1. SAPbiz Disaster Recovery Update Bil Huxley – IS&T Administrative Computing 14-September-2005

2. SAPbiz Disaster Recovery Update2 of 11 SAPbiz Disaster Recovery Agenda Disaster Recovery vs. Business Continuity MIT Disaster Priorities & Organizational Structure MIT Business Continuity Management Team & FARM Plans Recent Disaster Recovery related activities SAP Payroll to establish new recovery requirements SAP recovery requirements Disaster Recovery exercise proposed for Spring of 2006 Next Steps

3. 14-September-2005SAPbiz Disaster Recovery Update3 of 11 Disaster Recovery vs. Business Continuity Disaster: a sudden calamitous event bringing great damage, loss, or destruction; broadly : a sudden or great misfortune or failure Although instances of computer crime and abuse receive extensive media attention, human error is estimated to cause greater losses in information systems operation. Disasters such as earthquakes, floods, and fires are the particular concern of disaster recovery planning, which is a part of a corporate business continuation plan. A contingency scheme is also necessary to cover the failure of corporate servers or telecommunications networks.

4. 14-September-2005SAPbiz Disaster Recovery Update4 of 11 MIT Disaster Priorities Life and Safety will take priority in the event of a disaster. This may include the Cambridge community or other neighbors as well as students and staff “housed” by MIT. MIT’s Emergency Management Team and Emergency Operations Center (http://informit.mit.edu/emergency/) will coordinate all activities in the event of an emergency.http://informit.mit.edu/emergency/ People and Data are irreplaceable! Today there is increased concern for preparedness to deal with larger disasters (multiple buildings) and to comprehensively assess the value of contingency planning for a much broader collection of information systems.

5. 14-September-2005SAPbiz Disaster Recovery Update5 of 11 MIT Business Continuity Management Team & FARM Plans Through 2001 MIT’s Disaster Recovery efforts were led by MIT’s BCMT (http://web.mit.edu/bcmt/) and focused on plans to deal with the loss of single buildings / offices.http://web.mit.edu/bcmt/ Functional Area Recovery Management (FARM) Plans were published which dealt with about a dozen central offices / facilities including the W91 Data Center (http://web.mit.edu/bcmt/PlanLib.html). On average these plans have been updated about every 3 years. Data backups and alternate servers at on-campus sites were deemed adequate (sufficient risk mitigation).

6. 14-September-2005SAPbiz Disaster Recovery Update6 of 11 MIT Business Continuity Management Team & FARM Plans Freshman Admissions Student Services Information Technology Payroll SAP ERP Technology Licensing Office Comptroller's Accounting Office W91-Data Center Human Resources Student Financial Services Libraries Facilities Financial Planning Office of Sponsored Programs

7. 14-September-2005SAPbiz Disaster Recovery Update7 of 11 Recent Disaster Recovery related activities October 2004SAP E40 Recovery Simulation (Core R/3) Late 2004SAP ITS Servers upgraded (Linux) Early 2005SAP migrated to new EMC SAN May 2005SAP Integration Test for hardware renewal May 2005SAP R/3 Servers upgraded (SUN Servers) May 2005SAP WAS/NetWeaver technology installed July 2005SAP ERP FARM Plan updated

8. 14-September-2005SAPbiz Disaster Recovery Update8 of 11 SAP Payroll - new recovery requirements Weekly Non-Exempt Time Entry & Payroll run in SAP have a window of about 60 hours in a non-Holiday week to deliver deposit information to the bank / Federal Reserve. In a week with a Monday Holiday this window shrinks to about 36 hours. Other Payroll processes may also have requirements which could be very challenging if a 48 hour SAP recovery were required at the least opportune time. IS&T working with the business offices and senior management would like to look at opportunities / possibilities for reducing the SAP recovery timeline.

9. 14-September-2005SAPbiz Disaster Recovery Update9 of 11 SAP recovery requirements What services / systems are in scope? Can we list what services / systems are out of scope? Integration between various systems create concerns for defining interdependencies and functional impact if some systems are re- created at a later time or not at all (consider ECAT, IXOS or automated faxing). Integration between systems also raises issues for a consistent “Point In Time” restore lest systems be out of sync in a way that impacts the functionality or the staff (consider COEUS vs. SAP or MITid vs. SAP).

10. 14-September-2005SAPbiz Disaster Recovery Update10 of 11 Disaster Recovery exercise proposed for Spring of 2006 Include SAP Payroll implementation Include EH&S implementation Expand functional scope of exercise to include SAPwebSS (ITS) services, SAP-Dropbox, Check Printing, Departmental Printing and possibly other services not included in October 2004 exercise. Include process changes which simplify / expedite validation of recovered SAP environment.

11. 14-September-2005SAPbiz Disaster Recovery Update11 of 11 Next Steps Over the next couple of months Bil Huxley will be in touch with the various business offices and IT groups to pursue: Review for update with each business office their specific contacts, activities and ‘operational highlights’ in the SAP FARM Team Plan. Assess priorities for all SAP integration points with other systems / services. While the Core R/3 are ‘Category 1’ for disaster recovery, some integrated services may be Category 2 or higher. IS&T, including Admin Computing, R3-Admin, Server Operations, and Computing-Help, will investigate process and technologies which might allow a shorter time line for recovery and which may facilitate off campus data backups.