Gii Emergency Planning

8/6/2019 Gii Emergency Planning

1/58

March 17, 2005 Gerald Isaacson 2005

Emergency Management PlanningBusiness Continuity

IT Partners


2/58

April 19, 2005 Gerald Isaacson 2005

Business Continuity Planning

A few definitions to get started:

a disaster

The cake I was baking to bring to Xmas dinner

He lost a laptop with the only copy of his thesis

She lost her research and papers in the lab fire

Payroll system failed the day before payday

Asbestos released in a dorm renovation The death of a student

The Northeast blackout

The recent tsunami


3/58



a disaster

is an event, often unexpected, that seriously

disrupts your usual operations orprocesses

and can have long term impact on your

normal way of life or that of your

organization.


4/58




RTO [Recovery Time Objective]

the point in time when you must have at

least the critical aspects of your business

operational again.


5/58




RPO [Recovery Point Objective]

The last copy of your data that is out of harms

way hopefully it is recently current.


6/58






7/58



its not rocket science


8/58



it is:

a process to minimize the impact of a majordisruption to normal operations

a process to enable restoration of criticalassets

a process to restore normalcy to MIT as soonas possible after a crisis.

it is not just:

recovery of information technology resources


9/58



and it is the phase of crisis management

that follows the immediate actions taken to

protect life and property and contain the

event

it begins when the situation has beenstabilized.


10/58



and it

is now a

national

standardfor both

the

public

and

private

sectors


11/58



An ECAR report in March of this year, from

Baylor Medical Center and the University of

Houston, in the aftermath of hurricane

Allison, posed the following list ofquestions to ask to determine your

resilience to a disaster.


12/58



ECAR Research Bulletin Mar 1 2005


13/58



An ECAR report in March of this year, from

Baylor Medical Center and the University of

Houston, in the aftermath of hurricane

Allison, posed the following list ofquestions to ask to determine your

resilience to a disaster.

The answers constitute your Business

Continuity Plan


14/58


15/58



B B

C

V

F W

CV

C

F

Source: Gartner Group and Comdisco

Network Operations Disruptions

Power

ardware


16/58




17/58




18/58


Mt. St. Helens May 1980 new threats arise



19/58



Its different now.


20/58



ECAR Research Bulletin Mar 1 2005

but we still have the usual concerns


21/58



When is it a Crisis?

Continuity Continuum

Minutes Hours Days Weeks


22/58







23/58







24/58







25/58



A crisis timeline --


26/58


Restoration of Critical Processing


Alarm Notification to First Responders

Data center fire


27/58




Activate the Emergency Operations Center


28/58




IT decision to move to a backup facility


29/58




Assemble IT recovery team at appropriate sites


30/58




Obtain backup tapes from off-premises storage


31/58




Acquire and install backup hardware

and network connections


32/58




Restore Operating System and Network


33/58




Reload database and other data


34/58




Restore CriticalApplications


35/58


36/58


37/58



Recovery Time Objective (RTO)

Do you measure it in hours or weeks?

When do you need to start to reach it on time?


38/58



indows are Closing


39/58



Increasing dependencies on electronic

capabilities to do your job have shortened

the recovery timeframe.


40/58



Increasing dependencies on electronic

capabilities to do your job have shortened

the recovery timeframe.

This often leads to a disconnect between

users expectations and the organizationsability to meet them.


41/58



Lucent technologies

Move to

Alternate

Site

Return

Home

Resume

Business

Data Synchronization

Restore Technology Capability

Restore Communications

Restore Business unctions

Notifications

ital Records

Lost Data

Data Recovery Objective

Recovery Time Objective

(If necessary)

High Level Look at a Recovery Effort


42/58


43/58



Continuity Plan Development Phases

Understand the need

Define the risk to the DLC and define the

level of criticality


44/58


45/58


46/58



Continuity Plan Development Phases Understand the need

Define the risk to the DLC and define the levelof criticality

Give an individual responsibility and authorityfor overall planning

Ensure that organizational units accounting, facilities, residential life,

laboratories, etc. understand theirindividual responsibility for recovery oftheir operations.


47/58




DLCs develop their FARM (Functional

Area Recovery Management) teams

The Business Continuity Planning Team

(BCMT) consists of FARM Team

Coordinators

The BCMT is represented at the MIT

Emergency Operations Center (EOC)


48/58


49/58



The Table of

Contents from

the TLO FARM

Team Plan


50/58



Key Plan Components

Contact list up to date


51/58



Key Plan Components


Resources needed not just computing


52/58



Key Plan Components


Resources needed not just computing

Emergency procedures


53/58




Document the plans for each department,

lab or center Use a common template or framework

Plan review by Business Continuity

Management Team (BCMT) and

Information Systems & Technology


54/58




Test, test, test


55/58



Simulation Testing MITs Central Utility Plant

On an August afternoon, a fuel line rupture in theCentral Utility Plant results in a fire.

When the sprinkler system operates, the ensuing

flood creates a hazardous waste issue due to the oiland ACM.

The sprinkler operation also operates protectivedisconnects and the power is shut down.

There have been 5 injuries of CUP workers

because of this incident. After about 4 hours it is determined that the CUPs

clean up and return to service will take at least 24hours, and the 80% of the campus that the CUPserves will remain without power.


56/58




Test, test, test

Maintain the plans a very difficultprocess but critical to the long term

viability of any plan


57/58



Whats next?

Who should we be talking to in your area?

Who should we be talking to who is not

here?

Any overall concerns about the project?

Any specific concerns that we should beaddressing?


58/58

A il 19 2005 G ld I 2005


Gerald Isaacson, CISSP illiam McShea, C PS

[email protected] [email protected]

617 253-1440 617 253-9491

32-013 32-013

web.mit.edu/bcmt http://web.mit.edu/environ

ment/ehs/

Gii Emergency Planning

Documents

Transcript of Gii Emergency Planning