The Information Technology Infrastructure Library (ITIL) practices for IT service management originated in England in the 1980s and has been adopted by many IT organizations, especially in larger companies, in order to improve and standardize the delivery of IT services to their customers, both internal and external. ISO also offers a standard and framework around the concept â ISO 20000-2, Information technology â Service management. ITIL and ISO 20000 provide a similar comprehensive set of recommended best practices, but ISO 20000 offers additional guidance on management systems concepts related to establishing and maintaining the overall service management process.
Both processes provide specifications for the delivery of whatâs commonly called IT disaster recovery services, referred to as IT Service Continuity Management (ITSCM) in ITIL and Service Continuity and Availability Management in ISO 20000. Both provide high-level guidance on the establishment and maintenance of information technology recovery strategies and plans, noting key elements that include:
Determining recovery requirements, including identifying maximum periods of service outage, minimum levels of service during recovery and the maximum time allowed to return to a full service level
Assessing risks, mitigation opportunities, and costs to assist with prioritization of planning efforts
Developing recovery plans that take into account
Identifying system dependencies
Documenting clear procedures
Establishing responsibilities for invoking and executing the recovery strategy
Making sure plan content is protected and available
Maintaining plan documentation regularly (meaning, coordinating plan maintenance with change and service level management)
Testing the strategies and plans on a regular basis and establishing a method to ensure improvement of the plans based on testing outcomes and lessons learned
Maintaining provider contracts for disaster recovery services
This article discusses potential methods to establish a robust IT service continuity organization that has the tools and process to successfully meet these objectives.
Service Continuity Organization
The key to successful service continuity management is the establishment of a service continuity organization that has the necessary skills, authority, and visibility to ensure strategies and plans stay aligned to business need and viable over time. Key team roles and capabilities include:
Leadership at a level consistent with other members of the service management organization including operations, change management, and IT security to drive the program and maintain visibility to senior management
Technical capability, often an IT architect, capable of translating business requirements and working directly with infrastructure and application resources to design and implement appropriate solutions or to prepare specifications needed to source external recovery contracts. This role also interacts with change and project management groups on an ongoing basis to monitor changes to the IT environment that may have disaster recovery implications.
Planning and planning tool capabilities to assist in development, approval, and maintenance of plans, as well as management of plan repositories or other tools used to ensure that plans are current and available when needed
Testing expertise to develop, execute and document appropriate exercise sessions that challenge the organization, identify gaps and support continual improvement
Change and project management capabilities to ensure communications to all stakeholders.
Performance and management-level summary reporting
These roles or capabilities are often augmented by business continuity skills, especially knowledge of business impact analysis and risk assessment processes to assist with the development of business requirements if the organization does not have a separate business continuity team or process.
Tools and Processes
To enable a service continuity organization and build a lasting (ever-improving) capability, there must be a consistent set of processes to establish expectations (often summarized in a policy statement), provide assistance to the business units and other areas of IT, and ensure ongoing engagement with senior management.
The first step in developing this capability is documenting a service continuity charter that details goals and objectives, resource requirements, and a governance model. This charter provides a clear picture of what the organization will look like and the resources needed for success. The charter, once approved by the program sponsor, typically the CIO, becomes the basis for selecting and engaging a steering committee. The importance of an active steering committee cannot be overstated. It needs to be comprised of senior level representatives from IT applications, infrastructure, and operations groups, as well as decision makers from business areas within the scope of the disaster recovery program. The steering committee will provide guidance and approval on program scope, authorize expenditures to establish and grow capabilities, and assist the service continuity organizationâs engagement with needed resources across the organization. On an ongoing basis, they will also monitor program performance and resolve any issues and competing priorities across the IT organization.
Governance
The steering committee structure described above can only be effective if they are provided with relevant information on a regular basis. During the implementation of a service continuity program, itâs necessary to meet frequently, often monthly (at a minimum quarterly). As the program matures meetings can be less frequent, but experience has shown that if meetings are not held at least on a quarterly basis, programs often lose focus and urgency (remember the old adage, âout of sight, out of mindâ).
The steering committee should be presented with a consistent agenda. A typical meeting should include:
Review of decisions made and action items from the previous meeting
Review of any changes or events that could impact the programâs scope, objectives and design, including organizational changes, new business requirements, regulatory changes, audits, or external events
Review of key program performance metrics, including:
Progress in developing, maintaining, and approving disaster recovery plans
Exercise progress and performance
Corrective action tracking
Review of progress related to ongoing projects
Other topics requiring management assistance or decision.
This level of engagement provides needed visibility to the program and provides a regular opportunity to ask for guidance and assistance, largely mitigating the risk of the program losing momentum.
Solution Development
Developing and maintaining an appropriate disaster recovery capability requires consistent business analysis, clear requirements definition, solutions development and implementation, and regular testing. The service continuity organization needs to document how it will supply these services. A good way to accomplish this is by documenting a framework or a set of standard operating procedures. When approved by the steering committee, service continuity documentation provides the basis for consistent implementation of disaster recovery and sets the expectations for all areas of the organization. If IT service management is fully established as a provider/customer model, the development of a service catalog to describe and offer specific services to the business is also useful. Services typically offered include:
BIA/Requirements Analysis â in an ideal world fully developed business requirements would be presented to the IT organization to serve as the specification for DR strategy development. If that is not the case, the service continuity organization must be prepared to conduct a BIA to determine IT recovery requirements.
Strategy Development â based on approved requirements the service continuity organization develops recovery options and facilitates internal cost estimates or external contract quotes. Depending on the organization structure Service Continuity may also present estimates to the Steering Committee for approval.
Planning Assistance â working with the business and IT support organization to develop IT recovery plans. This also often includes training and facilitating the use of planning tools.
Exercising Assistance â working with the business and IT support organization to plan, execute, and document DR exercises including the capture of corrective actions and opportunities for improvement.
These are typical services. Within individual organizations, unique services will often evolve and be added to the service catalog over time.
Tools
In order to provide the repeatability, oversight, and continuous improvement needed to successfully execute a service continuity strategy, a few simple tools are often required. These tools include:
A secure repository to ensure that process documentation and plans are available when needed. This repository can be a commercial planning tool or as simple as document repository (e.g., a file server or SharePoint document library).
A method to track plan development, updates, and approvals. This process can be enabled by a planning tool or performed using a simple spreadsheet.
A method to capture, assign, and track corrective actions. Corrective actions tracking and management can also be as simple as a spreadsheet, but given the number of people requiring access to provide updates, a central location such as a SharePoint list is preferred if a commercial package is not utilized.
A method to track production equipment, applications, and disaster recovery equipment in scope and identify changes. This is often the most complex issue if the organization does not have active monitoring tools or a configuration management database. Frequent interaction with the configuration management and change management groups is often required to maintain awareness and ensure alignment between the production and recovery environments. In the absence of automated monitoring tools many organizations rely on manual methods such as spreadsheets or SharePoint lists.
Overall, implementing a successful disaster recovery capability within an ITSM environment absolutely requires an active management presence to provide implementation support, oversight and motivation of service providers, and decision making and financial support for disaster recovery initiatives. Establishing clear metrics and a regular channel with senior management (via a steering committee) is crucial. Another key success factor is clearly defining the services that service continuity can offer and staffing the organization with the skills to deliver the services. Finally, building and utilizing tools to track activities and drive continuous improvement is critical to maintaining visibility and commitment from all stakeholders.
Glen Bricker, MBCI, CBCP, is a managing consultant with Avalution Consulting, a leading provider of business continuity and IT disaster recovery consulting and software solutions. Over the past 12 years, Bricker has consulted with organizations of all sizes and in nearly all industries â specializing in operational risk and developing and implementing customized business continuity programs. Bricker is a frequent author and may be reached via email at glen.bricker@avalution.com.
