Development of an ITDR framework
The brief
The project began with a structured risk assessment identifying potential disaster scenarios across physical, cyber, and operational domains that could impact business continuity. Working collaboratively with IT leadership and key business stakeholders, we mapped over 20 critical business processes to their supporting IT systems—a crucial step that highlighted dependencies and informed recovery priorities.
We established tailored Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO) for each critical system, providing clear metrics for acceptable data loss and downtime tolerances.
Our approach
- Identified potential disaster events and risks that could impact operations.
- A crucial part of the framework involved mapping critical business processes to their supporting systems. This mapping serves as the foundation for effective ITDR by:
- Identifying dependencies between business functions and IT systems
- Ensuring recovery priorities align with business needs
- Providing clarity on what systems need to be recovered first
We established two key recovery metrics, Recovery Point Objective (RPO): The maximum acceptable data loss measured in time and Recovery Time Objective (RTO): The maximum tolerable downtime for critical systems. These objectives were tailored for each critical system based on business impact analysis.
The solution and key benefits
The project delivered a comprehensive suite of coordinated response plans including Business Continuity, Crisis Communications, Critical Infrastructure Protection, Information System Contingency, Cyber Incident Response, Disaster Recovery, and Occupant Emergency Plans. Each plan addressed specific aspects of disaster response while maintaining alignment with the overall ITDR framework.
