| | June 20157CIOReviewservice or function. It is the amount of time a service can be unavailable without significant impact to the organization. The RPO refers to the amount of acceptable data loss to be incurred due to a disaster. Both the RPO and RTO vary with each service provided by IT. For example, our organization determined that the time to recover core services such as finance and human resources staffing information was very short, meaning the organization could not be without these services for more than a few hours. At the other end of the services provided, some reporting needs including specific data validation and facilities reports could be inaccessible for many weeks before significantly impacting the organization.This level of detail informed the next steps in our planning process, which was to conduct a gap assessment to evaluate current service levels against the desired states uncovered in the Business Impact Analysis phase. IT staff needed to evaluate actual recovery times against need, backup strategies and backup frequency to ensure RPO objectives could be met.While the gap analysis is primarily an IT specific exercise, departments and schools were actively engaged, simultaneously developing Business Continuity Plans. These plans contain forms, workflows, tasks, vendor and other contact information needed by a school or department in the event of a disaster. Within the IT department, the task was to create a recovery plan addressing any gaps between existing capabilities and RTO/RPO objectives.The senior leadership team was again engaged to review the plans and their responsibilities in the event of a disaster. In addition to specific logistical duties around disaster declaration and facility needs, they are also charged with overall plan management and upkeep of the plans.There were a number of lessons learned in our exercise of leading a K12 enterprise through the Business Continuity/Disaster Recovery process. The first is that while it can be challenging to convince department leaders to allocate staff time to this process, the knowledge gained from documenting processes and expectations of systems availability is extremely valuable. Agreement upon needs and priorities helps staff understand the time systems could be offline, priorities for bringing services back online, and what alternate workflow they will use to accomplish their work. Our move from just an IT-centric Disaster Recovery plan to a comprehensive Business Continuity Plan increased awareness and understanding throughout the organization.Another important learning from the process was that as IT staff worked through the Business Continuity Planning with staff from other departments, IT staff gained a deeper understanding of the work and needs across the organization. This increased understanding of our business will help IT staff assist in a more strategic manner as they work with staff to continuously improve workflow and processes in schools and departments.Business Continuity/Disaster Recovery planning is a complex and intensive process for an organization. Many K12 staff in schools and departments are overwhelmed with work and to ask them to engage in this exercise is not an insignificant undertaking. Yet for all of the challenges with working through the BCP/DR process, the value-add of having documented processes and continuity plans for schools and departments offers considerable protection to the organization and drastically increases the likelihood of the continued education of our students should a disaster occur. The value-add of having documented processes and continuity plans for schools and departments offers considerable protection to the organization
< Page 6 | Page 8 >