Planning for Application Recovery ALFISIG – September 25, 2013 Presenter - David Birdsong

Application Recovery As Project Managers we plan many aspects of the project that has been assigned to our care. One area that is often overlooked is the planning for how the Application will be recovered. This is an area of Risk Management that is receiving more attention as our critical dependencies expand.

The Threat (Just to name a few) Loss of the Data Center (DR) Corruption of the Data Patches and Upgrades Human Error Malicious Harm

Protection Measures Just having backups of the data is no longer enough. Most backup and recovery planning is performed based on data and servers and may miss critical needs of the Application. The focus of Recovery planning must be directed towards the application or the whole system. It is often left up to Technology to provide the planning, but who knows the actual Application requirements ? The Line of Business believes that the plan for recovery of their application is ready and can be executed within a couple of hours. Technology believes that the data can be recovered and Hardware can be replaced but they are not sure how long it will take.

Protection Measures The best way to ensure adequate protection and recovery capabilities is to plan and implement them with the Application deployment. As the Project Manager identifies Project Risks and corresponding mitigation plans, Data Protection and Application Recovery should also be included. Include the DR and backup teams in your planning. Your Business Partners will not think about this unless you bring this aspect of the plan to them. You can help your Business Partners by asking the right questions.

What Do I need to Know? What is the Recovery Time Objective (RTO)? How long can the Application be down for recovery? What is the Recovery Point Objective (RPO)? At what point will the Application be recovered to? What is the Application’s Recovery Tiering? What is the impact to the customer when the application is not available? What is the financial impact to the bank when the application is not available? Are there regulatory requirements that must be met? Are there other applications that have dependencies on this one?

What Do I Need to Know? What are my available Backup Windows? When can the backup run with the least impact to business function while also capturing the data correctly? Does the application require Operational Recovery capabilities only? How will my Data Archive requirements be met? It is not a good practice to use a backup as an application’s archive. The data is at a higher level risk if it is the only copy. Application releases change and may not be compatible with the archived data. Backup systems upgrade and may not be compatible with the old backup format. The media itself is subject to failure or loss It is a better practice to have an application archive that is backed up or protected on a regular basis.

What Do I Need to Know? What is my off-site recovery capability? Define Hardware needs and plan for providing it Storage of data at an off-site location How will data move from off-site storage to the recovery site? What is my Tier rating for prioritization of the recovery effort? What is my on-site recovery capability? How quickly can data be restored on-site? Do tapes have to called from an off-site location?

Data Replication vs. Backups If the application has data replication, do I really need backups? Data Replication Data Replication is a good plan for Disaster Recovery. The recovery point is usually within minutes of the failure. Data Recovery at an off site location is very quick. Replicated disk can be expensive so it is often based on the application tier If you do not have dedicated hardware at the recovery site then the replicated data may be of little value. Deletions, errors and data corruption are also replicated to the site within minutes. Backups Point in time recovery, usually previous day’s files. Can recover an application’s data to previous day’s file for the past 30 days or beyond. Servers system state, and all local drives can be backed up and recovered. Deleted or corrupted data can be restored from previous backups. Off site recovery times can vary widely depending on the location of the off-site storage and the media being used.

Am I protected? Ask what the application tier is and what it means. Ask for a list of what backups are being performed. Ask how the data will be recovered in a DR event. Ask what the off-site hardware plan is for the application. Ask where the data is stored off site and how it will be recovered. Ask what data is actually being backed up. Ask what the retention periods are for the data.

Summary Planning for Application Recovery is best when performed during implementation. Application Recovery and Data Protection are often seen as technology responsibilities but they are not. The Line of Business is actually the key player in establishing the right level of recovery and protection. Project Managers should address this during their planning phase. Include your company’s DR and Backup resources in your projects.

Questions and Comments?

Thank You!