IBM—华为PDM项目IT04.Businessrecovery0205.doc

I/T Project PlanIT04. Business RecoveryInformation Technology Strategy and Plan ConsultancyPhase 3 ReportFebruary 1999IT04. Business RecoveryScope and ObjectiveWith the investment in IT facilities such as the new data center and with IT being the leverage to Huaweis business, it is important to assess the risk to Huawei in case of unforeseen disasters to IT facilities. The objectives of this project are to understand the business impact on Huawei in case of damage caused by disasters to IT facilities, and to develop IT recovery plan such that the impact of disasters to Huaweis business can be kept to a minimum. The scope of this project include: Analyze the business impacts to Huawei in case of disaster to key IT facilities. Assess the risk and threats involved. Derive a business recovery strategy with the key focus to understand what are the requirements for IT to get prepared. Plan and implement a corresponding IT Continuity Plan.This project should also address the following: Critical business processes and applications Future operating environment requirements Financial impacts of disasters Acceptable recovery windows Critical technology and resource Threat, vulnerability and asset relationships Plans for managing communications with the external media and employees during a disaster situation This project will be business-driven and will depend on the requirements from a business perspective of a total business recovery consideration. This project will definitely trigger thoughts and considerations for other non-IT facilities related disaster recovery. But this project will mainly focus on how IT can plan and get prepared for disasters that affect IT facilities. Therefore, the scope of this project will not cover: Non-IT facilities related risks and recovery considerations, such as disaster considerations on production facilities. Definition and implementation of the “Manage IT Continuity” process (which is covered in the “I/T Processes” project).Note: This project has specifically excluded any reference to Year 2000 capability including Year 2000 contingency planning and compliance issues. As such the IBM consultant team has not provided any advice nor does it make any recommendations in respect of ensuring Year 2000 compliance for any existing or proposed systems. In all cases where technology solutions are referenced the technology supplier should be contacted to determine Year 2000 compliance status.Business BenefitsIssues being resolvedThis project will have a positive impact on overcoming the following specific issues: No contingency IT plan in place in Huawei to cater for disasters. Maintain availability of key business functions in case of damage caused by disasters to IT facilities. Protect data, application, and infrastructure assets from disasters.Intangible benefitsThis project will provide the following intangible benefits: Minimize the impact of disasters on critical IT facilities on Huaweis business. Have an IT recovery strategy that is business-driven and in line with the business recovery strategy. Have an IT Continuity Plan in place and ready for any unforeseen disaster events. Tangible benefitsThis project will provide the following tangible benefits: Increase % of successful recovery of I/T facilities failure.ApproachThe approach includes the following major steps: Analyze the business impact to Huawei in case of damage caused by disasters to IT facilities Analyze the risk involved Assess Huaweis current IT recovery capabilities Develop a corporate-wide business recovery strategy Plan and implement the IT continuity planThe major activities for each step are as follows:Focus & Invent Phases1. Perform Business Impact Analysis1.01 Identify the critical business processes to Huawei and need to understand the following areas for each process: the relevance, priority and tolerable outage time, depending on the losses due to the process unavailability the vulnerability and analyzing the relationship among threats, safeguards and potential affected assets the needed resources / assets and identifying the chain of resources / assets (human resources, infrastructures, technologies, information, network) used by each process the recovery capability in emergency condition1.02 Estimate the financial impacts of disasters1.03 Estimate the cost for each critical business process depending on outage duration1.04 Identify the tolerable unavailability and loss of data for each process1.05 Identify indirect and consequential loss estimation for each business function, based on the outage duration2. Perform Risk Analysis2.01 Identify qualitative and quantitative risks related to major threats2.02 Rank threats, priorities definition2.03 Identify suggested actions3. Perform Environment Analysis3.01 Review and assess the current readiness for Huawei IT in recovering its operation in the event of disaster: Disaster recovery planning General facilities Computer facilities Off-site storage LAN operations Technical support Applications Telecommunications (data and voice) Systems management4. Develop Business Recovery Strategy4.01 Based on the findings from the Business Impact Analysis, develop the business recovery requirements, including: the critical business processes, the priorities to recover these processes in case of disasters the resources and technologies required to recover these processes the recovery window required4.02 Identify the future required recovery capability4.03 Develop high level plan for recovery capability gap elimination, indicating: costs of possible alternative solutions such as second site, hot site, cold site or outsourcing backup service recommendation on the preferred recovery solution timeframes (short - medium - long terms) recommendations related to changes in organization, processes and operations5. Develop IT Continuity Plan5.01 Define, document and test organization and actions to put in place before, during and after an emergency condition to ensure acceptable company operations continuity5.02 Test and audit critical business procedures5.03 Develop IT Continuity Plan Company Information Section which defines the overall guidelines and company policies in dealing with disasters, and includes details such as: Existing IT Recovery Plan Overview Organization of Plan Manual Scope and Assumptions Company Mission IT Mission Disaster Definition Escalation Alert Scheme Escalation Chart Disaster Declaration Disaster Levels Critical Business Functions Critical Applications Disaster Command Center5.04 Develop IT Continuity Plan Team/Responsibilities Section which define the roles and responsibilities for the persons involved in case of disasters: Management team Disaster Assessment team LAN team Communications staff System Software/Applications staff Operations staff Records Retention personnel Department Interface personnel Administrative staff5.05 Develop IT Continuity Plan Backup Procedures Section which describes the details of backup strategy and procedures, and includes: Backup / Redundancy Strategy Frequency of Backups Backup Requirements on productions systems Network Configurations LAN / WAN Network Software / Hardware Lists Off-Site Storage Information Critical Documentation5.06 Develop IT Continuity Plan Restore Procedures Section which describes the details of restore strategy and procedures, and includes: Recovery Activation Criteria Recovery Priority Recovery Procedures Server Restore Procedures Workstation Restore Procedures Network Recovery Procedures Verification Procedures Recovery Configurations5.07 Develop IT Continuity Plan Disaster Implementation Section which includes: Define the Disaster Assessment guidelines and process Define the Disaster Notification process and ensure effective communication channels with each party involved in a disaster. Develop plan for managing communications with the external media and employees during a disaster situation Define Action Plans for disasters such as loss of building, power interruptions, loss of Servers / Bridges / Routers or Gateways, Communication Failure and Viruses Define ways to restore such as restoring to alternative sites Define the “Return to Normal Operations” notification and process Define the test plan and testing frequency5.08 Provide training in IT Continuity Plan to appropriate users and IT staff5.09 Communicate the IT Continuity Plan to business users and IT staff5.10 Develop on-going Recovery Management guidelines to manage updates and changes to the IT Continuity Plan5.11 Develop on-going plan to manage risks and awareness education to staff for risk avoidanceLaunch Phase6. Implement The Launch Phase6.01 Implement the IT Continuity Plan This includes the acquisition, installation and implementation of backup sites/systems if they do not already exist.6.02 Test and drill the IT Continuity Plan in regular intervals, in consistence with the business recovery strategy6.03 Audit the IT Continuity PlanMajor ConsiderationsThe major considerations will be: IT disaster recovery strategy must be business-driven and it will dictate the IT Continuity Plan. The cost of a recovery solution is determined by how fast the alternatives to damaged/affected IT assets are made available again, which implies that higher cost is required for shorter recovery time. The proper recovery solution should have different recovery timeframe for different business processes, depending on their relevance and relative priorities to the business.Skills and Experience RequiredThe key skills and experience required on Huawei side: Project Manager who has more than 8 years of I/T experience with no less than 4 years of project management experience. The Project Manager should be familiar with Huawei business and some experience with IT operation in general. Business department staff who has in-depth knowledge on day-to-day business operations of a particular function. Business Process Executives (BPE) who understand the business processes and can help to define and prioritize which are the critical business processes. Business Process staff from the BR&CIO office, who can help to understand the existing Huawei processes. IT Systems & Operation staff who understands the daily IT system operations, including daily backup and recovery requirements. IT Facilities staff who is responsible for managing IT facilitates, such as data center, power supply and UPS. IT Application Development staff who understands the dependency of applications.The key skills and experience required on external consultant side: Business Recovery Services(BRS) consultant who has experiences in performing business impact analysis, risk assessment and developing IT Continuity Plan. Business Transformation(BT) senior consultant who can help to identify the critical business processes and associated supporting infrastructure. Also, he/she can contribute in defining how the future business recovery process can support the critical business processes. IT Architect who understands the overall Huawei IT environment, and participates in the overall design of IT Continuity Plan with an IT architectural perspective. The IT Architect should have data and voice networking experience. UNIX IT Specialist who has in-depth knowledge on the backup/recovery features, functions and alternative solutions provided by the UNIX environment. He/she should have experience in database backup/recovery experience also. Oracle IT Specialist who has in-depth knowledge on the backup/recovery features, functions and alternative solutions provided by the Oracle MRP II environment. He/she should have Oracle data base backup/recovery experience also. Notes IT Specialist who has in-depth knowledge on the backup/recovery features, functions and alternative solutions provided by the Lotus Notes environment.Resources RequiredTo complete this project, Huawei should establish: A core team which consists of the following team members: One Project Manager (full time) One Business Process staff (full time) One IT Systems & Operation staff (full time) One IT Facilities staff (full time) On a request basis, BPEs, IT AD staff and business department staff from various departments. External consultant team which consists of the following team members: One BRS Consultant (full time) One BT Senior Consultant (full time) One IT Architect (full time) One UNIX IT Specialist (part time) One Oracle IT Specialist (part time) One Notes IT Specialist (part time)Timing and InterdependenciesThis project should be completed within an elapsed time of 7 months depending on availability of Huawei resources and access to Huawei staff / management and information needs during the course of the project. The duration of the Launch Phase will be determined at the end of the Focus and Invent Phases.10 / 10Project PlanActivityElapsedResponsibilityWeeksDays123456789101112131415161718192021222324252627281. Perform Business Impact Analysis 1021.01 Identify the critical business processes20PM,BE,BD,BP,BR,BT,IA 1.02 Estimate the financial impacts of disasters10PM,BE,BD,BP,BR,BT,IA1.03 Estimate the cost for each critical business process depending on outage duration10PM,BE,BD,BP,BR,BT,IA1.04 Identify the tolerable unavailability and loss of data15PM,BE,BD,BP,BR,BT,IA1.05 Identify indirect and consequential loss estimation10PM,BE,BD,BP,BR,BT,IA2. Perform Risk Analysis2.01 Identify qualitative and quantitative risks5PM,BE,BP, BR, BT, IA2.02 Rank threats, priorities definition5PM,BE,BP, BR, BT, IA2.03 Identify suggested actions10PM,BE,BP, BR, BT, IA3. Perform Environment Analysis 3.01 Review and assess the current readiness for Huawei IT20PM,AD,BP,SO,FA,BR,BT,IA, UN,OR,NO4. Develop Business Recovery Strategy 4.01 Develop the business recovery requirements5PM,BE,BP,SO,FA,BR, BT, IA, UN,OR,NO4.02 Identify the future required recovery capability5PM,BE,BP,SO,