Achieving Continuity of Operations With VERITAS Software

WHIT E PAPER
Achieving Continuity of Operations with VERITAS Software
AN OVERVIEW OF THE COOP

REQUIREMENTS FOR THE FEDERAL
GOVERNMENT AND HOW VERITAS
SERVICES AND TECHNOLOGIES CAN
ASSIST AGENCIES IN COOP PLANS
1
TABLE OF CONTENTS
Continuity of Operations Planning..............................................................................................................................3

Presidential Decision Directive 63..............................................................................................................................3
Federal Preparedness Circular 65 and Presidential Decision Directive 67 ...............................................................3
Office of Management and Budget Circular No. A-130..............................................................................................3
Elements of a Viable COOP.......................................................................................................................................4
Using VERITAS Software to Achieve a Viable COOP ...............................................................................................4
Identifying Mission-Critical Functions within an Agency ........................................................................................5
Determining the appropriate technology based on Recovery Point and Recovery Time Objectives................5
Protecting Vital Records and Database .................................................................................................................6
Ensuring the Operations of Critical Functions at Alternative Facilities ..................................................................7
Cold Site ............................................................................................................................................................7
Hot Site ..............................................................................................................................................................7
Disaster Recovery Plans, Testing And Training ....................................................................................................8
Achieving Continuity of Operations with VERITAS Software.....................................................................................8
S. Atwood 2
Copyright 2002 VERITAS Software Corporation. All rights reserved. VERITAS, VERITAS Software, the VERITAS logo, and all other VERITAS product names and slogans are
trademarks or registered trademarks of VERITAS Software Corporation in the US and/or other countries. Other product names and/or slogans mentioned herein may be trademarks or
registered trademarks of their respective companies. Specifications and product offerings subject to change without notice. June 2002.
CONTINUITY OF OPERATIONS PLANNING
Continuity of Operations (COOP) planning has always been part of the fundamental mission of agencies
throughout the Federal Government. For years, COOP planning had been an individual agency responsibility
primarily in response to emergencies within the confines of the organization. The content and structure of the
COOP plans, operational standards, and interagency coordination, if any, were left to the discretion of the agency.
The changing threat environment post-September 11and recent disasters, including acts of nature, technological
emergencies, military or terrorist related attacks and accidents have shifted awareness to the need for COOP
capabilities that enable agencies to continue their mission-critical functions across a broad spectrum of
emergencies. The objective of the COOP plan includes: ensuring the continuous performance of an agencys
essential functions during an emergency; protecting essential facilities, equipment, records and other assets;
reducing or mitigating disruptions to operations; reducing loss of life, minimizing damage and losses and
achieving a timely and orderly recovery from an emergency and resumption of full service to citizens. Therefore,
a broad COOP strategy was developed in order to ensure that individual departments and agencies are able to
maintain minimum essential functions across a wide range of potential emergencies. There are three key
components that have driven the development of the COOP plan: Presidential Decision Directive 63, Federal
Preparedness Circular 65 and Presidential Decision Directive 67.
PRESIDENTIAL DECISION DIRECTIVE 63

The Presidential Decision Directive (PDD) 63, also known as the Critical Infrastructure Protection Directive, calls
for a national-level effort to assure the security of the increasingly vulnerable and interconnected infrastructures of
the United States. A major component of the directive involves the development and implementation of a plan by
each department and agency of the Federal Government to protect its own critical infrastructure including cyber-
based systems. There are three major asset categories that the PDD 63 covers: telecommunication and
telephony, information technology, and physical infrastructure. All three areas need to be accounted for in order
to ensure the critical infrastructure is protected. VERITAS Software can assist agencies by ensuring their data
and applications within the information technology (IT) environment are protected and available.
FEDERAL PREPAREDNESS CIRCULAR 65 AND PRESIDENTIAL DECISION

DIRECTIVE 67
As organizations began developing their Continuity of Operations Plan (COOP), they realized that coordinating
the different teams that had been formed was essential. The Federal Preparedness Circular (FPC) 65 and the
Presidential Decision Directive (PDD) 67 outlined the key elements in order to develop a viable and executable
contingency plan to achieve continuity of operations (COOP).
The PDD-67 requires that a viable COOP must plan against all hazards that may affect the organization and that
alternate facilities must be ready and available to return to operations within 12 hours after a disaster and that
these operations can be sustained for up to 30 days.
OFFICE OF MANAGEMENT AND BUDGET CIRCULAR NO. A-130

Office of Management and Budget (OMB) Circular A-130 requires continuity of operations planning for every
information system. The planning includes both contingency planning for short-term impacts to operations and
continuity planning for longer-term impacts in order to rapidly and effectively handle potential disruption of
mission-critical functions. To avert these disruptions, or minimize their damage, organizations must take proactive
steps to develop a Continuity of Operations Plan (COOP). The Contingency portion of COOP focuses on minimal,
day-to-day outages such as a localized short-term connectivity loss due to loss of a server, while the Continuity
portion deals with long term or disaster scenarios. The COOP should contain operational recovery issues, ranging
from arrangements for a limited backup capability to relocation to a different facility in the event of a total failure.
The goal is to protect lives, limit damage to property, and minimize the impact on operations, including information
systems processing activities.
S. Atwood 3
Summary of Presidential Directives as they relate to COOP planning:
Presidential Directive Description
Presidential order to strengthen the nations defenses against emerging unconventional threats to the
PDD 63 United States to include those involving terrorist acts, weapons of mass destruction, assaults on our
critical infrastructures and cyber-based attacks.
PDD 67 Presidential order to develop Continuity of Operations Plan for Essential Operations
Provides guidance to Federal Executive Branch departments and agencies for use in developing viable
FPC 65
and executable contingency plans for the Continuity of Operations (COOP)
OMB 130-A Requires continuity of operations planning for every information system
ELEMENTS OF A VIABLE COOP

The key elements to a viable COOP can be summarized in five distinct areas.
1. The COOP must be maintained at a high level of readiness, meaning that thorough planning and
implementation must occur prior to a disaster occurring.
2. The COOP must be capable of implementation both with and without warning. Some disasters may
provide a few hours of warning in order to allow the agency to react while other disasters may not provide
any warning and call for the COOP to be implemented immediately.
3. The COOP must be operational no later then 12 hours after activation.
4. After a disaster has occurred and COOP has been initiated, operations must be able to be sustained for
up to 30 days at the alternate facility.
5. While agencies are developing their COOP plans they should take maximum advantage of existing
agency field infrastructures.
There are many elements associated with delivering a viable COOP within an agency. VERITAS Software can
assist agencies with their COOP by:
1. Identifying mission-critical functions and recommending the appropriate technology to achieve the desired
level of availability based on function
2. Protecting viable records and databases
3. Ensuring the operations of critical functions at alternative facilities
Provide for attaining operational capability within 12 hours
Establish and implement reliable technologies to allow agencies to continue essential functions
and sustain operations for up to 30 days.
4. Provide Disaster Recovery Plans, implementation and testing
Outline a decision process for determining appropriate actions in implementing COOP plans and
procedures
Implement appropriate technology to meet COOP objectives
Test COOP plan
USING VERITAS SOFTWARE TO ACHIEVE A VIABLE COOP

Many government agencies depend on the availability of accurate and timely information to manage a broad
range of government programs because virtually all-critical information is processed by computers. Therefore, an
agencys COOP plan must outline an overall risk management program to respond to unplanned and adverse
situations that may destroy, damage, degrade, or compromise information systems data or computer processing
capabilities so that essential operations may continue. The ability to quickly and easily access critical information
is a major function of continuity of operations planning and VERITAS Software can help in ensuring that these
goals are met. While no vendor can provide all technologies needed to deliver on a complete COOP plan,
VERITAS Software is the leader in the disaster recovery software market and can assist organizations with
S. Atwood 4
providing data and application availability should a disaster occur. The following section will outline areas within a
COOP plan where VERITAS software can assist agencies in achieving the level of availability necessary to
ensure continued operations.
IDENTIFYING MISSION-CRITICAL FUNCTIONS WITHIN AN AGENCY

As part of the planning process of COOP, agencies need to identify the essential functions that enable Federal
agencies to provide vital services, exercise civil authority, maintain the safety and wellbeing of the general
populace, and sustain the industrial/economic base in an emergency. In performing this process, agencies should
identify important functions and then prioritize these functions in terms of mission-critical data and systems
necessary to conduct essential functions. In addition, functions not deemed essential to immediate agency needs
also need to be identified.
The first step to prioritizing data types is to understand the time frame allowable for data loss and recoverability of
data. The key measure of disaster recovery technologies is based on recovery point objectives and recovery time
objectives.
Recovery Point Objective (RPO) Point in time to which applications data must be recovered to resume
transactions.
Recovery Time Objective (RTO) Maximum elapsed time allowed before lack of business function severely
impacts an organization.
Once the data is prioritized, understanding which technologies are necessary for particular data types is much
easier to prioritize. A complete disaster recovery plan is not delivered by any one technology, service or vendor
but rather a combination of products that are implemented in order to provide the needed RPO and RTO of an
application. When analyzing a disaster recovery solution many components must be implemented in order to
guarantee data and application availability. VERITAS Disaster Recovery Services assists agencies in determining
their mission-critical requirements and mapping those needs to the recovery point and recovery time objectives.
Determining the appropriate technology based on Recovery Point and Recovery Time Objectives
The diagram shown above outlines software technologies that map to an organizations RPO and RTO
requirements. The burst in the middle represents a disaster. To the left of the burst is the recovery point
objective , which outlines software technologies that provide data recovery based on the organizations needs.
For example, if a particular application can afford a day or more worth of data loss, then a tape backup approach
using VERITAS NetBackup or Backup Exec is sufficient for backup and recovery of that application. However, if
a day or more worth of data loss will cause substantial impact on the operations of the agency, then replication
technologies, such as VERITAS Volume Manager or VERITAS Volume Replicator must be implemented into the
IT environment, in addition to the backup strategy, in order to protect against substantial data loss. VERITAS
Volume Manager and Volume Replicator go beyond the traditional tape backup approach by creating a duplicate
copy of data, in real time, to an alternate facility so that it can be accessed immediately should a complete site
outage occur.
S. Atwood 5
To the right of burst is the recovery time objective. If an agency can afford to take several days or more to
resume normal activity, then manual tape restore via NetBackup or Backup Exec will satisfy their needs.
Organizations can improve on this RTO by using bare metal restore capabilities. In normal restore scenarios,
administrators must completely rebuild a server in order to begin the tape restore process. This includes
acquiring the hardware, rebuilding the operating system and then loading the backup application onto the server.
VERITAS Bare Metal Restore automates this entire process in order to dramatically reduce the amount of time it
takes to get a server up and running so that the tape restore can begin immediately. Additionally, if an agency is
unable to afford several hours or days of mission critical applications or database downtime, clustering
technologies must be implemented. Clustering technologies may be used to automate the application and
database failover process to substantially reduce downtime. VERITAS Cluster Server provides application and
database availability within a local environment to protect against a server outage by automating the process of
failing over the application or database services to an available server within the cluster. In addition, VERITAS
Global Cluster Manager automates the failover of the IT environment to another location with a single click of a
button by managing the applications and replication associated with disaster recovery plans.
Summary of technologies and VERITAS products to meet Recovery Point Objectives:

RPO Objective Technology VERITAS Product Offering
Daily or weekly backups and weekly offsite
1 week or more VERITAS NetBackup and Vault Option
vaulting
1 day or more Daily backups and daily offsite vaulting VERITAS NetBackup and Vault Option
24 hours 1
Asynchronous Replication VERITAS Volume Replicator
minute
VERITAS Volume Manager or VERITAS
Zero Synchronous Replication
Volume Replicator
Summary of technologies and VERITAS Products to meet Recovery Time Objectives:

RTO Objective Technology VERITAS Product Offering
3 days or more Typical tape restore VERITAS NetBackup
Bare metal restore to rebuild servers
12 24 hours VERITAS Bare Metal Restore
quickly
Only replicate data to secondary site so
VERITAS Volume Manager or VERITAS
4 12 hours that all data lives on disk and is able to
Volume Replicator
restored immediately
10 minutes 4 Automatically bring up services at VERITAS Cluster Server and VERITAS
hours secondary location Global Cluster Manager
*For more detailed information on VERITAS Disaster Recovery Technologies and Services visit
http://www.veritas.com/products/category/ProductFamily.jhtml?baseId=2001
PROTECTING VITAL RECORDS AND DATABASE

The protection and availability of electronic and hardcopy documents, references, records and information
systems needed to support essential functions under any disaster scenario is another critical element of a
successful COOP plan. As outlined in FPC-65, the COOP plan should account for identification and protection of
vital records, systems and data management software and equipment, to include any data necessary to perform
essential functions and activities. In addition, agencies should pre-position and update duplicate records or
backup electronic files to an alternate location on a regular basis.
The best way to ensure that vital records and databases are protected is by combining backup and replication
technologies. VERITAS Backup Exec and NetBackup can be used to perform regular backups to ensure all data
can be recovered should a disaster occur. In addition, these tape backups need to be sent offsite on a regular
basis to ensure they will be accessible should a disaster occur. VERITAS NetBackup Vault can assist
administrators by automating many of the manual processes associated with vaulting tapes offsite to an alternate
facility in order to ensure the vaulting process is occurring on a regular basis and is tracked by the agency.
S. Atwood 6
For vital records and databases that may need to be accessed during a disaster scenario, VERITAS Volume
Manager and Volume Replicator can be used to replicate the data to the disaster recovery site. This provides the
ability to access the data immediately even during a disaster so that the vital records and database are protected.
In order to achieve maximum database availability VERITAS Cluster Server can be used to automate the process
of failing over applications and databases to an available server if there is a failure within an application,
database, server or network environment. This software technology can dramatically reduce downtime associated
with applications, databases and servers.
ENSURING THE OPERATIONS OF CRITICAL FUNCTIONS AT ALTERNATIVE FACILITIES

In addition, all agencies are required designate alternative operating facilities as part of their COOP plans and
prepare their personnel for the possibility of unannounced relocation of essential functions and/or COOP
contingency staffs to these facilities. Facilities may be identified from existing agency local or field infrastructures,
or external sources but should be far enough away so it wont be impacted by the same disaster at the primary
site. For example, if your primary data center is located in New York City and your secondary data center is
located in Jersey City both facilities may be impacted by the same disaster. Therefore, careful site planning but be
followed to ensure that facilities are far enough away from each other so not to be impacted by the same disaster.
Facilities shall be capable of supporting operations in a threat-free environment, as determined by the
geographical location of the facility, a favorable assessment of the local threat, and/or the collective protection
characteristics of the facility. Alternative facilities should provide the immediate capability to perform essential
functions under various threat conditions. In addition, sufficient space and equipment must be available to sustain
the relocation of the organization. Since the need to relocate may occur without warning, or access to normal
operating facilities may be denied, agencies should maintain minimal essential equipment for continued
operations at the alternative operating facilities. These alternate facilities should be prepared to sustain
operations for a period of up to 30 days.
There are many site strategies that an organization can use in order to maintain the continuity of operations. The
main site strategies are cold sites and hot sites.
Cold Site
A cold site is just a building available and ready should a disaster occur. In the event of a disaster situation, the
affected agencies would need to acquire the appropriate hardware, software and communications necessary to
conduct operations. Acquiring the appropriate technologies necessary to return to operations may be cost
effective in the short term, as the agency does not have to maintain a duplicate environment. However, if an
outage occurs it may be very expensive and time consuming to acquire the necessary hardware, software and
communications needed in order to begin operations in a new facility. In addition, there may be data security
concerns, as special precautions must be taken to ensure that all data that has been stored or processed on a
system in a secure environment. A cold site strategy may be used if there are not stringent recovery point and
recovery time objectives on the organizations data and applications.
Hot Site
A hot site, or redundant site, is a building already equipped with the processing capability and other services
needed in order to immediately recover from a complete site outage. The site is normally equipped and
configured similar to the primary site. The hot site can be a site that is already owned by the agency or it can be
outsourced to a third party who maintains hot sites for many organizations. Hot sites allow organizations to have
the least amount of data loss and downtime if a disaster occurs. Typically in hot site environments organizations
are backing up their data at the primary site and using clustering technologies to provide application availability at
the primary location. In addition, organizations are replicating the critical data to the secondary location and using
global clustering technologies to allow for immediate failover of the IT environment to the available hot site.
Determining the appropriate location and type of site requires an understanding of the possible disasters that may
occur in the area and fully understanding the essential functions of the agency so that recovery can occur during
the required recovery point and recovery time objectives. VERITAS software solutions such as backup and
S. Atwood 7
restore technologies can be used in a cold site strategy. For a hot site strategy, replication and clustering can be
implemented in addition to backup and restore. Whatever technology is chosen, VERITAS Software can provide
agencies the ability to sustain essential functions at the alternate location in order to meet the COOP
requirements. VERITAS Disaster Recovery Services can help agencies in planning and locating alternative sites
for disaster recovery and determining the appropriate technologies based on the site strategy.
DISASTER RECOVERY PLANS, TESTING AND TRAINING

Developing a COOP plan, implementing technologies, learning the capabilities of the new technologies and
testing the plan are essential to the viability of the COOP plan within the agency. Implementation and testing of
the COOP capabilities is essential to demonstrating and improving the ability of agencies to execute their COOP
plans during disaster scenarios. Periodic testing also ensures that equipment and procedures are maintained in a
constant state of readiness. Training on the technologies associated with COOP plans familiarizes contingency
staff members with the essential functions of the technologies and highlights processes they may have to follow
during an emergency.
VERITAS Disaster Recovery Services can provide expertise to help organizations define and deliver on disaster
recovery strategies as they relate to COOP plans. The VERITAS Disaster Recovery Services leading Disaster
Recovery certified professionals will work with the IT staff to determine the appropriate strategy to be deployed
within the agency. In addition, VERITAS Disaster Recovery Services can develop plans and testing scenarios to
help agencies understand the operational aspects of their Disaster Recovery strategy. After designing a COOP
plan, VERITAS Disaster Recovery professionals will provide product implementation and test of the solution while
providing the IT department hands-on knowledge transfer. Finally, after the solution has been implemented,
VERITAS Disaster Recovery professionals can perform periodic audits of the COOP plan and provide on-going
solutions management to ensure the VERITAS solution is meeting the COOP requirements.
ACHIEVING CONTINUITY OF OPERATIONS WITH VERITAS SOFTWARE

Achieving Continuity of Operations by ensuring Federal agencies will be up and running even during an outage is
become a critical function within any agency. VERITAS Software, the leading storage software company, can
deliver all levels data and application availability to Federal agencies. As agencies assess, define and implement
COOP plans, VERITAS Disaster Recovery Services can assist in the planning process. VERITAS Software can
provide a complete and integrated disaster recovery solution to meet the RPO and RTO objectives of the agency.
Whether the data and application requires a backup, clustering or replication technology VERITAS can deliver a
solid, integrated solution and allow agencies to recover their IT environment even if a disaster occurs.
S. Atwood 8

Achieving Continuity of Operations With VERITAS Software

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Achieving Continuity of Operations With VERITAS Software

Uploaded by

Copyright:

Available Formats

WHIT E PAPER

Achieving Continuity of Operations with VERITAS Software

AN OVERVIEW OF THE COOP

Continuity of Operations Planning..............................................................................................................................3

PRESIDENTIAL DECISION DIRECTIVE 63

FEDERAL PREPAREDNESS CIRCULAR 65 AND PRESIDENTIAL DECISION

OFFICE OF MANAGEMENT AND BUDGET CIRCULAR NO. A-130

Presidential Directive Description

ELEMENTS OF A VIABLE COOP

USING VERITAS SOFTWARE TO ACHIEVE A VIABLE COOP

IDENTIFYING MISSION-CRITICAL FUNCTIONS WITHIN AN AGENCY

Summary of technologies and VERITAS products to meet Recovery Point Objectives:

Summary of technologies and VERITAS Products to meet Recovery Time Objectives:

PROTECTING VITAL RECORDS AND DATABASE

ENSURING THE OPERATIONS OF CRITICAL FUNCTIONS AT ALTERNATIVE FACILITIES

DISASTER RECOVERY PLANS, TESTING AND TRAINING

ACHIEVING CONTINUITY OF OPERATIONS WITH VERITAS SOFTWARE

You might also like