Networking: A Beginner’s Guide Fifth Edition- P85 ppt

402 Networking: A Beginner’s Guide Disaster Recovery Plan GENERIC COMPANY, INC. IT Documentation TITLE: Disaster Recovery Plan Document #: IT-002 v3 Effective Date: 12/1/09 Issued by: IT Department Page Number: 1 of 4 Approvals: IT Department: Date Controller or CFO: Date 1) PURPOSE a) This document describes the actions, resources, and priorities to pursue to restore key IT services when a disaster causes the company’s computing resources to become unavailable. The plan is intended to minimize further losses and business impacts in the event of a disaster. b) The objectives of the plan include: i) Assist in maintaining business continuity during a disaster ii) Protect data integrity and ensure system survivability iii) Restore the data processing function as quickly as possible iv) Satisfy audit and legal requirements 2) SCOPE a) This Disaster Recovery Plan was written specifically for recovering the IT infrastructure for which IT has primary responsibility, located at the Generic Company headquarters building. It does not cover the recovery of data processing infrastructure located at any other company location(s). b) The plan covers the restoration of the software and historical data for applications resident on servers for which IT has primary responsibility. This does not include the business continuity or contingency plans for which the business units are responsible. While IT is not responsible for the development or implementation of these business continuity plans or contingency plans, IT will assist with the implementation of these plans as required. 3) RESPONSIBILITIES a) The IT department is responsible for issuing this document, reviewing it annually, and issuing new versions as appropriate. b) The Controller or CFO is responsible for reviewing and approving any new versions of this document. 403 Appendix: Understanding the Sarbanes-Oxley Act 4) DEFINITIONS a) Disaster: An event, whether man-made or natural, that unexpectedly inhib- its the company’s ability to operate or deprives the company of access to its key business systems. b) Major disaster: An event that substantially destroys computing and data infrastructure that the company requires to operate. Examples include a fire in the server room, a large earthquake, a major structural failure of the company’s building, flooding of interior spaces in the building that impact IT resources, and so forth. c) Minor disaster: A short-term disruption of the company’s ability to access its key business systems. Examples include the loss of a critical data file (whether through systems failure or accident), a power outage, or a temporary operating problem in the computing chain of a key business system. d) Remediation plan: A plan developed to remediate the key effects of a given major disaster. The remediation plan includes necessary objectives, time- lines, cost estimates, and acceptance criteria. 5) PROCEDURES a) Pre-disaster planning: i) The IT department will maintain a list of hardware resources on which key business resources reside and their necessary configurations. This list will be reviewed annually and updated as necessary, and is attached to this document as Attachment IT-002-A. ii) The IT department will maintain a list of software resources on which key or important business processes rely, including vendor contact data, account numbers, and any related serial or product ID numbers. This list will be reviewed annually and updated as necessary, and is attached to this document as Attachment IT-002-B. iii) The IT department will set up a backup and off-site storage plan that minimizes the risk of loss of data in the event of a disaster. The details of the backup and off-site storage plan will be reviewed annually and updated as necessary, and is attached to this document as Attachment IT-002-C. b) Testing: i) The IT department will annually test the ability of all backup systems to successfully restore data. The general procedure is as follows: (1) Select a recently created piece of backup media. (2) Using the backup software with which the media was created, haphazardly select several files that are normally unchanging 404 Networking: A Beginner’s Guide (such as program binary files) and restore those files to a test directory on the system’s hard disk. (a) If the backup software is unable to restore the selected files, this constitutes a failure of this test. (3) At the command prompt, use the FC.EXE program (file compare), or any other program that can perform bitwise comparisons of files, to compare the restored files to the on-disk live versions. (a) Any bitwise errors encountered constitute a failure of this test. (4) If any failures are encountered: (a) The IT department will notify the relevant parties for the affected server and backup system (for example, the Controller and CFO if the error is on the server that holds the accounting system). (b) The IT department will develop and implement a plan to repair the error. This repair will be treated as an emergency and resolved as quickly as possible. The IT department will work with the server vendor, the maker of the tape drive, and/or the provider of the backup software to assess and resolve the error, as appropriate. (5) The annual test and its outcome will be documented in each system’s server log book. c) Major disaster remediation: i) In the event of a major disaster, the head of IT will be notified immediately. ii) The head of IT will assess the scope and extent of the major disaster as it pertains to the company’s key business systems and other important computing resources. iii) The head of IT will notify the following personnel of the initial IT assessment, as appropriate: (1) CEO (2) CFO (3) Controller (4) Head of Research (5) Head of Human Resources (6) Head of Development iv) The head of IT will develop a detailed remediation plan to address the specific disaster conditions. 405 Appendix: Understanding the Sarbanes-Oxley Act (1) The remediation plan will prioritize recovery efforts in the following order: (a) Accounting system and data (b) Payroll system and data (c) Stock administration system and data (d) Systems to support regulatory and development activities (e) Systems to support research activities (f) Systems to support corporate and general computing needs (2) The remediation plan will include estimated timelines and costs. (3) Each affected department will determine testing procedures and acceptance criteria for the recovered operations, and is responsible for testing recovered operations and accepting or rejecting them. d) The CEO is responsible for approving the remediation plan and ensuring that appropriate resources are made available for carrying it out. e) The head of IT will update the CEO and affected departments of the status of the remediation efforts on a regular basis until the remediation is complete. 6) ATTACHMENTS a) Attachment IT-002-A: Hardware list and configurations b) Attachment IT-002-B: Software license list c) Attachment IT-002-C: Backup and off-site tape storage Server Maintenance GENERIC COMPANY, INC. IT Documentation TITLE: Network Server Maintenance Procedure #: IT-003 V3 Effective Date: 12/1/09 Issued by: IT Department Page Number: 1 of 2 1) PURPOSE a) To define Generic’s procedure for performing regular maintenance on all network servers and to document any problems or observations that may arise in between regular maintenance visits. 406 Networking: A Beginner’s Guide 2) SCOPE a) This procedure applies to the Generic network system server’s hardware and software. 3) REFERENCES a) IT-001, IT Organization and Systems b) IT-FR-003, Generic Network Server Maintenance Electronic Log form 4) RESPONSIBILITIES a) Generic’s IT department is responsible for preparation of this SOP. b) Generic’s IT department is responsible for the execution of the server main- tenance plan. c) Generic’s IT department is responsible for reviewing the server logs as part of the regular maintenance. d) Generic’s IT management is responsible for the approval of this plan and annual review of the server log books. 5) DEFINITIONS a) Network server: Computer and its software serving as a file or print server, or various other roles in the network, as documented in document IT-001. Examples include mail server, database server, DHCP server, accounting system server, etc. 6) PROCEDURES a) Each month as soon as practicable on a weekend following the second Tuesday of each month, maintenance tasks will be performed on each of the network servers and the administration workstation. b) The maintenance tasks will be documented on the electronic form IT-FR-003 as they are performed. This form is saved to the IT group folder on the company network. c) The following describes additional details used in the performance of the tasks listed on form IT-FR-003. i) Windows Update will be run on all servers and then the servers are restarted to test functionality. ii) All server event logs are reviewed for the prior month. Any errors that indicate a problem that requires remediation are noted on form IT-FR-003. iii) Each server (except server GCX) is configured to perform a disk defrag- mentation automatically on its main disk drive once a month. GCX is manually defragmented as part of the monthly maintenance. d) Any significant hardware or software errors will be documented on the IT- FR-003 form and in the server’s log book. “Significant error” is nontransient and is one that represents a problem that needs correcting. . loss of data in the event of a disaster. The details of the backup and off-site storage plan will be reviewed annually and updated as necessary, and is attached to this document as Attachment. Using the backup software with which the media was created, haphazardly select several files that are normally unchanging 404 Networking: A Beginner’s Guide (such as program binary files) and restore. complete. 6) ATTACHMENTS a) Attachment IT-002 -A: Hardware list and configurations b) Attachment IT-002-B: Software license list c) Attachment IT-002-C: Backup and off-site tape storage Server Maintenance GENERIC