1

Department of Information TechnologyOffice of Business Continuity

Disaster Recovery Assessment Disaster Recovery Assessment and and

Feasibility StudyFeasibility StudyClose Out Certification RequestClose Out Certification Request

July 28, 2010July 28, 2010

Presented by:Mary Wanda Anaya, Business Continuity Manager

Stephanie Gallegos, Business Continuity Analyst

Enterprise BCM

Program

Offi ce of Business Continuity

Mission Statement Provide the planning methodology for how the Department of Information

Technology will recover and restore partially or completely interrupted critical function(s) within a predetermined time after a disaster or

extended disruption.

Prepare for future incidents that could jeopardize the State’s core mission critical systems.

Vision StatementA Business Continuity Program that strives to maintain continuity of

operations for the State’s mission critical services by sustaining a high level of standards and excellence.

Business Continuity Program

3

The Department of Information Technology received $250,000 for a Disaster Recovery (DR) Assessment and Feasibility Study to determine the best approach for redundancy for its most critical Information Technology (IT) based services and applications. The purpose of this project was to determine the most cost effective means of providing this service.

FY 2008 C2 Appropriation

DR Assessment -Threat and Risk AssessmentEnterprise Applications

(Email, Share, Mainframe)Site Visits – Colorado, Arizona, & Oregon

Feasibility Study – Critical Applications AssessmentBC-DR Questionnaire to Executive AgenciesDetermine 12 Top Critical ApplicationsInterview 10 Agencies (Business & IT Staff)Provided the BC and DR Recommendations

Training – Business Continuity ClassesFormal BC Class and Certification

Business Continuity Awareness (2 Classes) – Agencies

Business Continuity Planning (1 Class) - Agencies

Result of the Study - DoIT released a RFP for Data Resilience and Disaster Recovery Site Service

4

Project Time Line

2009August Site Visit (Colorado, Arizona, Oregon)March Contracted POD Inc. August Conduct DR Assessment and Feasibility

StudyApril Office of BC formal training and attain

certification. November Develop and Release an RFP for

Enterprise BC/DR Site Services.2010

January Vendor prepare and submit RFP proposals.April Evaluate RFP proposals and select finalistMay Conduct Agency and DoIT staff BC trainingJune Close Out ContractJuly Award Price AgreementAugust Contract Enterprise BC/DR Site

5

Project Deliverables Received

Del #1 Discovery DocumentDel #2 Threat Analysis ReportDel #3 Risk Analysis ReportDel #4 Threat & Risk Recommendations DocumentDel #5 Critical Applications DeterminationDel #6 Evaluate Selected agencies BC & DR PlansDel #7 Evaluate Twelve Critical Applications ArchitectureDel #8 Critical Applications RecommendationsDel #9 Determine Disaster Recovery efforts for Developing Linkage of Like Applications and Platforms ReportDel #10 Overall Disaster Recovery Recommendations

6

Project Cost

  AMOUNT VENDOR DESCRIPTION

Feasibility Study $199,974.80 POD Associates

DR assessment and feasibility study to establish requirements for DR services. Contract No. 09-361-3025 Extended through - 3/30/10

Staff Training $19,459.06 ABBA BC Training Business Continuity Training

Colorado Site Visit $6,495.39 Aquila Travel Airfare & Per Diem to fly to Denver for site visits

Arizona Site Visit $5,380.37 Aquila Travel Airfare & Per Diem to fly to Phoenix for site visits

Oregon Site Visit $6,401.31 Aquila Travel Airfare & Per Diem to Portland for site visits

New Mexico Site Visits $44.80   In-state mileage to travel to CYFD

Washington Training $5,390.00 Sentryx Bus Continuity Training for Mary & Stephanie

Washington Travel $4,183.19 Aquila TravelAirfare for Stephanie & Mary to fly to Washington DC to attend a Training

Misc. $2,464.39 Amazon.com Bus Continuity Planning Books, Online Course

$250,000.00 TOTAL BUDGETED

$249,793.31 TOTAL EXPENDED

$206.69 TOTAL REMAINING

7

Lessons Learned1. When the product of the project is a study, it is critical to

the project to include a requirement in the contract for a technical writer.

2. When critical information is gathered through an interview process, note gathering should extend to include voice recording to assure all important information is documented.

3. Even in small projects It is difficult for the Project Manager and the Project Team Leader to be the same individual.

8

Price AgreementRFP# 00-361-00-01416DoIT Disaster Recovery and Data Resilience Data Center Site(s)

Category-1 Resilience Data Center Site (GOLD) Production/Failover Available 24x7x365

Category-2 Hot Data Center Site (SILVER) Host Equipment Operating System Application Software Copy of Data – test Available within 8 hrs

Category-3 Warm Data Center Site (BRONZE) Racks, Power, Data Available within 24 hrs

Category-4 Cold Data Center Site (PAPER) only floor space Available within 72 hrs