The document outlines the scope of an IT infrastructure review project, including assessing critical systems, data center operations, and governance processes. It defines service level objectives for system availability and recovery times. The review aims to improve resiliency, address single points of failure, and enhance disaster recovery capabilities to better support business needs.

1. Items
a. Infrastructure and Application Overview
b. Service Levels and Recovery Time Objectives
c. Confirmation of scope, key requirements and deliverables

2. IT Infrastructure Architecture
Head Office
Data Center Backup Site
Infrastructure Review
 To increase system resiliency for critical systems availability
 To ensure no single-point-of-failure in end-to-end
infrastructure components
 To enhance data center operations and processes
 To raise the level of IT preparedness in normal and crisis
situations

3. Maximum Tolerable Downtime (MTD)
Definition of Maximum Tolerable Downtime (MTD), Recovery Time Objective (RTO) and Recovery Point Objective (RPO)
RTO - Timeframe required for IT systems
and applications to be recovered and
operationally ready to support business
functions after an outage
MTD - Timeframe during which a recovery must become effective before an outage compromises the ability of the
organisation to achieve its objectives and / or to survive
Definition of Maximum Tolerable Downtime (MTD) and Recovery Time Objective (RTO)
 ISO22301 Definition of RTO - The term recovery time objective refers to a time period. It is the maximum amount of
time allowed to resume an activity, recover resources, or provide products and services after a disruptive
incident occurs. This target time period must be short enough to ensure that adverse impacts do not become
unacceptable.
 ISO’s definition of RTO above relates to BNM’s existing definition of MTD.
Assessment and mobilisation
Backlog
Resume
operationsRecovery
30 min 15 min 15 min 1 hour
Disaster
Data preparation and verifying
data readiness
30 min
assessment
movement
declaration
escalation

4. System Availability (SA) Formula:
1 – [downtime (in minutes)] x 100
[ (A x B) x 60 minutes ]
Note :
A – Operating Business Hour
B – Number of Working Days per Year
1.5 hour
Assessment and mobilisation
Backlog
Activation of Disaster Recovery System [RTO]
Maximum Tolerable Downtime (MTD) – 4 hours
Definition of Maximum Tolerable Downtime (MTD), Recovery Time Objective (RTO) and Recovery Point Objective (RPO)
Resume
operationsRecovery
30 min 15 min 15 min 1 hour
MTD and RTO In The Context of Critical Apps And Its SLA
Unable to
logon to
system
No System MTD RTO RPO SA
1 Application X 2 hrs* 1 hr** 0 hr 99.95%#
* Maximum Tolerable Downtime is 2 hours
** Recovery Time Objective revised from 1.5 hours to 1 hour
# System availability revised from 99.9% to 99.95% but excludes network connectivity. Calculation
is performed cumulatively throughout the year based on business hours
Data preparation and verifying
data readiness
30 min
SA
Annual Maximum
Downtime
99.99% 3 hours 56 minutes
99.95% 1 hour 36 minutes
99.9% 15 minutes
Moving Forward
Troubleshootingand
assessmentbyteam
Movementofoperations
andtechnicalstaffto
backupsite
Declarationofdisasterand
decisiontoswing
Escalationtomanagement
andstakeholders

5. Advanced Analytics
Social Collaboration
Expanded Mobility
Cloud-Hosted Services
Five primary areas
to support
the following objectives:
 Improve internal organizational
work efficiencies and service
turnaround time
 Provide new opportunities for
streamlining, automation and
creation of innovative technology
services for work productivity
 Assessment of relevant cloud-hosted services in
order to leverage on potential benefits of
technology resources that are scalable “on-
demand”
 Innovative services for
corporate networking and
fostering greater
collaboration
 Opportunity to tap on the
insights of community of
subject matter experts
through online group forum
and discussions
 Holistic IT security
management and
establishment of new
technology control
measures in view of
emerging threats/risks
 Tools to facilitate
information gathering,
consolidation and analysis
to support business
decision making
 Proactive alert and
information feeds to
specific user groups
 Enabling expanded
mobile access to a
portfolio of generic IT
services and specific
business applications
 Ease of accessibility
anytime, anywhere, via
designated types of
computing/ mobile
devices
Vigilant
Security
Management
Emerging Technology – Focus Areas
3
1
4
5
2

6. Key Deliverables
IT INFRASTRUCTURE EMERGING TECHNOLOGIES1 2
To enable the company to be in a strategic positioning
to adapt and adopt new or emerging technologies on a
timely basis
To address current gaps and recommend improvement measures to the
existing technology infrastructure, and to propose a holistic IT
architecture blueprint moving forward
To assess the existing governance process and maturity levels and recommend improvements
a. Perform current state assessment and gap analysis on the critical
IT systems architecture and services, including data center
infrastructure operations review
b. Propose and project manage the implementation of solutions to
address any shortcomings to address critical applications
availability, capacity, performance and resiliency
c. Establish detailed specifications document to guide the selection
and engagement of vendors for implementation
d. Recommend strategies for IT infrastructure planning be able to
cater for Track 2 initiatives (i.e. new requirements for mobility
technologies)
e. Propose a holistic IT architecture design moving forward
a. Review existing initiatives and infrastructure
design for improved mobility and information
access via smart devices, and recommend the “To-
Be” state supporting the agenda of high
performance work environment in the company
b. Formulate IT framework, strategies and roadmap
to provide innovative and practical IT services to
facilitate work anywhere, anytime, via any device
in a secured manner
c. Recommend new initiatives for integrated
document management and collaboration
a. To provide comprehensive risk identification, assessment and governance review in managing and supporting critical systems and
the IT Infrastructure, and to cater to new requirements in view of implementation of emerging technologies
b. To enhance the maturity level of core IT processes viaindustry best practice and/or similar leading organisations
c. Establish new standards, policies and guidelines
d. To recommend a roadmap and recommendations for adoption by the company according to the five domains of the governance
framework
Coverage: IT network, servers, storage, database, BCP, data center
operations, service level agreements review, IT security, process and
compliance review, new/enhanced architecture blueprint
Coverage: IT infrastructure review to cater to the
requirements, IT policy and risk review, existing initiatives
review, roadmap and recommendations to achieve
enterprise mobility objectives
Coverage: People and Structure, IT Risk Management, Process and Control, Performance Measurement, Information and Communication
IT GOVERNANCE3

7. IT Infrastructure – Data center Components
6 Generators
3 Structured Cabling
8
Data center
Operations
and
Monitoring
7 UPS and
Batteries
1 Precision Air Cons
4 Water Leak
Detection
5 Raised Floors
2 Server Racks
9
Security and
CCTVs

8. Application Flow

9. Application: Potential Slow Down
1 Underpowered
PC
3
Misconfigured
router
6
Server hardware
needs upgrading
5
Database queries
are inefficient
7
Problematic
switch8
Printing system
is down
2
Misconfigured
firewall
4
Application logic
or platform