Business Continuity Management

BCM tools in operation: Tool based Business Continuity and Disaster Recovery Planning
London, 1.Feb.2007

Schenker AG Alexander Tsolkas CSO February 2007

Agenda

Agenda Intro Overview of the market leaders Tool ranking Tool list prices Example of a tool based IT DRP Advantages and disadvantages of a tool based IT DRP Discussion
2

Schenker AG; Alexander Tsolkas; Feb.2007, London

Intro

65,5% of the organisations did not update their business continuity plan for the last 10 years 26,32 % did update their BCP 1 to 3 times in the last 10 years Less than half fullfil an appropriate quantity of their BCP targets 54% of the CIOs plan to change their BCP strategy 65% expect a raise in costs for IT BCP
Quelle: Gartner Research a KPMG study 2002

Schenker AG; Alexander Tsolkas; Feb.2007, London

Overview of the market leaders

Vendors Strohl Systems Binomial International Coop-Systems eBRP Solutions Inc. BRProactive Inc. Business Protection Systems EverGreen Grapevine Software MIR3 Sunguard TAMP Systems CAPT

Schenker AG; Alexander Tsolkas; Feb.2007, London

Strohl Systems

LDRPS 10
License does not expire Web hosting options Runs on SQL Server Small solution for 5 to 30 users Professional solution for 5 to 50 users Built-in methodology and guidance based on a long experience User prompts to enter data Modules: BCP, Corporate Crisis Management, Business Process Recovery Application Recovery, Site Event Management Drag and drop functionality Transparent tree structure User and group administration >200 predefined standard reports which describe plans Customizable plan navigation which guides the user through the plan specifically Secure data management via encryption Backup via standby servers Tool uses a basic Windows format Tree navigation function Strong consideration of business processes

Schenker AG; Alexander Tsolkas; Feb.2007, London

Strohl Systems

Incident Manager 3.0

Powered by ESIs WebEOC web based Strong influence during development through experience with LDRPS Scope: -Life Safety -Impact Assessment -Recovery and Restoration Pinboards offer the possiblity to digitise and electronically organise information and problems collected in an analog way Transparent tree structure Incident management on the basis of : - Coordination via control over the situation with tracking possibility - Communication Chat client, eMail and Incident Escalation Management - Methodology Best Practices via ICS (Incident Command System) - Scalable runs on a Laptop as well as in an IPC Status reports of the crisis situation Evaluation of the situation and priorisation of procedures Enhanced function for monitoring groups, processes and situations IM 3.0 offers status displays, markers and pinboards MapTac integrated

Schenker AG; Alexander Tsolkas; Feb.2007, London

Binomial International

Phoenix
For the development of BCPs on the basis of Windows Free selection which database to be used Quick and easy creation of the single components of the BCP Easy input of information and good information management Easy updates of the plan Multi user system Cooperation of different business departments and units possible Phoenix modules -Phoenix Corporte Edition -Phoenix for Banks -Phoenix for Credit Unions -Phoenix for Biotechnology -Phoenix for Community Hospitals -Phoenix for Hospitals -Phoenix for ISPs -Phoenix Small Business Edition

Schenker AG; Alexander Tsolkas; Feb.2007, London

Coop Systems

myCoop 5.3
Supports 7 phases in a web based system Easy to use Low costs Content can be imported Easy to learn Object class technology Can be customized during the complete life cycle of the system -Languages -Regions -Currencies -Integration into other systems Modules -Start, Analysis, Creation, Training, Exercise, Maintenance, Execution, Security -Regional parameter settings, Integration, Hosting

Schenker AG; Alexander Tsolkas; Feb.2007, London

eBRP Solutions

eBRP Toolkit
Offered modules are: -Risk assessment o Physical, personal related, business processes, technological systems -Business impact analysis o Critical resources, recovery time, customers vendors, finance, dependencies -Technology modelling o Hardware inventory, software inventory, network, applications, users -Plan development & maintenance o Unlimited amount of plans, built-in web links, built in data links, check list development, plan linkage, print feature of plans in parts or completely, eMail notification -Features o Web based, unlimited amount of users, role based, access controls, traceability, import of data sheets, Web services, >100 built-in standard reports

Schenker AG; Alexander Tsolkas; Feb.2007, London

BRProactive Inc.

BRProactive
Tour guide for users Uses Microsoft Word for planning and editing Very good help functions No database know how necessary Integrated full recovery: Main business area, Voice, IP, LAN, Mid-range systems 8 predefined recovery team plans, which can be added initially with information Resource planning and notification sequence integrated Industry standards are provided consequently and have been considered during development Action based approach Password security Import and export function for files Predfined forms which can be used

Schenker AG; Alexander Tsolkas; Feb.2007, London

10

Business Protection Systems

Business Protector Gateway

Web based with browser interface Specifically for risk management and BCP Scalable Outsourced service or own operation Fast reaching of the targets High quantity of plans and reports in documents (on-line formats and *.pdf) Decentral planning with central control Automatic notification options On-line reports, notification trees, emergency procedures Relational database Simple document management Connection to external links, documents and databases

Schenker AG; Alexander Tsolkas; Feb.2007, London

11

Evergreen Data Continuity Inc.

Mitigator
Overall business continuity management Complete company inventory Business impact analysis IT Risk Assessment Application recovery points based on lost data Recovery analysis based on business requirements versus IT capabilities Impact analysis based on a malfunction, application failure or general failure Recovery strategies including cost calculation based in inventory data Overall business and operative continuity and disaster recovery plans for all company locations Creation of recovery teams and task assignment to team members Test and maintenance of the BCP or DRP Assists for SOX 404 compliance Financial and operative risks can be drawn from operative failures Tons of reports After installation Mitigator provides loaded potential risks, recovery team tasks and 1000 best practice proposals

Schenker AG; Alexander Tsolkas; Feb.2007, London

12

Grapevine

Full Command
Transform existing plans in living documents The process of finding, insertion, registration, evaluation, approval und supporting of personnel, of resources and documentation is simplified. Distribution and standardisation of the content of plans over many organisations Plans can be edited directly by the means of a browser Maitenance of accurate plan data Testing of plans Analysis of vulnerabilities and risks Reporting Secure authentication and accesses

Schenker AG; Alexander Tsolkas; Feb.2007, London

13

MIR3

Enterprise
Company wide communication for the major Business, Disaster Recovery, Business Continuity Role based access control Intelligent messaging system Works with Oracle DBs, Peoplesoft applications, MS-Active Directory, SunGard, Paragon/ePlanner/Revolution, Strohls LDRPS and LDAP Implementations Support for MS-Outlook for Telefone, GSM, Email, Pagers, SMS, Fax and Satellite telefone systems Maintenance of Remote- and international business locations, IPCs and WANs

Schenker AG; Alexander Tsolkas; Feb.2007, London

14

Sungard

Business Continuity Solutions

Business and Technology Profile Solution Business Impact Analysis Solution End-User Recovery Solution Information Availability Assessment Solution Managed Tape Backup Solution System Recovery Solution Vaulting and Business Continuity Solution Paragon -BCP development -What if scenario development (simulation) -Messaging, Eskalation -Maintainance of plans -Database oriented

Schenker AG; Alexander Tsolkas; Feb.2007, London

15

TAMP Systems

Disaster Recovery System DRS

Scalable Customizable reporting Decentral planning possibilities Role based access control Automatic plan updates (via external interfaces) Pratical approach for application functionality to maintain plans without complications Simple user guidance

Schenker AG; Alexander Tsolkas; Feb.2007, London

16

Heine & Partner Info AG

Continuity Action Planning Tool

MS-Access based Registration and maintenance of resources -Organisational units, persons emergency teams, business functions, technology, software, data inventory, connections, other aids, dangerous goods Development of action plans - Emergency scenarios and recovery strategies, activities and action plans (graphical user interface) Output document manager -Print lists ( report generator for multiple formats) -Free textpages -Emegency handbooks and table of content Administration -Logging of user activities -User access control and authentication Special functions -Layout of the print output -Customization of data and field names -Data import and export
Schenker AG; Alexander Tsolkas; Feb.2007, London 17

Tool ranking

Vendors (personal ranking list)

1 eBRP Solutions Inc. eBRP Toolkit 2 Strohl Systems, LDRPS 3 Sunguard Business Continuity Solutions 4 MIR3 Enterprise 5 EverGreen Mitigator 6 Heine & Partner Continuity Action Planning Tool 7 Grapevine Software Full Command 8 Coop-Systems myCoop 9 Strohl Systems , Incident Manager 10 BRProactive Inc. BRProcative 11 Business Protection Systems - Business Protector Gateway 12 Binomial International Phoenix 13 TAMP Systems Disaster Recovery System

Schenker AG; Alexander Tsolkas; Feb.2007, London

18

Tool list prices

Hersteller
Strohl Systems, LDRPS 115.000 , Incident Manager 3.0 38.000 . Binomial International Phoenix ca. 80.000 Coop-Systems myCoop ca. 7000 Euro eBRP Solutions Inc. eBRP Toolkit ca. 350.000 BRProactive Inc. BRProcative 26.000 Business Protection Systems - Business Protector Gateway 150.000 EverGreen Mitigator 120.000 Grapevine Software Full Command 27.000 MIR3 Enterprise from ca. 140.000 Sunguard Business Continuity Solutions varies from module to module TAMP Systems Disaster Recovery System - no price provided Heine & Partner Continuity Action Planning Tool 10.000 SU, 80k Enterprise

Schenker AG; Alexander Tsolkas; Feb.2007, London

19

Example of a tool based IT DRP

Heine & Partner CAPT Continuity Action Planning Tool

Schenker AG; Alexander Tsolkas; Feb.2007, London

20

Advantages and disadvantages of a tool based IT DRP

Pros
Standardized and customized format of all plans Simple maintenance and update of plans (via integrity of the software) Cental policy of the tool and decentral maintenance Web based access from all over Access to plans is simple and availability is higher Customizable layout of lists/reports and plans Printout of plans in parts which are required Partly plans for dedicated groups can be printed out

Cons
Expensive first time investment Costs for training Requirement of a handbook Interfaces most often do not provide what is wished in terms of applications and data General limitations due to the fact that is is a tool Additional costs for administration, hosting and maintenance, backup, etc.
Schenker AG; Alexander Tsolkas; Feb.2007, London 21

Discussion

Questions
Alexander Tsolkas CSO Schenker AG Alexander.Tsolkas@schenker.com www.schenker.com

Opinions
Schenker AG; Alexander Tsolkas; Feb.2007, London 22