Summary

---

Forms and Resources

Building your information portfolio begins with a formal process. Therefore, it is important to have some level of consistency when you begin. We have included some sample forms and reports that you might find useful in your organization. If you choose not to use these forms, at least use something that can be reused by other members of your team. Inconsistent information portfolios are basically worthless when you are trying to coordinate disaster recovery plans. To begin the information portfolio, use this first worksheet shown in Table E.1, Preliminary List, as a brainstorming tool to identify as many systems or applications you are aware of. Once you decide what application or service you want to assess, you should next use the BIA Assessment Sheet to begin your investigative work and gather the other information listed.

Table E.1: Preliminary List

DATE: APP/SERVER/SERVICE	SYS. ADMIN/DATA OWNER	BUSINESS UNIT	PHONE #	BIA (Y/N)
Dependencies, additional contacts, misc. information:

DATE: APP/SERVER/SERVICE	SYS. ADMIN/DATA OWNER	BUSINESS UNIT	PHONE #	BIA (Y/N)
Dependencies, additional contacts, misc. information:

DATE: APP/SERVER/SERVICE	SYS. ADMIN/DATA OWNER	BUSINESS UNIT	PHONE #	BIA (Y/N)
Dependencies, additional contacts, misc. information:

BIA Assessment Sheet

The BIA Assessment Sheet is the beginning of the information portfolio. This will only be as complete as you are thorough; therefore, never think it unprofessional to ask additional questions and for additional information. Remind the individuals that you are gathering this information only to ensure that this report is sufficiently complete to make a recovery as smooth as possible.

Your assessment sheet should include the following:

• Date the report is created

• Application/system being used

• System administration support person's name and phone number

• Business unit manager's name and phone number

Be as thorough as you can in your report, but remember that some of this information will come out in the interviews you conduct. For the application/system, list all other applications or services it depends on. If this is a server, then list all of the applications that it supports and that must be recovered in the event of a disaster. Also make note of what areas of the company would be affected if any of those applications or servers listed were lost.

Start building your interview list. Remember to start at the top and work your way down. For example, start with a vice president of the business unit and explain the situation to him or her, then continue from there. You should definitely interview the system administrator for the server that is being assessed.

Lastly, always leave yourself some room for issues that arise either during the initial conversations regarding the meetings or just when you have an idea. This will eliminate many loose pieces of paper and the potential for loss or misplacement of them.

Overall Impact Assessment Sheet

The overall impact assessment sheet will help you define during your meetings the financial impact a failure would have on the particular business area you are assessing, corporate image, customer confidence, and any legal ramifications to be concerned with as a result of losing this particular business area's functions for a period of time. The following information should be included in your report:

• Date report is created

• Business area/unit being assessed

• System administration support person's name and phone number

• Business unit manager's name and phone number

Also note what financial loss the company would expect to see should this particular business area experience a disaster, based on the level of importance it holds for the overall business. Table E.2 shows a sample form where you can record this information.

Table E.2: Financial Loss per Outage Duration

OUTAGE DURATION	< 1 HOUR	1 - 12 HOURS	1 DAY	1 WEEK
<Business Component>	Enter $$ Amount	Enter $$ Amount	Enter $$ Amount	Enter $$ Amount
<Business Component>	Enter $$ Amount	Enter $$ Amount	Enter $$ Amount	Enter $$ Amount
<Business Component>	Enter $$ Amount	Enter $$ Amount	Enter $$ Amount	Enter $$ Amount
<Business Component>	Enter $$ Amount	Enter $$ Amount	Enter $$ Amount	Enter $$ Amount

Note: NOTE

Before completing this form, you should first determine the loss ranges per outage duration.

You will also need to note the following in your report:

• Could this loss have impact on the corporate image?

  • At what point would it impact image negatively?

• What would be the impact to the customers?

  • At what point would it impact the customers negatively?

• Are there any legal ramifications to be concerned with as a result of this loss?

  • At what point would it impact the company legally?

Internet Resources

So many resources are available that we decided to list only a few in Table E.3 to help you with your research. Since the BIAs can be used for all levels of your business, you will find a broad sampling of resources and links that you can visit.

Table E.3: Internet Resources

RESOURCES AND LINKS	URL
Disaster Recovery Journal	www.drj.com
Contingency Planning and Management Magazine	www.contingencyplanning.com
Disaster Recovery Institute International	www.dr.org
FEMA	www.fema.gov
Disaster Links	www.Disasterlinks.com
Disaster Prevention and Recovery Guide	www.system.missouri.edu/ records/disaster.html
X-Force Threat Analysis Service	http://xforce.iss.net
The Business Continuity Institute	www.thebci.org
Disaster Recovery Information Exchange	www.drie.org
State of Kansas Business Contingency Planning	http://da.state.ks.us/disc/dr/

SOME VENDORS TO KNOW ABOUT	URL
On-Track Data Recovery	www.ontrack.com
Media Recovery	www.mediarecovery.com
ServiceMaster Recovery Management	www.servicemasterrecovery.com/

---