Part of a report need . 3-4 pages . Please ready below

The name of our company is Coral Gables (CG). CG is a city government in South Florida. CG performs functions such as the review/approval of the annual budget, establishment of tax rates, modification of the city’s charter, and regulation of public health and safety (NLC, n.d.). It has an open data portal that allows residents to evaluate and analyze datasets (e.g., budget data). The company is in desperate need of a technology solution that is compatible with its contingency/disaster recovery plan (DRP). Recently, CG has experienced a fire disaster that caused a huge data loss. The fire has cost them a hefty amount of time and money to rebuild/replace equipment. Both of which they cannot afford to waste, as their responsibilities as a city government rely on their ability to maintain the security and integrity of sensitive data. They now understand that they need to push forward with their plan to set up an off-site location. Specifically, a location that possesses an adequate amount of space for optimal functionality, in the event that it must be used during the aftermath of a disaster. Currently, CG is looking into a cloud-based service that will provide them with a relocation process that hosts features such as management tools, data services, and networking. CG intends to combine the chosen hyperconverged infrastructure (HCI) solution with their DRP strategy.

Contingency plans are a necessity within every organization. They help organizations develop contingency strategies that are based on considerations and solutions. For example, data backup and recovery might be a consideration. One solution for it would be interoperability; which means the backup device will need to be compatible with different operating systems and applications (Swanson et al, n.d.). A contingency plan is made up of three important components (Garcia, 2008): emergency response (focuses on people), crisis management (focuses on the decision process), business recovery/resumption (focuses on business revenue).

All three usually play out in phases; when the circumstances of an incident or event supersede the capability/responsibilities of one team (e.g., crisis management team), it is then to be handled by the next phase. The procedures for each phase need to be well defined and documented, to lessen the risk of failure when a real event occurs. Before a contingency plan process can begin, three objectives of a risk analysis must be addressed (Toigo, 2003):

· Identify business processes and their associated IT infrastructure resource requirements (that is, the data, applications, systems, and networks that are used in delivering the business process). Prioritize business processes according to time sensitivity and criticality.

· Identify existing threats to business processes and infrastructure resources.

· Define objectives for strategies to eliminate avoidable risks and to minimize the impact of risks that cannot be eliminated.

To make the process easier, or at least more efficient, an organization must utilize and/or create categories for the contingency plans used in response to an event. What this means for organizations is that they would be prepared for risks and threats because they have a list of contingencies grouped under specific categories, from which an organization can draw in their time of need. This way the use of resources becomes more refined in terms of cost-effectiveness and time management. By using a criticality spectrum (Toigo, 2003), risk levels can be categorized as Critical, Vital, Sensitive, and Noncritical.

Tabletop testing is a simulated exercise (with limitations) that allows a disaster recovery (DR) team to play out disaster recovery scenarios. The facilitator creates a scenario in where the team must complete their objectives by using the DR runbook, whilst they deal with constrictions. For example, a constraint might be that a database system cannot be accessed because the location of an essential device/person is cut-off or unreachable. This device/person is one step of a multi-factor authentication process. The solution to this problem might be to modify the authentication procedure and/or establish an alternate method to gain access to the database. Generally, a tabletop test would include (Herrera, 2017):

· The scenario

· Names of participants

·

MIS540 Team Project Report – Keller School of Management, 2021 Prof. A. Turkey Page: 2

· Facilitator

· Leader

· Department heads

· Suppliers and other third parties

· Note-taker

·

· Scope and exercise boundaries

· Usually one department/location.

· Assumptions about the facts surrounding the exercise

· Goals and objectives of the exercise

· Logistics detailing people, process, technology, or supply requirements

Contingency plans work best when they allow staff and/or departments to share their expertise during the planning phase of the project. As well as permit them to make their contributions during the development phase. This way key management personnel feel that they have more of a role during the process because it will then take into consideration the matters that are unique to them. By getting, for example, department leaders more involved with the contingency plan, they take on responsibilities and thus become more accountable. Which is a good thing, because their investment in the strategy (i.e., policies, guidelines, procedures, and standards) improves the sustainability of the plan.

Mind Tools (n.d.) offers advice on how to get people to buy-in and how to offset resistance to a contingency plan: “stress the importance of the task and the potential consequences of not having a plan in place. And, if it's within your power to do so, set people deadlines for submitting their contribution, or make it a performance review objective.” It is important that the vision of the project is comprehensible. Participants need to be able to contribute to it in some way, to give them a sense of ownership, or partnership during the realization, of that vision.

The city Coral Gables, dubbed "The City Beautiful', was developed by George Merrick during the Florida land boom of the 1920s. The city is in the Miami Metro area, located about eight miles southwest of downtown Miami. The city's architecture is almost entirely Mediterranean Revival Style and is home to the famous Biltmore Estate. Today Coral Gables is a major employment center comprised of local and international business. Coral Gables is especially desirable to businesses because of its proximity to Miami International Airport, downtown Miami, and the Port of Miami. The city sees many high-end leisure and corporate travelers and has more than 100 cafes and restaurants. As the city has grown so has government business. Coral Gables is the 61st largest city in Florida with a population of 48,4850 but has declined at a rate of -0.86% annually. Overall, the city has seen a 4.42% increase since the 2010 census.

Disasters are an ongoing threat to the operational stability of a business. It is the reality of companies today who realize that they must be able to maintain a steady flow of production before, during, and after an event occurs. If they fail to plan ahead of a particularly disruptive event, they could end up as the victim of any number of outcomes that could negatively impact them over a period of time. Immediate impacts include loss of life, loss of tax revenue, loss of PHI (Protected Health Information), disrupted supply chains, property damage (e.g., buildings, equipment, etc.), and communication failures. Most of which, if they exist too long, become long-term impacts that stay with a company throughout a significant duration of its lifespan. Unfortunately, small businesses would have a hard time surviving the aftermath of a disaster. To combat these scenarios, a business would need to develop a contingency/disaster recovery plan that is supported by a technology solution.

Data backup can be the easiest and most cost-effective way for an organization to at least save and protect data that is vital to the organization. Data should be backed up on a platform that is removed from production and kept offsite and as current as possible. Businesses can back up data using tapes, cartridges, and large-capacity USB drives with integrated data backup software. Data should be backed up as frequently as an organization feels necessary to minimize data loss. Backups should be kept in the same secure environment as the original data. In this scenario, a business may not be able to continue right away. Depending on the type of disaster servers may have to be reloaded with a new operating system, software installed, and data restored from backup. In the worst case where equipment has been destroyed this may not be possible, but an organization will still have its data.

Having your production system offsite and in the cloud offers a much better chance for an organization to recover almost immediately. This also adds greater protection from viruses or malware by separating production data from local workstations. Employees may be able to continue work remotely in a very short amount of time even if there is not a building to return to. This may require companies to invest in equipment that can be used remotely or implement a BYOD (Bring Your Own Device) policy where workers would be able to use their own device when connecting to the organization's production system.

CG is looking into a cloud-based services solution that will make the relocation process of its IT infrastructure smooth to execute, whenever necessary. It's a hyperconverged infrastructure system that combines computation, storage, networking, and cloud management into a single server-based instance. Through research, CG has discovered that Microsoft has been steadily advancing its services to help make the path of digital transformation easy to venture. One of those services is referred to as Azure. Azure has many features that provide users of its Azure portal with migration and recovery options. Specifically, Agrawal (2019) lists Azure Migrate and Azure Site Recovery.

Figure 1. Azure Migrate Assessment Process. (Bangera, 2018).

Figure 2. Azure Site Recovery Setup. (Microsoft, n.d.).

Azure Migrate assists businesses that want to migrate to Azure. The service performs an assessment of the data kept onsite before migrating them to the Azure SQL Database or Managed Instance. During the assessment phase the readiness, sizing, cost, and dependencies of the environment that is to be replicated are made. Azure Site Recovery (ASR) is a Disaster Recovery as a Service (DRaaS) that offers a method of data replication that maintains constant sync between locations (e.g., Site 1, Site 2, etc.). CG will have to download/install an ASR provider on an Azure Stack HCI OS node, which has been deployed to the servers that will be clustered. Workloads that can be replicated include both physical and virtual machines. ASR ensures that the business of, for example, CG will remain operational during a disruption (e.g., outages).

In his cloud and cybersecurity blog, Nemnom (2021) applied the ASR strategy to a disaster recovery scenario. You duplicate machines to Azure regularly for disaster recovery. You can fail the machines over from the primary Azure site to the secondary Azure site and access them from there if there is an outage on-premises or in one of the Azure datacenters. You can failback once the primary site is operational again. The following is an overview of Microsoft Azure:

· Features:

·

· Build websites with ASP.NET, PHP or Node.js

· Deploy and run Windows Server and Linux virtual machine

· Migrate applications and infrastructure

· SQL Database

· Caching

· CDN

· Virtual Network

· Mobile Services

· Cloud Services

· Business Analytics

· Hadoop

· Media Services

·

· Technical Details:

·

· Devices Supported

· Windows

· Linux

· Deployment

· On-Premise

· Language Support

· English

· Pricing Model

· Free

· Quote-based

· Customer Types

· Small Business

· Large Enterprises

· Medium Business

Given the previously stated details of Microsoft Azure, we recommend that CG should consider two of Azure top competitors, Mule ESB (MuleSoft Anypoint Platform) and Freshservices, as alternative solutions.

MuleSoft ESB is an enterprise service bus developed by MuleSoft (MuleSoft, n.d.). Its first stable release was July 22, 2019. Even though its software is java-based, it can communicate with other platforms (e.g., NET). Mule has four high availability options: Cold Standby, Warm Standby, Hot Standby – Active-Passive, and Active-Active. Freshservices is a management tool developed by Freshworks. It was founded in 2017 and is currently being used as a cloud-based SaaS. Freshsevice assists IT departments with the management of incidents and assets.

The diagrams below represent the disaster recovery process of Mule ESB and Freshservice.

Figure 3. Mule’s zero downtime deployment model. (MuleSoft, n.d.)

Figure 4. Freshservice's default process for its attachments and disaster recovery (DR) bucket. (G, 2020).

The following is a comparison analysis (i.e., the similarities and differences) between Mule ESB and Freshservice:

Similarities :

· Pricing Plans:

· Free Trial

· Quote-based

· Features:

· SLA Management/Monitoring

· Supported Languages:

· English

· Supported Devices:

· Windows and Mac.

Differences :

· Pricing Plans:

· Freshservice:

· Monthly Payment

· Annual Subscription

· Features:

· Freshservice:

· Automation Tools

· Custom SSL

· Priority Matrix

· Mule ESB:

· API Deployment Flexibility

· Edge Gateways

· Tokenization

· Supported Devices:

· Freshservice:

· Linux, Android, iPhone/IPad, and Web-based.

We recommend Freshservice. According to Finances Online (n.d.), both services have a user satisfaction score above 95%; Freshservice 97% and Mule ESB 99%. However, Freshservice has a high 9.4 SmartScore, compared to Mule ESB’s 8.5 SmartScore. Real-time analysis of user reviews suggests that Freshservice is the better option, based on three factors (G2, n.d.):

· Requirements/Needs were met.

· The platform is well-supported.

· Updates/Roadmaps are better.

The business impact analysis (BIA) serves as an examination of operational components; a process that works to develop plans/strategies that expose weaknesses and minimize risks. Such risks are revealed through the connections between all of the operational components of an organization. The risk itself being the reliance they may have on each other throughout its infrastructure. The BIA would help identify essential components and determine how funds should be allocated, based on the severity of the impact the failure of a component may have company-wide. Some of the areas the BIA would focus on are matters of safety, finances, marketing, business reputation, legal compliance, quality assurance, and IT resiliency (ITSMO, n.d.). During a current/ongoing disaster, the BIA would assess and put into action a recovery strategy that, per its recommendations, prioritizes crucial points of impact whilst making efficient use of both resources and time. There are four types of BIAs of note that serve as guidelines: Initial, Product and Service, Process, and Activity. Typically, the steps include (Smartsheet, n.d.):

1. Gather Information. During this phase, you would form a team and define the BIAs objectives and scope. The type of information/metrics relevant to this phase is the name of processes, users, maximum allowable downtime, financial/operational impact, regulatory/legal/compliance impact, and historical data.

2. Analyze Information. During this phase you would:

1.

2. Determine the Resource and Process Interdependencies

3. Identify the Resource Requirements for Optimal Operation

4. Determine the Impact of Disruption

5. Prioritize Business Functions

6. Estimate the Time and Resources Needed to Recover

7. Set Parameters

8. Identify the Vulnerabilities, Ways to Minimize Impact, and Recovery Strategies

3.

4. Document Your Findings. This phase involves the composition of the BIA report (i.e., exploratory and planning components). The BIA report includes:

1.

2. Executive summary

3. Objectives and scope

4. Description of methodologies

5. Detailed discussion of findings

6. Recommendations

7. Supporting documents

5.

6. Present Your Findings. At this point, the BIA team presents its findings to senior management.

The BIA uses the information gained from interviews, descriptions, and reports to help (e.g., the CPC) assign tiers of criticality to each IT system within the organization. The criticality tier is based on the recovery time objective (RTO), as well as the feasibility of the downtime procedures that would need to become standardized over time. Standardization helps to ensure that the security policies set in place by an organization remain consistent throughout the business, as it establishes/reinforces rules (i.e., passwords must be complex and/or use a certain type of encryption to protect them) that are used during the implementation of hardware and/or software. The following is an example of how CG would assign and define their tiers of criticality (ITSMO, n.d.):

·

· Tier 0: CGs IT infrastructure requires multiple data centers to be able to serve production without manual intervention.

· RTO: 15 minutes

· Tier 1: Critical systems are needed to help make immediate decisions (e.g., for diagnostics, documentation, etc.). 

· RTO: 6 hours

· Tier 2: Critical systems can rely on the manual operation of business processes for up to 1 day.

· RTO: 24 hours

· Tier 3: Critical systems can remain unavailable for at most 3 to 5 days.

· RTO: Up to 5 days

· Tier 4: Critical systems are barely impacted and the functions that they provide can be manually operated until the system is available.

· RTO: 30 days

With cloud technology, a business's contingency plan would take into consideration essential elements such as contingency triggers, data recovery tools, and methods for data migration and restoration. And just like every organization that has gone public, they must comply with the Sarbanes-Oxley Act (SOX). The requirements (e.g., internal/external audits, data retention, etc.) an organization will need to meet to remain compliant with SOX fits perfectly well with the benefits of a contingency plan (Bruno, n.d.):

·

· Minimize risk of loss

· Avoid litigation and the courts

· Time to migrate to a new solution

· Satisfies governance, risk, and compliance policy

· Allows focus on the vendor deliverables and benefits of SaaS

As for the cloud compliance adoption, itself? Companies interested in SaaS platforms often gravitate towards cloud service providers who will give them access to automation tools to help them monitor their processes, as well as secure their data. However, a company may hesitate to adopt cloud compliance standards for many reasons. The top concern a company might have is the geographical location of where its data would be stored. Or to be more specific, the data protection and privacy legislation of a state and/or country. As of now, 132 (out of 194) countries have protections in place that safeguard and restrict access to private information, but how it is practiced/enforced may differ between each of them (UNCTAD, n.d.). Rodrigues (2013) stresses that it is important to understand current legislation and how it applies "to your particular company, which may vary with the states where you do business, the type of data you handle, and even the service or product you are providing, are all fundamental steps for a successful move to the cloud."

CG’s move to a cloud-based model is a necessity as opposed to their current on-premised based model. Easy data backup and disaster recovery is CG’s top priority. Within the cloud environment all server-based infrastructure is located off-site. This allows business to continue during a disaster as long as the user has an internet connection. Data redundancy is also provided by the cloud service. A strong indication that cloud computing security is more reliable than some perceive it to be is the report that over 93% of businesses that moved to the cloud now have better data security. Local IT will manage any security threats that occur with their local network. The clear separation from the building can provide protection to CG’s data from virus or malware attack. The cloud is flexible in providing mass storage for the organization. Aside from cutting hardware costs this also helps employees work together efficiently no matter where they are based. Access from a computer, smart phone, or tablet offers a convenience not seen while CG is hosting their own environment. This will increase productivity and ease of use across the entire organization. CG realizes cloud-based computing is the future of smart and safe business practice.