centre or local sales office.

IT Services inventory.
IT Services defined:

• Lotus Notes Mail

• Scala
• CAS
• File/Print
• Local Area Network
• Wide Area Network

Other hardware components necessary to accomplish above services

• Desktop PCs
• Portable PCs
• Network Equipment
• Servers
• Cooling
• Fax
• UPS
• PBX
• Structured cabling and fiber optic cables

6
Hardware and software maintenance and communication agreements
AL has signed following IT / IS agreements:

Agreement tape and Duration of agreement

Supplier
description
Agreement for provision of Equant 2008-10-01
WAN connection
iScala software maintenance Scala Global AL Agreement
and support agreenent
Software licenses and Hewlett Packard Global AL Agreement
distribution Ireland

The detail list of servers hardware, operation system, installed software version, server
name and IP address could be found in file named yyy.xls in the worksheet named
Servers.
The information about routers, network switches and printers could be found in file
named zzz.xls in the worksheet named LAN.

These two documents yyy.xls and zzz.xls resides both in the file server and in the safe.

Risk Assessment/Business Impact Analysis (BIA)

This Alfa Laval company maintains a small sales office with a local area network (LAN) that
supports about 50 users. The office relies on the LAN and its components for standard
automated processes, such as developing and using spreadsheets, word processing, and e-
mail. The office also maintains a customized database application that supports Inventory, a
key resource management process. CAS is also in use. The network manager is responsible
for developing a LAN/PC/server disaster recovery and begins with the business impact
analysis (BIA). This includes the business process, consequence, Business impact and
tolerance.

Consequence in case of Max time

Business Process Business Impact Comments
disruption to restore

Lotus Notes Mail Server No access to mail Medium 3 Days

Scala Server No access to ERP functions High 3 Days
Lan components No access to local servers High 1 Day
No access to applications
Power User Desktops Low 2 Days
and data
No access to applications
Power User Portables Low 2 Days
and data
Global network access No access to Sweden High 2 Days
No access to all IT
Complete Damage of Computer Center High 2 Days Temporary
Resources

Structured Cabling and Fiber Optic No Access to IT Resources High 1 Day Temporary

CAS server No access to sales tools Medium 2 Days

7
File server No access local shared files Medium 10 Days

High = Not possible to do business without this service

Medium = Affecting the business but the consequences are limited
Low = Minor impact to the business

Processes/procedures
Server hardware restore.doc
BackupRestore.doc
CAS restore.doc
Scala restore.doc
File server restore.doc
Tape rotation.doc
Network equipment replacement.doc
Contact WAN supplier.doc
Mail server.doc
Process handling a virus attack.doc
…

All above documents are printed and stored in the safe and also in the off site location.

Information about system administration password

list, source software CD’s and backup copies.
System administration password list.
The password list is kept in the safe and also in the off site location. Password list is available
for IT disaster recovery group.

Supervision on the installation software.

The source software CD’s are in the safe in the office. The access to the safe is as per
company policies.

Action steps in event of a major disaster:

Initially:
• Management Team inspects damage and reports to the Managing Director
(MD)
• MD makes decision if Disaster Recovery Plan is to be invoked

Plan Step 1:
• IT Manager retrieves Backup Tapes
• IT Manager to determine if Outside consultants are required to assist in
Restoring services

8
Plan Step 2 – Restore Temporary Communications to ERP
RESPONSIBILITY – IT Manager
• Install necessary software/hardware to be able to access the ERP system
• Create possibilities for printing

Plan Step 3 – Restore Temporary Network Services

RESPONSIBILITY – IT Manager
• Rent / Purchase temporary server for Lotus Notes
• Restore Lotus Notes with priority to the e-mail database
• Temporary server to be located at external site site due to bandwidth, backup
site is office B
• Restore Lotus Notes Database

Plan Step 4 – Re-establish Communications Full Operation

RESPONSIBILITY – IT Manager
• List Data Communication Equipment required to be purchased in order to re-
establish primary site
• Place order with relevant WAN provider. In case of centrally controlled WAN
service contact Corporate IT for coordination
• Arrange with phone company for voice equipment and service

Plan Step 5 – Re-establish Network Full Operation

RESPONSIBILITY – IT Manager
• List Network Equipment required to be purchased in order to re-establish
primary site
• Place order with Leading Solutions (HP/Dell) for Servers
• Place order with Equant for Routers, Switches, Hubs
• Install Network, order of priority: Applications, User files

Plan Step 6 – Re-establish Desktop / Laptops Full Operation

RESPONSIBILITY – IT Manager
• List Desktop / Laptop Equipment required to be purchased in order to re-
establish primary site
• List any local software media required to be purchased in order to re-establish
primary site
• Place order with Leading Solutions for hardware, Compaq Ireland for
Microsoft or Lotus software, Leading Solutions for all other software
• Install hardware and software

9
Matrix of responsibilities and communication plan
Matrix of responsibilities:
Mobile phone /
Person Responsibility Company Office phone Home address
home
Kalle Olsson IT Responsible AL XYZ +4646223344 +46709332244
Inger Karlsson PC Environment AL XYZ +4646223345 +46709332245
Kalle Olsson Server AL XYZ +4646223344 +46709332244
Environment
Inger Karlsson WAN AL XYZ +4646223345 +46709332245
Inger Karlsson LAN AL XYZ +4646223345 +46709332245
Kalle Olsson AS/400 AL XYZ +4646223344 +46709332244
Kalle Olsson Notes/Domino AL XYZ +4646223344 +46709332244
Kalle Olsson IS Systems AL XYZ +4646223344 +46709332244
Inger Karlsson SecurID AL XYZ +4646223345 +46709332245

During an Emergency:
Notify IT Department as to the loss of computer services

Please note: If emergency was to occur after hours, the Alarm company would contact an
appointed responsible person who in turn would contact the Personnel Staff and/or MD.
Depending on the emergency he/she would contact the Management Team

After an Emergency:
1. If necessary, Backup sites will be set up and begin operations to support business until
the primary site is restored to service
2. Network services shall be restored in priority order as much as possible with functional
equipment on hand.
3. The additional equipment required to bring the business to full operations shall be listed
and ordered from vendors.

Contacts
Members of IT disaster recovery group

Person Position Company Office phone Mobile phone / home Home address
Kalle Olsson Managing Director AL XYZ +4646223344 +46709332244
Inger Karlsson Financial Director AL XYZ +4646223345 +46709332245

Internal & external IT contact information

10
Internal Contact List

Person Position Company Office phone Mobile phone / home Home address
Inger Karlsson Managing Director AL XYZ +4646223345 +46709332244
Sven Lilja Financial Director AL XYZ +4646223346 +46709332245

External Contact List

Office phone /mobile/fax

Vendor Name Support Person
Equant WAN data comunication Egypt
Scala ERP - Scala
LAN supplier Integrator X
Dell Hardware new sales

Global IT Services
Alfa Laval Lund AB, PO Box 73, SE-221 00 Lund, Sweden
Visiting address: Rudeboksvägen 3, Lund
Tel switchboard: +46 46 36 65 00
Tel direct: +46 46 36 72 75, Fax: +46 46 36 71 81
Web address: http://servicedesk.alfalaval.com

Disaster recovery test

It is important in successful disaster recovery planning to regularly test and evaluate the plan
itself. Data Processing operations are volatile in nature, resulting in frequent changes to
equipment, programs, documentation, etc. These actions make it critical to consider the plan
as a changing document.

Test simulation

Simulate that each/all critical services are down as described in the BIA and take action
according to the Disaster Recovery Plan

Testing Plan

• One simulation every year or when major changes are applied

• Days and times will vary
• Scope of the test will vary depending on the need

Testing report

• Report must be created and communicated locally and to local management. This must
include time taken to do the restore.
• Update the Disaster Recovery plan accordingly.

11