Fill in the table below to capture this information. Note that the columns with grey backgrounds contain information that was captured in the previous step. Time Sensitivity Dep’t Service Supporting IT Services or Applications Safety/ Human Life Financial Operations Reputation Regulatory/ Legal/ Contractual Finances Payroll SRB Financial Services Minor Major Major Moderate Major 24 hours 24 hours Step 2.3: Assess Risks Document the known risks that could cause disruptions to IT services, applications and processes. For example, a server room that does not have a backup source of power will mean that services will not be available during a power outage. Specify the implications if the risk occurs and whether or not a strategy needs to be developed to address the risk. Fill in the table below to capture this information. Note that the columns with grey backgrounds contain information that was captured in previous steps. Department Process or Service Supporting IT Services or Applications Implications Need Strategy to Address? Finances Payroll SRB Financial Services No backup power supply Finance information will not be available if there is a power outage Yes, make plans to install a backup generator Step 2.4: Classify and Prioritize The next steps is to classify and prioritize IT Services based on need and criticality. Fill in the table below to capture this information. Include core IT services that other IT services or applications depend on in order to function under the “Dependencies” section of the table. For example, the financial services application in the first line below depends on Network Infrastructure and SuperNet in order to function.
Service Context [Document the service context such as: Who uses the service. Criticality periods (i.e., periods during which the service is critical such as for payroll processing or year-end processes, etc.). Contact information for vendors and other personnel such as database administrators and application owners.] Service Classification [Specify the classification of this service (critical, vital, necessary or desired) as determined in step 2.4 – Classify and Prioritize of the IT Disaster Recovery Planning Guide.] Recovery Strategy and Location [Specify the overall strategy for recovering this service as well as where the service will be recovered.] Assumptions [Specify any assumptions required to follow the recovery procedure, such as the ability to restore from backups, etc.] Recovery Time Objective (RTO) and Recovery Point Objective (RPO) [Specify the recovery time objective and recovery point objective for this service as determined in step 2.2 – Assess Impact of Service Outages of the IT Disaster Recovery Planning Guide.] Recovery Platform [Specify the technology platform required to restore this service. For example, virtualized Windows servers configured similar to the current production environment.] Recovery Procedure [Consider providing an overview of the major steps of recovery before providing detailed recovery procedures. Select the minimum level of documentation possible that reduces risk to an acceptable level as more detailed documentation requires more time to create and maintain. See page 28-29 of the IT Disaster Recovery Planning Guide for more information.] Test Procedure [Specify how the service can be tested to ensure that it’s working correctly.] Resume Procedure [Specify how to resume the service after the event has been addressed.] D – [Instructions: This appendix contains sample content for a Voice Communications Service Recovery Plan.] Responsibility John Smith, IT Manager, Communications