DISASTER RECOVERY PLANS

MODULE 8
usually RPO is defined in minutes,
Disaster recovery planning, in support of business sometimes hours/days, basta time.
operations/provisioning IT service, is an element of ○ Gaano kabilis gusto mo makarecover ng
an internal control system established to manage data mo.
availability and restore critical processes/IT ○ Acceptable data loss
services in the event of interruption. ○ Ex. nagkaroon ng malware, tapos ang
- Sabihin natin na may disruption, the event gusto mo is 4 hours before the
happened and somehow we are really affected disaster/disruption kayang mawala.
- Dito papasok yung importance ng DRP ○ Yung 4 hours na period na yun dapat may
- End goal: manage availability available backup within 4 hours.
- Pagkakaroon ng available resources in the
event of disruptions ● It is almost impossible to recover the data
- Managing availability decreases the impact of completely. Even after entering incremental
interruption data, some data are still lost and are referred
- Why? Having backups is increasing availability to as orphan data. The RPO directly affects
so that in the event of disruption, mapapababa the technology used to back up and recover
ang impact ng disruption data.
- DRP is a continuous planning process. YES. ○ Binalik yung limit/capacity sa Google
Why? Pare-pareho ba ang possible disasters na Drive.
mangyayari? No ○ Kahit you perform incremental backups,
- Need natin mag-adapt ng DRP you still lose data
- DRP does not end, needs to be monitored kasi ○ Orphan data - yung di mo na marecover
may iba't ibang klase ng disruption na data
- Most of the business is not ready to adapt right ○ Kung gaano katagal yung RPO may
away during the pandemic, it’s something new dictate what medium yiou will use for
- DRP is very essential when you want to recover backup
your critical operations, capacity in the event
of disruption ● The Recovery Time Objective (RTO) is
determined based on the acceptable
The ultimate goal of the disaster recovery planning downtime in case of a disruption of
process is to respond to incidents that may impact operations. It indicates the earliest point in
people and the ability of operations to deliver time at which the business operations (and
goods and services to the marketplace and to supporting IT systems) must resume after
comply with regulatory requirements. disaster.
- Pandemic: one of the major restrictions for ○ Gaano katagal yung acceptable mong
restaurants: social distancing, dine in downtime
- Measures: one seat apart, plastic barrier, no ○ Tolerance for disruption
dine in delivery only, ○ Think of it as your tolerance, gaano mo
- Delivery: contactless payments katagal kaya tolerate ang disturbance
- One good practice of DRP, they recovered right ○ WHAT DOES RTO TELL YOU? Acceptable
away, they were able to somehow modify how data lost
they deliver their goods and services
- Philhealth ransomware attack: cannot afford to
stop operations, they did their processes
manually

RPO AND RTO

● The Recovery Point Objective (RPO) is
- RPO technologies: nonremovable media
determined based on the acceptable data loss
- Pag mas malapit yung RPO sa disruption, the
in case of disruption of operations. It
costlier it is.
indicates the earliest point in time in which it
- Mirroring and real time replication - needs
is acceptable to recover the data.
more storage (costlier)
○ May disruption—ransomware. Gaano mo
kagusto na makapagrecover agad-agad,

MARIA BERNISE DIMZON • ELEINA BEA BERNARDO 1

 Module 8: Disaster Recovery Plans

- RTO technologies: the nearer both the RTO and ○ Also talks about the tolerance for
the RPO to the point of disruption, the costlier disruption
it would be
- 0-1 hour: hot site best way SERVICE DELIVERY OBJECTIVE (SDO)
● Level of services to be reached during the
● Both of these concepts are based on time
alternate process mode until the normal
parameters. The nearer the time
situation is restored. This is directly related to
requirements are to the center (0-1 hours),
the business needs.
the higher the cost of the recovery
○ Philhealth: when the ransomware
strategies. If the RPO is in minutes (lowest
happened, most of their processing turned
possible acceptable data loss), then data
from automated to manual processing.
mirroring or real-time replication should be
○ Pero di naman lahat kaya gawin manually.
implemented as the recovery strategy. If the
○ You have to determine kung ano lang kaya
RTO is in minutes (lowest acceptable time
mong gawin manually.
down), then a hot site, dedicated spare
○ Ex. Processing of cheques, kunwari may
servers (and other equipment) and clustering
mga claims sa Philhealth, during that time
must be used.
they were not able to process cheques and
disbursements because they were
● Disaster tolerance is the time gap within
attacked by ransomware.
which the business can accept the
○ Di lahat ng services nila nagresume kahit
unavailability of IT critical service; therefore,
may manual processing na.
the lower the RTO, the lower the disaster
○ Determine mo lang kung alin sa mga
tolerance.
services ang kaya mong continue amidst
○ Why? Critical yung process so mas mabilis
disruptions.
mong gusto makabalik agad sa
operations.
Philhealth
○ Critical - very very low yung disaster
Application
tolerance
Monthly Dues by Members
● RTO affects the technology used to make Disbursements
applications/IT systems available— what to Claims
use for recovery (e.g., warm site, hot site,
clusters). RPO usually affects data protection - SDO: alin ba dito ang pwedeng emmanuel pa
solutions (backup and recovery, synchronous rin for the meantime hanggang makabalik sa
or asynchronous data replication). dating operation
○ RPO - acceptable data loss - Identify mo sa mga process mo ang kaya
○ RTO - acceptable downtime for disruption mong ituloy amidst disruptions

● In addition to RTO and RPO, there are some MAXIMUM TOLERABLE OUTAGES (MTOs)
additional parameters that are important in ● Maximum time the organization can support
defining the recovery strategies. These processing in alternate mode. After this point,
include: different problems may arise, especially if the
○ Interruption window alternate SDO is lower than the usual SDO,
○ Service delivery objective and the information pending to be updated
○ Maximum tolerable outages can become unmanageable.
○ Gaano katagal kang pwede mag operate
INTERRUPTION WINDOW in the alternate mode
● The maximum period of time the organization ○ Gaano katagal mo kaya mag process sa
can wait from the point of failure to the Plan B, pag may disruption
critical services/applications restoration. ○ Ex. Philhealth, gaano katagal magprocess
After this time, the progressive losses caused manually
by the interruption are unaffordable.
○ Gaano katagal magkakaroon ng RECOVERY STRATEGIES
interruption or point of failure sa critical
services/application restoration. ● A recovery strategy identifies the best way to
recover a system (one or many) in case of

MARIA BERNISE DIMZON • ELEINA BEA BERNARDO 2

 Module 8: Disaster Recovery Plans

interruption, including disaster, and provides ○ Meron lang nakaready

guidance based on which detailed recovery ○ Gagamitin lang pag meron ng disruption
procedures can be developed. ○ Ex. bangko
○ You can employ many strategies ○ Moral support sa operations, nandoon siya
pero di pa kailangan
● Different strategies should be developed, and
all alternatives should be presented to senior MOBILE SITES
management. Senior management should
● Mobile sites are packaged, modular
select the most appropriate strategies from
processing facilities mounted on
the alternatives provided and accept the
transportable vehicles and kept ready to be
inherent residual risk.
delivered and set up at a location that may be
○ Kasama dito ang pagevaluate ng many
specified upon activation. A plan to utilize
recovery strategies
mobile processing must specify the site
○ The IT department would be suggesting
locations that may be used. The plan must
to the management the best options
provide right-of-access to the selected site by
○ Inherent residual risk - kahit may
the vendor and the company. The plan must
recovery strategies, may other risk pa rin
also provide for any required ancillary
na pwedeng mag exist
infrastructure necessary to support the site
○ Hindi pwede maging zero ang risk
such as access roads, water, waste disposal,
power and communications.
● Recovery strategies based on the risk level
○ Pwede siyang dalhin kahit saan kaya siya
identified for recovery include developing:
mobile
○ Hot sites
○ It’s mobile because its’ movable
○ Warm sites
○ Trailer trucks - pwedeng i-detach anytime
○ Cold sites
○ Nakaready sila, nasa sasakyan sila para in
○ Duplicate information processing
the event of the disruption pupunta sa
facilities
offsite na napili and activating mobile site
○ Mobile sites
○ Pag nagkaroon ng disruption, alis agad
○ Reciprocal arrangements with other
ang mobile site doon sa offsite location
organizations
○ Baka nga meron kang mobile site pero di
● When the normal production facilities become
naman accessible by land yung iyong
unavailable, the business may use alternate
chosen offsite location
facilities to sustain critical processing until the
○ Kailangan tumawid ng ilog, or off-road
primary facilities can be restored.
yung daan
○ If you choose mobile site, you should also
COLD SITES consider access roads, etc.
● Cold sites are facilities with the space and ○ Baka yung nabili mo dead spot pala
basic infrastructure adequate to support
resumption of operations, but lacking any IT WARM SITES
or communications equipment, programs,
● Warm sites are complete infrastructures but
data or office support. A plan that specifies
are partially configured in terms of IT, usually
that a cold site will be utilized must also
with network connections and essential
include provision to acquire and install the
peripheral equipment such as disk drives,
requisite hardware, software and office
tape drives and controllers. The equipment
equipment to support the critical applications
may be less capable than the normal
when the plan is activated. To use a sports
production equipment yet still be adequate to
analogy, a cold site is like having a substitute
sustain critical applications on an interim
on the bench, ready to be called into the
basis. Typically, employees would be
game.
transferred to the warm site, and current
○ Literal na malamig kasi wala pang
versions of programs and data would need to
masyadong gamit sa loob ng offsite
be loaded before operations could resume at
○ Meron daw siyang space, may allotted ka
the warm site. Using the sports analogy, a
na na offsite facility pero wala siyang IT
warm site is a substitute warming up, getting
equipment
ready to enter the game.
○ Kumabag nandoon na ang space pero
○ Yung bangko nagreready pa lang pumasok
wala ka pang nilalagay sa space

MARIA BERNISE DIMZON • ELEINA BEA BERNARDO 3

 Module 8: Disaster Recovery Plans

○ May provisions for network connections ○ Mas marami kang minemaintain dito
○ Magagamit lang siya pag may lumipat na
doon sa site RECIPROCAL AGREEMENTS
○ Ready na siya magamit and meron ng
● Reciprocal agreements are agreements
minimal configurations and setup
between separate, but similar, companies to
temporarily share their IT facilities in the
HOT SITES event that one company loses processing
● Hot sites are facilities with space and basic capability. Reciprocal agreements are not
infrastructure and all of the IT and considered a viable option due to the
communications equipment required to constraining burden of maintaining hardware
support the critical applications, along with and software compatibility between the
office furniture and equipment for use by the companies, the complications of maintaining
staff. Hot sites usually maintain installed security and privacy compliance during
versions of the programs required to support shared operations, and the difficulty of
critical applications. Data may also be enforcing the agreements should a
duplicated to the hot site in real or near disagreement arise at the time the plan is
real-time. If this is not the case the most activated.
recent backup copies of data may need to be ○ Reciprocal - both sides, agreement, give
loaded before critical applications could be and take
resumed. Although hot sites may have a small ○ Meron kang 1 company, separate
staff assigned, employees are usually companies kayo but very similar in nature
transferred to the hot site from the primary ○ May usapan kayo, pag nag down yung isa
site to support operations upon activation. kong process pwede pasalo saglit
Using the sports analogy, a hot site is a ○ Para pag ikaw nagdown ang isa mong
substitute on the sideline waiting to enter the process, ako naman ang sasalo
game. ○ Marami raw mga setbacks dito
○ RTO - near the disruption (0-1 hour) ○ What is you are using a different
○ Main difference: Hot site kumpleto na ang hardware, issue with compatibility
laman ○ Issue with data security and privacy,
○ May office furniture na and equipment paano kapag pinoprocess mo confidential
○ Ready na yung site na yun anytime to use information tapos ipapasa mo sa kanila
○ With all the communications and network kapag nagka disruption
necessary, both hardware and software ○ Hindi siya ganon ka-viable
○ Real and near real time mirroring ○ Similar yung companies niyo
○ May orig facility, orig facility - real time
na-babackup RECIPROCAL AGREEMENTS WITH OTHER
○ Mas mataas yung maintenance, mas ORGANIZATIONS
mataas yung cost
● Reciprocal agreements with other
○ Complete ka sa facilities, kaya mas
organizations, although a less frequently
magastos
used method, are agreements between two or
○ Pero mas mabilis naman ang recovery
more organizations with unique equipment or
○ Si bangko papasok na literal, hinihintay na
applications. Under the typical agreement,
lang yung dead ball, init na init na siya
participants promise to provide assistance to
maglaro
each other when an emergency arises.
○ Mas lalong di viable kasi di na nga same
MIRRORED SITES software/hardware di pa same industry
● Mirrored sites are fully redundant sites with ○ Unique na nga equipment and application
real-time data replication from the production magsasaluhan pa kayo
site. They are fully equipped and staffed, and ○ Not commonly used
can assume critical processing with no ○ Babalik sa issue with compatibility, data
interruption perceived by the users. security and privacy
○ Not really advisable as though you are
maintaining 2 sites with the same purpose ALTERNATE PROCESSING FACILITY
○ Kung anong meron sa isa, dapat meron
● The alternate processing facility can be
din sa isa
provided by a third-party vendor or by the

MARIA BERNISE DIMZON • ELEINA BEA BERNARDO 4

 Module 8: Disaster Recovery Plans

company using its own resources. When the ● Criteria for plan activation (i.e., in which
facility is provided by a third party, the circumstances the disaster is declared, when
company needs to have clearly stated the IT DRP is put to action, which scenarios
contracts that ensure that the company will are covered by the plan [loss of the IT system,
get access to the resources it needs without loss of the processing site, loss of the office])
delay following a disaster. ○ May untoward event. Kailan magiging
○ Mobile sites - third party, complete setup applicable yung DRP
○ Pwede rin through your own resources, ● Linkage with the overarching plans (for
using your own money instance, emergency response plan or crisis
○ SLAs management plan or BCPs for different lines
○ Third party dapat walang delay of business)
○ Your plans must go along
○ Hindi contradicting dapat ang contents ng
DEVELOPMENT OF DRP
bawat isa
As part of a greater business continuity planning ● The person (or people) responsible for each
process, IT disaster recovery planning follows the function in plan execution
same path. After conducting a BIA and risk ○ Yung listahan ng members ng bawat team
assessment (or determining the risk and should be placed on DRP
effectiveness of mitigation controls otherwise), the ○ Not only the names but also the functions
IT disaster recovery strategy is developed. ○ Parang nag-apply ka lang ng job (job
- BCP, DRP, and BIA should go hand in hand description)
- You will base your DRP on the BIA and risk ● Recovery teams and their responsibilities
assessment ● Contact and notification lists (contact
- For counter check: BIA information for recovery teams, recovery
managers, stakeholders, etc.)
IT DRP ○ Included pala contact information dun sa
● An IT DRP is a well-structured collection of list.
processes and procedures intended to make ● The step-by-step explanation of the whole
the disaster response and recovery effort recovery process (i.e., where and when the
swift, efficient and effective to achieve the recovery should take place [the same site or
synergy between recovery teams. The plan backup site], what has to be recovered [IT
should be documented and written in simple systems, networks, etc.], the order of
language that is understandable to all. recovery)
○ Swift because we cannot afford downtime ○ Kung ano yung napili mong alternative
in our critical systems. dapat may narrative or step by step
○ DRP teams - dapat identified yung roles procedure kung paano implement yung
nila para hindi magtuturuan at time of strategy
disruption ○ Where and when: dapat offsite kasi for
○ Written: block and white example may sunog, baka ma-subject to
○ Mas mapapadali kapag updated yung damages yung original site mo pang
documents andun
○ DRP is a continuous planning process ○ Order: ano uunahin mo, pagkakasunod ng
○ Not everyone in the organization has irerecover mo, connection/data
enough knowledge to understand jargons ● Recovery procedures (for each IT system or
○ It should be understood by people outside component). Note: the level of detail here
of the IT department. greatly varies and depends on the practices
○ Di naman lahat ng members ng teams ay used in the organization.
galing sa IT. ○ Yung actual recovery procedure
● Contacts for important vendors and suppliers
Typically, the IT DRP contains: ○ Why? Because some of our processes are
● Procedures for declaring a disaster serviced by 3rd party vendors
(escalation procedures) ○ Why SLA important? Warranties—baka
○ clear guidelines to declare the event a may damages
disaster ○ You have to review your SLAs
○ important to constitute

MARIA BERNISE DIMZON • ELEINA BEA BERNARDO 5

 Module 8: Disaster Recovery Plans

● The clear identification of the various - Hindi niya i-tetest yung laman, kundi yung
resources required for recovery and continued pagimplement ng laman ng DRP
operation of the organization
○ Ex. napili mo hot site, ano resources na A result of the evaluation step should be a list of
need mo? Complete resources recommendations to improve the plan.
○ Warm site - network connections, - Possible ba na walang recommendations to
hardware improve the plan? Very rare that the auditor
○ Mirror site - lahat ng meron sa main would not be able to look for a finding and a
site/original facility recommendation
○ Mobile site - lahat ng kasya sa movable - It is important na yung IS auditor na alam niya
vehicle yung laman ng DRP
- Note: Wala pang actual disaster na
It is common to identify teams of personnel who nangyayari, itetest lang.
are made responsible for specific tasks in case of
disasters. Some important teams should be formed In summary, testing should include:
and their responsibilities are explained later in this ● Develop test objectives.
section. Copies of the plan should be maintained ○ Test the effectiveness of DRP
offsite. The plan must be structured so that its parts ● Execute the test.
can easily be handled by different teams. ○ Simulate ka ng disaster as tough you are
- Hahatiin mo yung team mo. wag mo expect na going to recover
kaya gawin lahat ng isang tao. one team ● Evaluate the test.
maybe in charge of the software, hardware, ○ Check if the objectives are met
backup, etc. ● Develop recommendations to improve the
- Ex. meron kang hot site, dapat doon sa effectiveness of testing processes and
mismong hotsite, andoon yung copy ng DRP recovery plans.
- Why is it important? Para mas accessible na ● Implement a follow-up process to ensure that
siya during a disaster the recommendations are implemented.
- Maactivate yung offsite pag meron ng disaster ○ Goal: to check if your recommendations as
an auditor will be followed and the
recommendations have corrective actions
DR TESTING METHODS
○ You are going to check kung nasolusyonan
Based on the risk assessment and BIA, critical yung mali
applications and infrastructure are identified for
testing. These should be developed into a testing It is extremely unlikely that no recommendations
schedule. Recovery plans that have not been tested will result and that everything works as planned. If
leave an organization with an unacceptable it does, it is likely that a more challenging test
likelihood that plans will not work. should have been planned.
- May plano ka na. May printed ka na, completo - Dapat may opportunities for improvement
na ang teams, resources, nakapili ka ng - Baka mali yung testing na ginawa kung walang
alternatives mo, it’s time to test your plan recommendations na makita or maibigay yung
- Simulate and test if the plan would really work IS auditor
- Kung di mo tinest, tinatanggap mo na na di
nagwowork The types of disaster recovery tests include:
● Checklist review — This is a preliminary step
As testing plans cost time and resources, an to a real test. Recovery checklists are
organization should carefully plan and develop test distributed to all members of a recovery team
objectives to ensure that measurable benefits can to review and ensure that the checklist is
be achieved. current.
- You can list down the objectives and check if the ○ Easiest way of testing
plan would be able to complete the objectives ○ Literal na you are going to check from a
list if the DRP is complete or not
Once these objectives have been defined, an ○ Easiest but does not give much insights on
independent third party such as the IS auditor the actual implementation of the DR
should be present to monitor and evaluate the test. ● Structured walk-through — Team members
physically implement the plans on paper and
- Dito pumapasok ang role ng IS auditor review each step to assess its effectiveness,

MARIA BERNISE DIMZON • ELEINA BEA BERNARDO 6

 Module 8: Disaster Recovery Plans

identify enhancements, constraints and

deficiencies.
○ Para siyang simulation pero
pinag-uusapan lang, yung team members
ineexecute
○ I-dididscuss yung step-by-step procedures
pero wala pang simulation
● Simulation test — The recovery team role
play a prepared disaster scenario without
activating processing at the recovery site.
○ Think of it as a role play. As if na may
disaster na pero di pa iaactivate yung
offsite facility
● Parallel test — The recovery site is brought to
a state of operational readiness, but
operations at the primary site continue
normally.
○ Sa simulation test, role-playing pero di
gagamitin yung recovery site
○ Parallel test, roleplaying simulation siya,
iaactivate yung recovery site pero
continuous parin yung operation sa
original site
● Full interruption test — Operations are shut
down at the primary site and shifted to the
recovery site in accordance with the recovery
plan; this is the most rigorous form of testing
but is expensive and potentially disruptive.
○ Pinakamagandang test pero costly, pag
may disruption activate si recovery site tas
titigil ang original site
○ Literal na matitigil yung primary site as
though merong disaster
○ Costly siya kasi it might affect the normal
operations of the business (dangerous)
○ Time or schedule of the test (give
consideration)
○ Pinakamaganda kaso costly and
dangerous kasi it might affect the
operations

- Last three all simulation, as if roleplaying

MARIA BERNISE DIMZON • ELEINA BEA BERNARDO 7