DR CARE

DR CARE is a continual improvement assessment process that allows for complete understanding of a unit’s ability to effectively respond to a disaster. DR CARE was adopted to break down and describe how a DR system assessment is conducted and what happens in each phase of the process. The more often the process is repeated, the more effective the DR CARE effort will be and the more resilient our organization will become.  

By completing DR system assessments, we will be able to effectively measure and monitor our recovery risk at the university and identify how prepared the university is to recover from a disaster. With DR assessments we will be able to:   

• Know what we are doing well and where we have gaps.  

• Recognize how to meet the ISCR DR controls to be better prepared. 

• Understand where the highest DR needs and risks are at the university. 

• Provide observations that will aid in increasing our resilience.   

• Provide detailed recommendations and guides to reduce the potential impacts from a disaster. 

• Aid in determining if a particular risk is critical enough to commit money and resources to manage. 

The DR Program Lead, along with DR Coordinators, will work to complete system level (application and service) DR assessments. DR Coordinators will rely on system information gathered from service owners, architects, and engineers.  

The amount of time to complete the process will depend on the complexity of the system in question. The DR CARE Assess process reviews existing documentation and processes of DR requirements in the ISCR, so the process' time is based on how long it takes to provide necessary data, answer questions, and enhance after the assessment by remediating discovered gaps. 

DR system assessments are a compliance process which allows measurement of a unit’s preparedness in accordance with the requirements of the ISCR and outlines steps to remediate gaps and mitigate risk. DR assessments look further into each requirement to ensure specifications are met and operating as required, and that information is prepared and available for use during an event. For example, an assessment will ensure criticality levels are assigned and align with a unit’s recovery and criticality expectations. In addition, the DR program will provide specific details how to mitigate any risks found. 

The DR Program team has reviewed this process with Internal Audit to align efforts and will continue to coordinate to minimize duplication of effort within a unit. Internal Audit has and will continue to review the DR Program’s plans and process to attest that the DR requirements are being met, thereby reducing and/or eliminating their need to focus on DR during audits.  

Each DR system assessment will provide a gap analysis that helps ensure recovery activities are designed to aligned with the ISCR. This will give units additional assurance that their DR processes meet industry standards (ISCR) or what is needed to further mature those processes. A proactive approach ensures the university is better protected. Additionally, units will be better prepared to respond to internal and external assurance (audit) requests and can show compliance with various regulatory requirements.   

DR CARE is NOT a Business Impact Analysis. 

DR CARE is NOT intended to assist with developing Business Continuity Plans (BCPs), and will not assess BCPs, but may utilize BCPs to assist with identifying DR risks. 

Reviewing assessment results will support the university’s readiness for disaster. The DR assessment report will be provided to the respective DR Coordinators, Security Coordinators, service owners, managers, IT leadership, and Deans/VPs. Identified risks will be tracked and shared with necessary parties.  

Systems with the highest fundamental risk will be assessed first. This will drive university discussions around what IT systems are foundational and vital to the functioning of many enterprise-wide IT systems. This will also allow us to have a stronger understanding of where our key dependencies lie.  

Under advisement from Office of Technology and Digital Innovation's Infrastructure Risk Management, Business Continuity, and the Security and Trust Advisory Board, the DR Program is working to build a prioritized list of systems for each of these systems. For FY24, we will be working to complete pilot and priority one systems.    

Learn more about our Targeted System Approach.

Yes, infrastructure, networking, and buildings will not be assessed with the DR CARE process. Our current focus is what to do for applications (cloud and on-premises). It is likely we will have a different approach for each of these areas.