Robust DR and BCP Assessment for Leading Australian Mutual Organisation
A large Australian Mutual organisation needed to assess
the current state of its Disaster Recovery and ICT Business Continuity Planning practices as part of a significant business transformation program.
Diaxion was asked to conduct the assessment and provide a framework and oversight to support the development of a robust DR plan that could be implemented in the case of a
Our client is one of the largest Mutual organisations in Australia with a purpose to improve people’s lives by addressing their needs in the areas of mobility, home and leisure. The organisation’s strategy aims to grow its membership base, deliver more products and services, and make membership more meaningful and relevant.
In support of its strategy, our client was undertaking a transformation program resulting in the consolidation and modernisation of many of its business systems resulting in a single member view. This included a migration of some systems to the cloud leveraging heavily SalesForce and Mulesoft, other cloud services and on-premise system integration. As the transformed state neared completion, the organisation needed to re-establish and uplift the Disaster Recovery (DR) and ICT Business Continuity Planning (BCP) practices within the IT operation. Our client needed a better understanding of current and desired capability to inform a re-enablement roadmap and to enable DR for the top two tiers of applications. This would be followed by a DR tabletop exercise.
In order to prepare for this, Diaxion was asked to assess the current state of the DR and ICT BCP practices and standards. This involved the definition and review of standards and processes to be uplifted to meet the desired target state of DR maturity. Diaxion was also to lead the construction of the DR plans for the business-critical applications.
Diaxion’s engagement followed a phased approach of Discovery, Analysis, Plan, and Exercise. In the Discovery phase, Diaxion undertook the work by reviewing documentation and conducting workshops. The initial documentation requested covered various areas including current DR and BCP, recent Business Impact Assessment (BIA), DR charter, Crisis Management Plan, last DR and BCP exercises, and supporting documentation such as sequencing, system recovery, and service tiering.
After reviewing the documentation, Diaxion conducted workshops to confirm the desired target state for both DR and BCP, and to understand or confirm current gaps. Diaxion also brought samples of different DR strategies, plans and runbook formats from previous engagements to facilitate alignment to the style best suited to the organisation. The workshops were held with key stakeholders across the business including risk and crisis managers, BIA process manager, operations manager, service owner, and solution design lead.
In the Analysis phase, Diaxion analysed capability gaps and determined how they could be best resolved; be that through technology, process improvement, 3rd party requirements, or people capability and capacity. Diaxion then identified an appropriate DR framework for the client and assessed them against it by considering how the framework would integrate into the existing Crisis Management Plan, the DR charter and triggers to be catered for, and the DR calendar. Diaxion also considered initial socialisation and ongoing project life cycle integration, training and testing for re-establishment, and how to test and mature the DR capability over a two year period.
The Plan phase saw Diaxion use the findings from the Analysis phase to create and update our client’s DR documentation. These documents included an overall DR strategy and plan, DR plans for each application and service, and a DR runbook. While the client was responsible for the construction of the plans and a further set of applications, Diaxion provided the supporting framework, explanation, oversight, assistance, and quality assurance review of one. Diaxion took a collaborative approach to review all documents, provide feedback and ensure consistency.
The final phase was run as a walk-through of the DR plans, where all relevant teams needed to confirm that the DR plans aligned sufficiently with the requirements and could realistically be implemented in the case of a disaster scenario. There were two review cycles which aimed to detect any technical or non-technical issues or concerns, and to inform the final DR documentation.
The engagement provided the organisation with a set of realistic and achievable DR documentation and plans for business-critical and supporting services. Architectural and other gaps were clearly identified and prioritised with Diaxion providing recommended remediation. This will enable the organisation to adequately resource for DR and successfully test and maintain the DR processes.