Business Continuity Management

BCM tools in operation: Tool based Business Continuity and Disaster Recovery Planning
London, 1.Feb.2007

Schenker AG Alexander Tsolkas CSO February 2007

Agenda

• • • • • • • •

Agenda Intro Overview of the market leaders Tool ranking Tool list prices Example of a tool based IT DRP Advantages and disadvantages of a tool based IT DRP Discussion
2

Schenker AG; Alexander Tsolkas; Feb.2007, London

Intro

• 65,5% of the organisations did not update their business continuity plan for the last 10 years • 26,32 % did update their BCP 1 to 3 times in the last 10 years • Less than half fullfil an appropriate quantity of their BCP targets • 54% of the CIO’s plan to change their BCP strategy • 65% expect a raise in costs for IT BCP
Quelle: Gartner Research a KPMG study 2002

Schenker AG; Alexander Tsolkas; Feb.2007, London

3

Overview of the market leaders

Vendors Strohl Systems Binomial International Coop-Systems eBRP Solutions Inc. BRProactive Inc. Business Protection Systems EverGreen Grapevine Software MIR3 Sunguard TAMP Systems CAPT

Schenker AG; Alexander Tsolkas; Feb.2007, London

4

Strohl Systems

LDRPS 10
License does not expire Web hosting options Runs on SQL Server Small solution for 5 to 30 users Professional solution for 5 to 50 users Built-in methodology and guidance based on a long experience User prompts to enter data Modules: BCP, Corporate Crisis Management, Business Process Recovery Application Recovery, Site Event Management Drag and drop functionality Transparent tree structure User and group administration >200 predefined standard reports which describe plans Customizable plan navigation which guides the user through the plan specifically Secure data management via encryption Backup via standby servers Tool uses a basic Windows format Tree navigation function Strong consideration of business processes

Schenker AG; Alexander Tsolkas; Feb.2007, London

5

Strohl Systems

Incident Manager 3.0
Powered by ESI’s WebEOC – web based Strong influence during development through experience with LDRPS Scope: -Life Safety -Impact Assessment -Recovery and Restoration Pinboards offer the possiblity to digitise and electronically organise information and problems collected in an analog way Transparent tree structure Incident management on the basis of : - Coordination – via control over the situation with tracking possibility - Communication – Chat client, eMail and Incident Escalation Management - Methodology – Best Practices via ICS (Incident Command System) - Scalable – runs on a Laptop as well as in an IPC Status reports of the crisis situation Evaluation of the situation and priorisation of procedures Enhanced function for monitoring groups, processes and situations IM 3.0 offers status displays, markers and pinboards MapTac integrated

Schenker AG; Alexander Tsolkas; Feb.2007, London

6

Binomial International

Phoenix
For the development of BCPs on the basis of Windows Free selection which database to be used Quick and easy creation of the single components of the BCP Easy input of information and good information management Easy updates of the plan Multi user system Cooperation of different business departments and units possible Phoenix modules -Phoenix Corporte Edition -Phoenix for Banks -Phoenix for Credit Unions -Phoenix for Biotechnology -Phoenix for Community Hospitals -Phoenix for Hospitals -Phoenix for ISPs -Phoenix Small Business Edition

Schenker AG; Alexander Tsolkas; Feb.2007, London

7

Coop Systems

myCoop 5.3
Supports 7 phases in a web based system Easy to use Low costs Content can be imported Easy to learn Object class technology Can be customized during the complete life cycle of the system -Languages -Regions -Currencies -Integration into other systems Modules -Start, Analysis, Creation, Training, Exercise, Maintenance, Execution, Security -Regional parameter settings, Integration, Hosting

Schenker AG; Alexander Tsolkas; Feb.2007, London

8

eBRP Solutions

eBRP Toolkit
Offered modules are: -Risk assessment o Physical, personal related, business processes, technological systems -Business impact analysis o Critical resources, recovery time, customers vendors, finance, dependencies -Technology modelling o Hardware inventory, software inventory, network, applications, users -Plan development & maintenance o Unlimited amount of plans, built-in web links, built in data links, check list development, plan linkage, print feature of plans in parts or completely, eMail notification -Features o Web based, unlimited amount of users, role based, access controls, traceability, import of data sheets, Web services, >100 built-in standard reports

Schenker AG; Alexander Tsolkas; Feb.2007, London

9

BRProactive Inc.

BRProactive
Tour guide for users Uses Microsoft Word for planning and editing Very good help functions No database know how necessary Integrated full recovery: Main business area, Voice, IP, LAN, Mid-range systems 8 predefined recovery team plans, which can be added initially with information Resource planning and notification sequence integrated Industry standards are provided consequently and have been considered during development Action based approach Password security Import and export function for files Predfined forms which can be used

Schenker AG; Alexander Tsolkas; Feb.2007, London

10

Business Protection Systems

Business Protector Gateway
Web based with browser interface Specifically for risk management and BCP Scalable Outsourced service or own operation Fast reaching of the targets High quantity of plans and reports in documents (on-line formats and *.pdf) Decentral planning with central control Automatic notification options On-line reports, notification trees, emergency procedures Relational database Simple document management Connection to external links, documents and databases

Schenker AG; Alexander Tsolkas; Feb.2007, London

11

Evergreen Data Continuity Inc.

Mitigator
Overall business continuity management Complete company inventory Business impact analysis IT Risk Assessment Application recovery points based on lost data Recovery analysis based on business requirements versus IT capabilities Impact analysis based on a malfunction, application failure or general failure Recovery strategies including cost calculation based in inventory data Overall business and operative continuity and disaster recovery plans for all company locations Creation of recovery teams and task assignment to team members Test and maintenance of the BCP or DRP Assists for SOX 404 compliance Financial and operative risks can be drawn from operative failures Tons of reports After installation Mitigator provides loaded potential risks, recovery team tasks and 1000 best practice proposals

Schenker AG; Alexander Tsolkas; Feb.2007, London

12

Grapevine

Full Command
Transform existing plans in living documents The process of finding, insertion, registration, evaluation, approval und supporting of personnel, of resources and documentation is simplified. Distribution and standardisation of the content of plans over many organisations Plans can be edited directly by the means of a browser Maitenance of accurate plan data Testing of plans Analysis of vulnerabilities and risks Reporting Secure authentication and accesses

Schenker AG; Alexander Tsolkas; Feb.2007, London

13

MIR3

• Enterprise
Company wide communication for the major Business, Disaster Recovery, Business Continuity Role based access control Intelligent messaging system Works with Oracle DBs, Peoplesoft applications, MS-Active Directory, SunGard, Paragon/ePlanner/Revolution, Strohl’s LDRPS and LDAP Implementations Support for MS-Outlook for Telefone, GSM, Email, Pagers, SMS, Fax and Satellite telefone systems Maintenance of Remote- and international business locations, IPCs and WANs

Schenker AG; Alexander Tsolkas; Feb.2007, London

14

Sungard

• Business Continuity Solutions
Business and Technology Profile Solution Business Impact Analysis Solution End-User Recovery Solution Information Availability Assessment Solution Managed Tape Backup Solution System Recovery Solution Vaulting and Business Continuity Solution Paragon -BCP development -“What if” scenario development (simulation) -Messaging, Eskalation -Maintainance of plans -Database oriented

Schenker AG; Alexander Tsolkas; Feb.2007, London

15

TAMP Systems

• Disaster Recovery System DRS
Scalable Customizable reporting Decentral planning possibilities Role based access control Automatic plan updates (via external interfaces) Pratical approach for application functionality to maintain plans without complications Simple user guidance

Schenker AG; Alexander Tsolkas; Feb.2007, London

16

Heine & Partner – Info AG

• Continuity Action Planning Tool
MS-Access based Registration and maintenance of resources -Organisational units, persons emergency teams, business functions, technology, software, data inventory, connections, other aids, dangerous goods Development of action plans - Emergency scenarios and recovery strategies, activities and action plans (graphical user interface) Output document manager -Print lists ( report generator for multiple formats) -Free textpages -Emegency handbooks and table of content Administration -Logging of user activities -User access control and authentication Special functions -Layout of the print output -Customization of data and field names -Data import and export
Schenker AG; Alexander Tsolkas; Feb.2007, London 17

Tool ranking

Vendors (personal ranking list)
1 eBRP Solutions Inc. – eBRP Toolkit 2 Strohl Systems, LDRPS 3 Sunguard – Business Continuity Solutions 4 MIR3 – Enterprise 5 EverGreen – Mitigator 6 Heine & Partner – Continuity Action Planning Tool 7 Grapevine Software – Full Command 8 Coop-Systems – myCoop 9 Strohl Systems , Incident Manager 10 BRProactive Inc. – BRProcative 11 Business Protection Systems - Business Protector Gateway 12 Binomial International – Phoenix 13 TAMP Systems – Disaster Recovery System

Schenker AG; Alexander Tsolkas; Feb.2007, London

18

Tool list prices

Hersteller
Strohl Systems, LDRPS 115.000 €, Incident Manager 3.0 38.000 €. Binomial International – Phoenix ca. 80.000 € Coop-Systems – myCoop ca. 7000 Euro eBRP Solutions Inc. – eBRP Toolkit ca. 350.000 € BRProactive Inc. – BRProcative 26.000 € Business Protection Systems - Business Protector Gateway 150.000 € EverGreen – Mitigator 120.000 € Grapevine Software – Full Command 27.000 € MIR3 – Enterprise from ca. 140.000 € Sunguard – Business Continuity Solutions – varies from module to module TAMP Systems – Disaster Recovery System - no price provided Heine & Partner – Continuity Action Planning Tool 10.000 € SU, 80k Enterprise

Schenker AG; Alexander Tsolkas; Feb.2007, London

19

Example of a tool based IT DRP

Heine & Partner CAPT – Continuity Action Planning Tool

Schenker AG; Alexander Tsolkas; Feb.2007, London

20

Advantages and disadvantages of a tool based IT DRP

• Pros
Standardized and customized format of all plans Simple maintenance and update of plans (via integrity of the software) Cental policy of the tool and decentral maintenance Web based access from all over Access to plans is simple and availability is higher Customizable layout of lists/reports and plans Printout of plans in parts which are required Partly plans for dedicated groups can be printed out

• Cons
Expensive first time investment Costs for training Requirement of a handbook Interfaces most often do not provide what is wished in terms of applications and data General limitations due to the fact that is is a tool Additional costs for administration, hosting and maintenance, backup, etc.
Schenker AG; Alexander Tsolkas; Feb.2007, London 21

Discussion

Questions
Alexander Tsolkas CSO Schenker AG Alexander.Tsolkas@schenker.com www.schenker.com

Opinions
Schenker AG; Alexander Tsolkas; Feb.2007, London 22