Agency directives and legislative mandated requirements for IT disaster recovery planning. Disaster issues do not take priority when there have not been any impacts to IT. SAO Performance Review (December 2009) recommending the Legislature support development of a comprehensive disaster recovery plan. SAO recommendation is to have DIS to seek funding for the comprehensive Disaster Recovery Solution for all agencies. Some agencies (i.e., WSDOT) are not on the SGN and have mainframe applications which cannot at this time be recovered at DIS. Increasing events on Earthquakes, flooding and tsunamis which have impacted much of the US. Technical difficulties and complexity of developing and deploying IT Disaster Recovery Solutions. Recommendation: Implement the SAO recommendation of developing a comprehensive state-wide disaster recovery plan for all agencies built upon shared services and facilitated by DIS. SWOT Analysis Strengths Opportunities disaster recovery costs less than having each agency planning individual disaster recovery. Reduced budget funding requirements by the legislature on state agencies. Disaster recovery exercises can be done at one place and certified that the DR solution will work for all agencies on the shared service. State agencies will need to go through the existing services and determine which outdated technology can be eliminated. State agencies which will need to adapt some applications to a generic
Balanced Scorecard Improved Resilience and Recovery of Systems that Support Statewide Essential Functions Objective Measurement Target Initiative Owner Supplier Financial Lower Cost and More Effective Investments for Resilience and Recovery Capability Investments in Resilience and Recovery are mandatory for all new systems and upgrades Statewide effort funded by 419 like process Measure and report investments to develop, maintain, and operate essential systems resilience and recovery Number of essential systems identified Revised ISB investment Policy, Standards, and Guidelines are amended to require Resilience and Recovery capability in all IT investments Strategic approach to IT investments for resilience and recovery is adopted Investments aligned to Statewide Essential Functions Cost data is available for systems that breaks out the cost for resilience and recovery IPMA LeaderPath Capstone Project Results stimulate a discussion within the IT community CAB Initiatives to establish a strategic approach to IT resilience and recovery ISB Initiatives to update current investment and DR policy, standards, and guidelines Provide a budget for developing statewide plans to improve the resilience and recovery of systems that support statewide essential functions The Governor and Legislature Agency Executives Agency CIO’s State Agencies Information Technology Providers Customer Essential Services to Citizens are Uninterrupted After: Regional Disaster No reported outages of essential systems that support essential Essential systems that support Essential Functions are identified at the enterprise Leverage EMD efforts that are underway to identify essential functions Assign responsibility for The Governor and Legislature Assign for Agencies that provide statewide essential systems All State Agencies Information Technology Suppliers
Loss of State Data Center(s) in Olympia Loss of Agency Data Center Component Failure services to Citizens Decrease recovery time for essential systems Established metrics for expressing the state of resilience and recovery and for tracking improvements to it. developing the strategy for Resilience and Recoverability in the office of the State CIO developing the strategy for Resilience and in the office of the State CIO Internal Establish an Effective Statewide Planning Process focused on the Resilience and Recovery of statewide essential systems Adopt Improved Policy, Standards, and Guidelines for Resilience (e.g. Disaster Recovery) planning and testing - Consider WACIRC as a model Executive Leaders (COOP Planners Group Maybe) Establish Clear Priorities for Statewide Essential Systems Agencies cooperate to develop Inventory of Essential Systems Positive trend in the number of systems that can tolerate equipment failure at primary data center Positive trend in the number of systems that can continue operations after loss of Agency or State datacenter Positive trend in “Resilience Indicator” data Systems that Support Essential Functions are Tested Annually Washington Statewide Essential Systems Resilience Board (WASESRB) is chartered by the Governor and ISB An effective planning process exists People are assigned to the task of developing an Enterprise DR Plan team develops essential system plans Improved ISB Policy, Standard, and Guidelines for Resilience and Recovery Governance – Charter an effort similar to WACIRC Letter from the Governor to ISB and EMD ISB and DIS Directs DIS to update existing policies and processes. Revised policy directs agencies Planning - Identifying and understanding critical operations and functions, Planning - Anticipating impacts of events, Testing - Preparing for and adapting to manage a crisis or disruption as it unfolds, Investing Wisely - Creating capacity to rapidly return to and/or reconstitute a more resilient “normal” operation, The Governor State Agencies State Agency Internal IT Workforce Agency System and Service Providers (DIS, OFM, OST, Etc.) Information Technology Providers hazard
Resilience and Recovery for Essential Systems Planning - Tolerating loss of some capacity for the duration of the response effort to a disruption, and Planning - Partnering through communications, coordination and collaboration Learning Define “Resilience” Train and certify statewide planning group Train system engineers, developers, and IT management how to design and build cost effective resilient and recoverable systems Number of planners trained Number of system designers and engineers trained Clear definition added to ISB policy and standards Resilience is a capacity to absorb or mitigate the impact of events while maintaining and restoring critical services. TBD State Agencies TBD
Agency Critical / Essential Function Year DIS Public information - COMM 2007 DIS Platform monitoring - CSD 2007 DIS State information operators - TSD 2007 DIS SCAN - TSD 2007 DIS Conference calling - TSD 2007 DIS KVM - CSD 2007 DNR Emergency Response Management - Resource Protection 2008 DNR Materials Management and Transportation - Engineering 2008 DNR Communication site recovery (e.g. tower) - Asset & Property Management 2008 DNR Payroll Records - HR, Financial Mgmt 2008 DNR Accounts Payable - Financial Management 2008 DNR Risk management (Insurance Claims) - Financial Management 2008 DNR Records Office damage assessment & recovery - Engineering 2008 DNR Public Disclosures & Records - Executive Management 2008 DNR Geoduck Compliance - Aquatic Resources 2008 DOC Increase recruitment and retention of diverse, qualified, competent and valued staff 2007 DOC Maintain safe work environments for staff 2007 DOC Develop improved business practices and tools that are responsive, effective and efficient 2007 DOC Maintain offender safety during incarceration and supervision 2007