IT SECURITY: BUSINESS CONTINUITY PLAN - BCP - IT PCA

SECURITY
Plan de reprise d’activité, PRA et PCA informatique

This guide will assist you throughout the completion cycle.

your IT project: project management assistance, drafting of specifications
specifications, technology assessment, assistance in choice, verification
necessary features…

SPECIFICATIONS

1/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - BCP - IT PCA

ABOUT THIS GUIDE

Resuming activity - IT DRP and BCP

1 USE THIS GUIDE 2 RIGHTS OF USE 3 COMMUNITY

The structure and the content of [Link] Share your expertise,
these guides constitute a authorize any person exchange around your
excellent base for preparation physical or moral to use IT projects and let us know
a specifications document or a and reproduce this document from your feedback experiences
comparative. for his own use for on the use of models
provided that the source is mentioned. of specifications.

Learn more En savoir plus Learn more

4 INFOGRAPHICS 5 INTERVIEWS 6 TRAINING

Statistics, accounts The responsible ones A range of sessions
study reports, elements of computer scientists express themselves of a day intended for
reflection on a fifty on the implementation to deepen a subject and to
for IT subjects. Download operational of their materialize the approach of
freely these infographics on projets : conseils, anecdotes preparation of a project.
[Link]. practices, traps to avoid...

Learn more Learn more Learn more

COMPARATIVE GUIDES

Le portail collaboratif du cahier des charges

2/24 PAGES | [Link]

 IT SECURITY: BUSINESS RECOVERY PLAN - PRA - IT PCA

INTRODUCTION
Technological context, methodology, and framing elements

PRA - PCA - BCP

We define by Business Continuity Plan (or Business Continuity)

Plan - BCP) all preparatory studies, strategies, of
the organization, processes, and resources, intended to ensure the
vital functions of the company in case of crises as diverse as the
natural, health, energy risks...
The IT Business Recovery Plan is one of the
components of a global Business Continuity Plan. It can also
to be established autonomously, in the absence of a broader plan,
by a more 'departmental' necessity, at the request of ers
partners or sectoral...

PRA Informatique

A Business Continuity Plan implements the entire

processes and human, material and technological resources
permitting the company to face an information disaster
major, the notion of "major" being very variable from one company to
another.

A PRA Informs that it revolves around:

The definition and implementation of processes and means to be

preparatory, essential bases on which the company will rely
to deal with the disaster.
• The operational implementation of a 'degraded' mode or
minimal configuration allowing the company to ensure its
vital functions immediately after the disaster. The speed of
Reaction and the quality of the preparation are essential here.
The progressive reconstruction of the permeable global infrastructure.
for the company to find a situation identical to the previous one
to the disaster. Numerous cases testify that a reconstruction to
the identity of an infrastructure is not always acquired for a
company and can take several years.

3/24 PAGES | [Link]

 IT SECURITY: BUSINESS CONTINUITY PLAN - BCP - IT PCA

The purpose of this document is to establish a list of means

to request and validate for the establishment of a Recovery Plan
Information Activity.

It is however necessary for the company to personalize and complete

this document based on a prior risk analysis, and to establish
a choice of measures to be implemented.

Cost of an IT Disaster Recovery Plan

The cost of a DRP is completely variable from one company to another.

An impact analysis on operations will allow:

to identify the extent of possible damages corresponding to

each risk. These damages are very variable and depend on
the organization of the company, sensitivity, and impact on the
heart of mother... The server of a company's website will not
no call to the same DRP if it is a site with the purpose of 'plaque'
commercial or an online shopping site through which
transit a part of the business letter.
• To perform a comparative calculation of the cost of the PRA / cost of time
stop.

A PRA can today prove to be relatively simple and not very

expensive depending on the contexts, and the multiplication of service providers
specialized allows through the pooling of resources, to have
of processes and means relatively simple in terms of safety
brought
In any case, the project manager will have to get back to work.
delicate construction of a balance between probability and impact
risks, budget of the business continuity plan, and permanence of the technical solution
envisaged.

Market standards and norms

Different standards, recommendations, and norms exist in

mother of PRA, with very variable levels of precision. It is
So it is recommended to review the publications of the organizations.
normalization, the associations, the actors or their specific to each
activity sector, but also the requests that may come from
partners or clients.

As an example, the Financial Markets Authority (AMF) requests

from now on, all licensed portfolio management companies
by the AMF have a PRA.

4/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - BCP - IT BACKUP

In my mother of associations, the Club of System Security

the information French (CLUSIF - [Link]) publishes some
documents and recommendations of great interest.

The following standards and recommendations are also dedicated to

to the PRA:

• ISO : ISO 22399, ISO 27000

• BSI (British Standard Institute) : BS25999-1 BS25999-2
• ITIL : « Con nuity Management » et « Availability Management »

5/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - PRA - IT PCA

SUMMARY
IT security, business recovery, IT DRP and BCP

1 CONTEXT AND PRA PROJECT

1.1. Context and inventory of the existing
1.2. The PRA project

2 IT INFRASTRUCTURE
2.1. Computer Environment
2.2. Networks and telecommunications

2.3. Servers
2.4. Database engines
2.5. Application chain
2.6. Backups
2.7. Replication (outside DBMS) to the backup site
2.8. Workstations

3 Fallback Site
4 IT Outsourcing Services
5 SERVICE LEVEL GUARANTEES (SLA)

6/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - BCP - IT CONTINUITY

SPECIFICATIONS TEMPLATE
Select and weigh the following criteria according to your
project to guide your technological choices

1. Context and PRA project

1.1. Context and inventory of the existing
1.1.1. Site implantation

Identification of the different sites of the company: Identification of

servers on each site:

Identification of virtual servers of physical servers:

Identification of network cores (local network):

1.1.2. Telecommunications data

Identification of existing telecommunications means on

Each site: Identification of the role of each telecom link:
Identification of the flow of each link:

Identification of existing telecom operators:

Identification of RTOs (Recovery Time Objectives)

possibly subscribed through the links:

1.1.3. Voice telecommunications

Inventory of the telephone solution in place at each site:

Identification of operators in place:

GTR (recovery time guarantees) identification

potentially subscribed:

1.1.4. Backups

Identification of the type of backup for each server

(periodicity, backup time, archiving, volume):

7/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - BCP - IT RECOVERY

Identification of backup outsourcing solutions

possibly in place :

Description of restoration tests that may have been carried out (nature,
frequency...)

1.1.5. Applications

Detailed identification of application chains:

Description of the links between application chains and the elements

physiques:

1.1.6. Workstations

Inventory of all existing applications on the workstations

work

1.2. The PRA project

What is the nature of the PRA project?

Evolution of an existing DRP
Creation of a Business Continuity Plan (BCP)

Application of regulation
Is part of an international group project
Other(s):

1.2.1. Backup site

In the event of subscribing to a backup site, what connections

will be used to interconnect (Internet, VPN...) ?

1.2.2. Computer Science

What is the acceptable level of data loss?

What is the maximum deadline for resuming operation requested by

application?

What is the maximum time frame for bringing each server back into service?
asked after a complete "crash" in the existing environment?

8/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - BCP - IT PCA

1.2.3. Telephony

What are the telephone services (voice, fax, voicemail)?

before resuming an activity following a disaster?

What is the maximum timeframe for restoring services?

telephone lines should resume activity as a priority?

What are the phone numbers that need to be kept in

case of crisis?

1.2.4. Project PRA Environment

Should the project include a fallback solution for users?

Has a communication plan for users already been made?

established?

2. IT infrastructure
2.1. IT Environment

2.1.1. Characteristics of the proposed computer room

service provider

What is the total area of the computer room?

What is the average width of the aisles between the cabinets?

servers?

What is the number and dimension of the accesses (width and height of the
doors) of the room informs?

What is the total capacity of the room?

Number of cabinets and their availability in terms of "U" (the
The characteristics of the cabinets will be detailed further on?
Any other relevant information regarding the capacity of the room:

What is the total occupancy rate (in %) of the cabinets (if any
Are the equipment pre-installed?

What is the allowable weight per square meter?

What is the total capacity of the room in electrical power?

9/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - BCP - IT RECOVERY PLAN

Is the electrical capacity of the room suitable in case of

total filling of the room?
Yes
No, at what filling rate can we estimate this capacity?

Is the room equipped with a false floor?

No
Yes

Is the room equipped with a false ceiling?

No
Yes

Is the room equipped with humidity control?

□ No
Yes

Does the room allow for equipment to be accommodated elsewhere than in the
cabinets (servers in tower, desktop or other formats, equipment
individuals...?
□ No
Yes
If yes, thanks to which arrangements (shelves, furniture...)?

2.1.2. Air Conditioning

For what total heat dissipation has the air conditioning been
dimensioned?

Is the air conditioning suitable for proper regulation?

temperature in case of total filling of the room cabinets?
□ No: at what fill rate can we estimate this limit?
Yes

How many independent air conditioning units is equipped with the

What does the room inform?

Is the air conditioning independent of that of the building?

No
Yes

10/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - BCP - IT PCA

What is the technology of the air conditioning circuit?

On water circuit
On air circuit
Other, please specify:

The room informs that it is equipped with an alarm that goes off.
in case of failure?
No
Yes

Is she capable of issuing instructions for server maintenance?

(SNMP type) in case of failure or excessive temperature?
No
Yes

Is it manageable by computer console?

□ No
□ Yes, specify:

The room informs that it is covered by a contract of

maintenance and upkeep?
No
□ Yes

The room informs whether it is covered by a SLA from the provider?

No
□ Yes

If Yes:
What is the contractual on-site intervention time?
What is the contractual time for reactivation?

2.1.3. Electric Inverters (UPS)

What are the inverters used by the provider (brand,

power, role, technology (batteries...) :

What is the nominal operating time on battery?

(detail by inverter if needed)?

Are inverters equipped with an alarm that triggers in case

of failure?
No
□ Yes

11/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - PRA - IT CONTINGENCY PLAN

Are they able to issue instructions for excision of

servers (SNMP type)?
No
Yes

Are the inverters covered by a maintenance contract and

on-site intervention?
No
□ Yes

If yes, specify the terms of this contract, particularly the timings.

guarantee of intervention:

2.1.4. Server cabinets (racks)

What are the number, the size (in number of 'U') and
possibly the brand of the server cabinets (racks)?

Are the cabinets of standard size (19 inches wide,

17 inches deep?
□ No, dimensions:
Yes

Are the cabinets equipped with lockable doors?

No
□ Yes, on the front and side faces
□ Yes, only on the front face
□ Yes, other, please specify:

Are all the cabinets connected to the inverters?

No
Yes

Is physical access to the cabinets as easy from the back as from the front?
the front?
No
Yes

What are the pre-installed equipment in the cabinets (PDU,

screen/keyboard disposals?)

12/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - BCP - IT CONTINUITY

2.2. Networks and telecommunications

2.2.1. General architecture

What is the category of network cabling used (5, 5E, 6, 6A, 7…)?

Is the transport of data and voice (telephone) a

shared?
No
Yes

Describe the repair of concentrators (hubs) and switches.

(switches) in the premises, as well as the principles adopted and
the constraints taken into account in the design of this
architecture.

Does the network allow for the definition of service classes?

No
Yes

Is there a network monitoring system?

No
Yes
□ If yes, specify which one:

Does the provider propose the establishment of secure access to

network starting from unsecured areas (e.g.: home of the
employees) ?
No
□ Yes

2.2.2. Wi-Fi

Does the network offer the possibility of Wi-Fi connections?

No
Yes

Is the entire site covered by the Wi-Fi signal?

No
Yes

Are the Wi-Fi hotspots physically secured (against theft,

disconnection, extinction, displacement...)
No
Yes

13/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - PRA - IT PCA

Are there workstations whose connection to the network is

mandatory Wi-Fi?
No
□ Yes, in what proportion in relation to the total number of
workstations?

What is the Wi-Fi standard used?

2.2.3. Data

What is the nominal flow rate on the network (detailed in case of portions
heterogeneous on the network) ?

Is the network connected with one or more external lines?

No
Yes

If Yes:
Lister les lignes avec leur caractéris que (cuivre, bre op que…),
technology (ADSL, SDSL, MPLS...), the type of router, the name of their
service provider and their nominal rate:

If they exist, describe the switching devices between these lines.

fail-over

Does the network offer an Internet gateway (proxy)?

No
□ Yes

If Yes: What software or equipment ('appliance') provides the service

of proxy?

On which operating system is the proxy running?

The server (physical or logical in the case of virtualization) that

Is the proxy software hosted dedicated?
No, what other application services are hosted on this server?
Yes

Is the network equipped with one or more firewalls?

No
□ Yes

14/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - BCP - IT CONTINGENCY PLAN

If Yes:
What software or equipment ('appliance') provides the firewall service?
fire?

On which operating system is the Firewall running?

The server (physical or logical in the case of virtualization) that hosts

Is the firewall dedicated?
No, what other application services are hosted on this server?
Yes

Is the network equipped with a VPN (virtual private network)?

No
□ Yes

If Yes: Describe the characteristics of this VPN (type of VPN, software,

security...)

What are the deployment constraints of the VPN on the workstations?

users?

2.2.4. Voice

Does the network support the service of 'Voice over IP' (VoIP)?
No
Yes

Is there a private branch exchange (PABX) connected to the network?

physique?
□ No
□ Yes

If yes, is this PABX:

Traditional
Traditional with VoIP gateway
□ Software, operated internally
Software, operated externally (outsourced IP Centrex)
Other, please specify:

Are the telephone stations:

Traditional
□ IP
□ Other, please specify:

15/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - PRA - IT PCA

2.3. Servers

2.3.1. Characteristics of pre-installed servers

What architecture is adopted (multiple answers possible)?

Blade servers
Autonomous servers with their own storage unit
Servers connected to a SAN
Other, please specify:

List the available servers by type, with their number, in

specifying:
The manufacturer and the model:
The processor (CPU) model:
The amount of installed RAM (Random Access Memory):
The maximum installable RAM amount:
The possible emergency automated backup systems in case of
breakdown:
The type (SAS, SCSI, RAID ...), the number and size of the hard drives
of the server, the ability to replace them while running (hot plug):
Redundant equipment (power supply, disk controllers...) :
Network interface cards:
□ Connectivity (type and number of ports, fiber optic sockets (fiber
channel)…) :
The fans (number, maximum capacity, hot-installable...)
□ Any possible peripheral devices (CD reader/burner/
DVD, floppy disk drive…) :

List mass storage devices (type SAN) in

clarifying:
The manufacturer and the model:
The characteristics:

Is it possible to administer the servers remotely?

No
Yes, continuously
Yes, but only when production has shifted to the site of
reply

2.3.2. Characteristics of pre-installed servers

Can the provider offer server hosting?

virtualized?
No
□ Yes

16/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - BCP - IT RECOVERY PLAN

If Yes:
What is the solution retained by the service provider (publisher, name and
version of the hypervisor) :

How many servers are pre-installed in virtualization?

2.3.3. Operating System Licenses

Are the server operating systems pre-installed?

No
□ Yes

If yes, specify the names, versions, and languages of the system(s), in

indicating the applied 'service packs':

What is the licensing mode offered by the provider (several

possible answers)?
All licenses for the operating systems are included in
the service provided by the contractor (If applicable, indicate the systems
possible exploitation options proposed by the service provider
Operating systems are pre-installed on the servers but
the client company must hold the corresponding licenses,
notably in cases of dual use (main site and fallback site)
The provider supplies and installs the operating systems according to the
client company's directives and invoices the corresponding costs back to them
by transferring the licenses to him
The client company installs the operating systems themselves with
its own installation supports, the servers being provided blank of
any system
Other, please specify:

Does the client company need to provide the installation supports?

operational systems?
No
□ Yes

2.4. Database Engines

What are the database engines offered or pre-installed?

by the service provider (if applicable, indicate the versions)?

What is the physical distance of the redundant servers (production/

rescue) and what is the impact on management and functionalities of
databases?
Less than 10 kms:
From 10 km to 50 km:
17/24 PAGES | [Link]
IT SECURITY: BUSINESS CONTINUITY PLAN - BCP - IT PCA

More than 50 km:

What types of architecture are DBMS engines hosted on?

(multiple answers possible)?
Dedicated server, single base instance
Shared server, multi-instance of databases
Shared server with other applications
Dedicated cluster servers for the DBMS
Locally redundant servers ("mirroring")
Virtualized servers
Other, please specify:

What are the features offered attached to the base of

data directly related to the DRP?
The database on the remote site (backup database) is updated.
day by the water, in a completely automated way (detection
automatic gap filling and resolution without manual intervention,
synchronous or asynchronous mode (configuration flexibility). Only
The 'logged' data is sent to the remote site (efficiency
network).
The mechanisms for managing the remote database
ensure data integrity (protection against corruption
physical and logical)
Ability to configure synchronization mechanisms in mode
"Zero data loss" during the activation of the DRP.
Other(s):

What are the possible peripheral features attached to the

database?
The database on the remote site, updated with the data from
production, perhaps accessible and used for other purposes: analysis
decision-making, reporting, backup, testing...
In addition to the role of a backup database, activated during the disaster recovery plan,
the database on the remote site can take on the role of the database
production data in case of maintenance operation to be carried out
on the production site (planned role swapping)
Other(s):

18/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - BCP - IT DISASTER RECOVERY

What are the operating modes offered by the service provider?

before the triggering of the BCP (multiple answers possible)?
The servers are pre-installed with the database management system (DBMS) engine(s) according to
the technical directives of the client company, which will then have to
and deploy its databases on its own during the
triggering of the business continuity plan.

The client company sends its backup files to be restored during the
activation of the recovery plan, the provider takes care of their restoration
on the fallback site.
The client company regularly sends sets to the service provider.
backups of its production bases :
These backups are tested periodically to ensure that
their integrity
These backups are systematically mounted on the servers.
to be ready for use when switching to the backup site
(a delay of a few days or a few hours)
Other, please specify:
The backup site servers are synchronized in real time with the
client company's production site ('mirroring'), based on
on the native replication features of DBMS engines.
Other, please specify:

According to the possible modes of operation, indicate the

potential obligations and operational constraints imposed on
the client company, related to the DBMS:

When the operation of the client company is switched to the site of

reply

What are the possible modes of utilization of backups of

databases (multiple answers possible)?
Use of full backups
Use of incremental backups
Use of differential backups
Utilization of synthetic backups
What is the retention period for save games?
What is the rotation period of the backup media?
How many total backups ("Full") can be kept?
online?

2.5. Application chain

How does the provider ensure the consistency of the chain?

apply in case of emergency?

19/24 PAGES | [Link]

IT SECURITY: BUSINESS RECOVERY PLAN - PRA - IT PCA

Based on the possible modes of operation, indicate the

potential obligations and operating constraints imposed on
the client company, related to this data:

2.6. Backups

What backup methods are offered by the provider?

concerning data files other than those of the databases
data (multiple answers possible)?
The servers are pre-installed identical to those of the company.
client, who will then deploy their data there by themselves
care.
The client company sends its backup files to be restored.
when the business continuity plan is triggered, the service provider takes care of their

restoration on the fallback site.

□ L’entreprise cliente envoie régulièrement au prestataire des jeux de
backup of its data:
These backups are tested periodically to ensure
of their integrity
These backups are systematically mounted on the servers
in order to be ready for use when switching to the backup site
(a shift of a few days or a few hours)
□ Other, please specify:

What backup equipment is offered by the provider?

What backup methods are offered by the service provider?

Use of full backups
Use of incremental backups
Use of differential backups
Use of synthetic backups

What is the retention period for saved game data?

provider? What is the rotation period of the supports?
provider's backup?

How many total backups ('Full') is it possible to

online storage?

Is the backup of tapes - or the media used - done?

outsourced by the service provider?
□ Tous les jours
At least once a week
At least once a month
□ Other, please specify:

20/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - BCP - IT RECOVERY

2.7. Replication (outside RDBMS) to the backup site

What are the replication modes offered by the provider?

before the activation of the PRA (multiple answers possible)?
Delayed replication: what frequency?
The backup site servers are synchronized in real time with
the production site of the client company ('mirroring'). Specify the
technique used :

What control is performed on data replication?

According to the possible modes of operation, indicate the

any operating obligations and constraints imposed on
the client company, related to the implementation of the replication:

Workstations

What solutions can the service provider offer for the implementation of
workstation arrangement in the event of the activation of the DRP
(multiple answers possible)?
The provider does not offer this service
The computers are provided without pre-installation.
the client company must take care of it themselves
The computers are pre-installed:
□ with the operating system:
requested by the client company
in a version offered as standard by the provider
□ with the office suite (including the email client):
requested by the client company
in a version proposed as standard by the provider
with business applications as deployed by the company
customer on their regular site
by identical copying of user workstations, thanks to:
Regularly taken images of each position
user
Another process (specify):
Antivirus: What antivirus solutions for workstations
are offered by the provider?
Other, specify:

21/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - PRA - IT PCA

Does the provider offer standardized computer models?

No
Yes

If yes, specify the brands, models, and characteristics, as well as

the expansion possibilities (RAM, etc…):

Within what timeframe can the service provider commit to delivering posts of
work ready for employment?

What operating systems and which version(s) does the provider

Can it handle workstations?

What are the minimum hardware and software requirements required by

the service provider?

Can the service provider handle the implementation of new ones?

applications?
No
Yes

What is the park management tool proposed by the provider?

Does the service provider implement a monitoring system for maintenance contracts?
on the equipment?
No
□ Yes

If yes, in what form?

Does the service provider implement a tracking system for licenses to be renewed?
No
□ Yes

If yes, in what form?

Does the provider manage the update of workstations?

No
Yes

3. Site of refuge
What is the precise location of the fallback site that will be used in
case of damage?

22/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - BCP - IT PCA

How many job positions are available?

the company on the fallback site?

Does the backup site have parking spaces and how many?

What is the existing security infrastructure of the premises?

fallback site?
Access by badge
Access traceability
Video surveillance
Other(s):

What are the surfaces and amenities available on the

fallback site?
Telephone standard
Administrative Secretariat
Shared or not shared reception:
Other(s):

Does the provider offer a unit for the crisis group?

Meeting rooms
Video conference
Television
Radio
Other(s):

What is the minimum notice period for the availability of the positions
of work?

What is the welcome procedure for users on the backup site?

of the service provider?

23/24 PAGES | [Link]

IT SECURITY: BUSINESS CONTINUITY PLAN - BCP - IT PCA

4. Managed Services
Can the provider take care of the administration of
following elements (specify the proposed arrangements by the
provider on each of the topics) ?
□ Serveurs
Internal network
Classic telephony
VoIP Telephony
Internet Gateway and Proxy
Firewall
User posts
Database (role of DBA)
Backups
Replication
Office support (helpdesk)

Does the provider manage the activation and deactivation of accounts?

users?
No
Yes

5. Service Level Guarantees (SLA)

What certificates does the service provider have?

What are the standard quality control indicators proposed?

by the service provider?

Are these indicators communicated to the client company?

No
□ Yes, how often:

Does the provider offer an SLA covering overall functioning?

When is the business continuity plan triggered?

No
□ Yes, specify:

24/24 PAGES | [Link]