1 Department of Information Technology Office of Business Continuity Disaster Recovery Assessment and Feasibility Study Close Out Certification Request July 28, 2010 Presented by: Mary Wanda Anaya, Business Continuity Manager Stephanie Gallegos, Business Continuity Analyst

Mission Statement Provide the planning methodology for how the Department of Information Technology will recover and restore partially or completely interrupted critical function(s) within a predetermined time after a disaster or extended disruption. Prepare for future incidents that could jeopardize the State’s core mission critical systems. Vision Statement A Business Continuity Program that strives to maintain continuity of operations for the State’s mission critical services by sustaining a high level of standards and excellence. Business Continuity Program

3 The Department of Information Technology received $250,000 for a Disaster Recovery (DR) Assessment and Feasibility Study to determine the best approach for redundancy for its most critical Information Technology (IT) based services and applications. The purpose of this project was to determine the most cost effective means of providing this service. FY 2008 C2 Appropriation DR Assessment -Threat and Risk Assessment Enterprise Applications ( , Share, Mainframe) Site Visits – Colorado, Arizona, & Oregon Feasibility Study – Critical Applications Assessment BC-DR Questionnaire to Executive Agencies Determine 12 Top Critical Applications Interview 10 Agencies (Business & IT Staff) Provided the BC and DR Recommendations Training – Business Continuity Classes Formal BC Class and Certification Business Continuity Awareness (2 Classes) – Agencies Business Continuity Planning (1 Class) - Agencies Result of the Study - DoIT released a RFP for Data Resilience and Disaster Recovery Site Service

4 Project Time Line 2009 AugustSite Visit (Colorado, Arizona, Oregon) March Contracted POD Inc. AugustConduct DR Assessment and Feasibility Study AprilOffice of BC formal training and attain certification. NovemberDevelop and Release an RFP for Enterprise BC/DR Site Services JanuaryVendor prepare and submit RFP proposals. AprilEvaluate RFP proposals and select finalist MayConduct Agency and DoIT staff BC training JuneClose Out Contract JulyAward Price Agreement AugustContract Enterprise BC/DR Site

5 Project Deliverables Received Del #1 Discovery Document Del #2 Threat Analysis Report Del #3 Risk Analysis Report Del #4 Threat & Risk Recommendations Document Del #5 Critical Applications Determination Del #6 Evaluate Selected agencies BC & DR Plans Del #7 Evaluate Twelve Critical Applications Architecture Del #8 Critical Applications Recommendations Del #9 Determine Disaster Recovery efforts for Developing Linkage of Like Applications and Platforms Report Del #10 Overall Disaster Recovery Recommendations

6 Project Cost AMOUNTVENDORDESCRIPTION Feasibility Study$199,974.80POD Associates DR assessment and feasibility study to establish requirements for DR services. Contract No Extended through - 3/30/10 Staff Training$19,459.06ABBA BC TrainingBusiness Continuity Training Colorado Site Visit$6,495.39Aquila TravelAirfare & Per Diem to fly to Denver for site visits Arizona Site Visit$5,380.37Aquila TravelAirfare & Per Diem to fly to Phoenix for site visits Oregon Site Visit$6,401.31Aquila TravelAirfare & Per Diem to Portland for site visits New Mexico Site Visits$44.80 In-state mileage to travel to CYFD Washington Training$5,390.00SentryxBus Continuity Training for Mary & Stephanie Washington Travel$4,183.19Aquila Travel Airfare for Stephanie & Mary to fly to Washington DC to attend a Training Misc.$2,464.39Amazon.comBus Continuity Planning Books, Online Course $250,000.00TOTAL BUDGETED $249,793.31TOTAL EXPENDED $206.69TOTAL REMAINING

7 Lessons Learned 1.When the product of the project is a study, it is critical to the project to include a requirement in the contract for a technical writer. 2.When critical information is gathered through an interview process, note gathering should extend to include voice recording to assure all important information is documented. 3.Even in small projects It is difficult for the Project Manager and the Project Team Leader to be the same individual.

8 Price Agreement RFP# DoIT Disaster Recovery and Data Resilience Data Center Site(s) Category-1 Resilience Data Center Site (GOLD) Production/Failover Available 24x7x365 Category-2 Hot Data Center Site (SILVER) Host Equipment Operating System Application Software Copy of Data – test Available within 8 hrs Category-3 Warm Data Center Site (BRONZE) Racks, Power, Data Available within 24 hrs Category-4 Cold Data Center Site (PAPER) only floor space Available within 72 hrs