Disaster Recovery Plan - December 2012

Mom & Pop Groceries

Disaster Recovery & Business Continuity Plan

Mom & Pop Groceries 1234 Main Street Joliet, IL Robert Clayton http//www.m&p.com

December 2012

M&P Disaster Recovery

Disaster Recovery Plan - December 2012

Executive Summary
The board of directors for Mom & Pop Groceries, recognizes the importance of the contingency planning for the business processes critical to the continuation of operations for the franchise. Included within this plan are the functions of various departments and associated personnel. Therefore, the board of directors and senior management of the franchise, firmly support the need to establish and maintain this comprehensive disaster recovery / business continuity plan. The disaster recovery / business continuity plan has been devised to recover operations on a building by building basis. Under the assumption that most retail operations are similar, a broad plan has been assembled for recovery of operations for all branches of the franchise. The recovery areas were determined to be: - Mom & Pop HQ - Mortgage - Metropolitan Bank Group (Delaware, Illinois, and Georgia Locations) - Central Operations The plan was created with the full understanding that technology, people, and procedural knowledge are all equally important participants in Mom & Pop's operation. Equally important, the plan recognizes that disasters come in many forms, each type having a different area of franchise operations. Furthermore, the plan evaluated and prioritized core processes to "M&P" operations. Below is a table summarizing each processes current levels of operating range, revenue impact, customer inconvenience, recovery time objective, and significance. Additionally, another table identifies the class of validation testing which will occur on a regular basis to continually validate the disaster recovery process. While the table below provides a high level view of the process to be utilized to restore the various systems and/or processes, additional detailed information on the systems, configuration and processes are located within the plan. Disasters vary based on geographical location thus steps during the reconstruction process will vary based upon the area and natural disaster that affects the site.

M&P Disaster Recovery

Disaster Recovery Plan - December 2012

System / Process

A. B. C. D. Operating Revenue Customer Recovery Range Impact Inconvenience Time Person (0) None (0) None (0) Objectiv Department Low (1) Low (1) Significance Risk to e
(1) HQ (2) All Sites (3) Med (2) High (3) Med (2) High (3) More than 1 day (0) Less than 1 day (1) = A+B+C+D

Availability

Total Risk to Availability = Significance * Risk to Availability

Vendor IBT Deluxe Guardia n Retriever POS Software Savvis AT&T Comcast CBS Desktop Dunbar ADP

3 3 2 3 3 2 3 3 3 2 3

3 2 3 2 3 3 2 2 2 3 1

3 1 1 1 3 1 2 2 3 1 0

1 1 1 1 1 1 1 1 1 1 0

10 7 7 7 10 7 8 8 9 7 4

1 5 10 10 10 10 10 5 1 1 5

10 35 70 70 100 70 80 40 9 7 20

M&P Disaster Recovery

Disaster Recovery Plan - December 2012

Importance Of Plan
Mom & Pop Groceries recognizes the importance of business surfival. In order to assure that all critical business functions continue in the evnet of a disaster, a disaster recovery / business continuity plan has been developed. This disaster recovery / business continuity plan will be reviewed and/or updated periodically to ensure current procedures.

Goals and Objectives

The primary goal of the plan is to establish written procedures that will enable M7P to recover from an emergency situation that may disrupt or disable operations for 24 hours up to several days. To minimize disruptions to customers, reduce financial losses and minimize potential risks associated with such disruptions, and ensure the rapid recovery of one or more critical business processes, the success of this plan depends on meeting the following objectives. - Establish authority and define responsibilities for the development, implementation, and maintenance of the plan - Establish a disaster recovery planning team - Assign roles and responsibilities to team members - Integrate recovery plans based around a business impact analysis that: - Identifies and prioritizes internal and external threats to the organization - Identifies and prioritizes business processes performed both internally and by external sources within each functional area - Assesses the impact of loss of information and services from both internal and external sources - Formulate and maintain written contingency procedures for critical business processes - Establish basic requirements for testing the plan - Train personnel assigned to various responsibilities under the plan

M&P Disaster Recovery

Disaster Recovery Plan - December 2012

Authority and Responsibility

It shall be the policy of the board of directors and senior management to establish and maintain a comprehensive plan to ensure that business resumption contingency planning, and testing takes places. Furthermore, it is recognized that the processes most critical to the organization are those performed by outside services and vendors. Those processes include data processing, item processing, web hosting, and the operating system, which supports internal and external communications for all applications. it is essential that the Disaster Recovery Committee evaluate the adequacy of the contingency plans of its third part processors and vendors to ensure compatibility with that of its own plan.

Disaster Recovery Planning / Response Team

A disaster recovery planning team has been established. The team is comprised of a disaster recovery coordinator and a primary team leaders representing management personnel from functional areas critical to its business operation. Core Business Function Disaster Recovery Coordinator Primary Team Leaders Frank James, Risk Management / Investigations Officer Business: 888-555-1234 Cell:630-555-6859 Fax:773-555-9653 Email:Fjames@gmail.com Michael Knox, Information Services / Investigations Officer Business: 888-555-4321 Cell:545-586-6931 Fax:758-583-6542 Email:Mknox@gmail.com Secondary Team Leaders Bill Jones Business: 888-555-7896 Cell:630-555-1257 Fax:773-555-1234 Email:Bjones@gmail.com Robert Clayton Business: 888-555-4856 Cell:630-555-6419 Fax:777-555-9853 Email:Rclayton@gmail.com

Information Services

M&P Disaster Recovery

Disaster Recovery Plan - December 2012

Crisis Management
Notification of Teams
Following an emergency at any of the sites, the operational personnel on site will take the appropriate initial action and then contact a member of the Disaster Recovery Team, starting with the first name on the list, if other than a team member. When a member is located, that member will contact the remaining members of the team. The members will meet to make a firsthand to make a firsthand assessment of the impact. They will determine the action to take and will notify senior management. If a determination is made to notify all personnel, the disaster recovery team will phone the other personnel using a predefined contact system.

Establish a Control Center

The first task for the disaster recovery team is to establish a control center. The location of the control center should be in close proximity to the data center or at the contracted off site location. If nothing is available or usable, a nearby hotel which affords excellent accommodations. The phone number should be made available to all departments and users so that all information can be changed throughout the center The following location has been designated as the command center: Command Center Location Joliet Community Main 7458 West Lake Street Joliet, IL Command Center Telephone Number TBD Alternate Command Center* TBD Alternate Command Center Telephone Number TBD *The alternate Command Center is to be used in the event of geography widespread disaster or due to extenuating circumstances.

M&P Disaster Recovery

Disaster Recovery Plan - December 2012

Workflow Process
Assess Damage / Declare Disaster Notify Manageme nt Notify DR Team Notify Vendors

Begin Initial Recovery

Establish Command Center

Notify Data Storage Site / Obtain Backup Tapes

Begin Event Documentatio n

Relocate to Command Center

Work with ISP for DNS changes

Bring up Mission Critical Hardware

Restore from backups

Applicatio ns Tested

Migrate Users

Recover Phone / Workstation Services

Business Resumption

M&P Disaster Recovery

Disaster Recovery Plan - December 2012

Damage Assessment Form

1. Disaster Reported Date________________ Time__________________ 2. Description of Incident:

3. Damage Assessment to Building / Location:

4. Damage to Computer / Cashier Equipment:

5. Personal Injuries - Staff:

6. Personal Injuries - Customer:

7. Evaluation of Hazards:

8. Safe to Enter?:

9. Report Damage to Management Team: Status Mechanical Electrical Lighting Heating/Air Conditioning Computer Equipment Registers

Remarks

M&P Disaster Recovery

Disaster Recovery Plan - December 2012 10. Resources Impacted:

11. Remaining Resources:

12. Are remaining resources sufficent? Yes_________ No __________

13. Action to be taken:

M&P Disaster Recovery