For the French power company EDF, the efficiency and reliability of its Business Continuity (BC) and Disaster Recovery (DR) plans, as well as the technology on which they are based, go far beyond the organization – they cover the functioning of the country itself .
In this article, we look at how EDF is building its BC / DR service across the organization to cover potential disruptions in its data centers, cyberattacks, and even the likelihood of major floods around Paris once a century. In other words, all the risks identified by the IT department.
To fulfill its DR plans, EDF has developed an application dedicated to the work it calls Phenix-IT. “We needed a tool to manage the disaster recovery plan at the data center,” he said Bruno LeirisHead of IT BC / DR and Crisis Management at EDF.
But Phenix-IT’s goal is twofold. First, it is an operational tool that works in real time when it is a data center DR plan is activated. Second, it is also used daily to manage and generate reports to the management of EDF and its business lines.
Leyris emphasizes the role of Phenix-IT in testing and improving the delivery of BC / DR. “We use Phenix-IT regularly during our annual exercises,” he says. “Every year we simulate the destruction of data centers and monitor the recovery through Phenix-IT.
“Within the framework provided by these exercises, we generate reports and graphs and communicate the findings using reliable tools in the group’s crisis management organization.”
In addition to this operational role during crisis management, Phenix-IT collects data related to these exercises. The analysis of these data contributes to improvements in crisis management and the recovery plan.
Phenix-IT: An increasingly rich and sophisticated application
Since its launch 12 years ago, Phenix-IT has evolved tremendously, with many functional areas added to the original application in collaboration with the software vendor. mega. Among the most significant additions during Phenix-IT’s lifetime is the introduction of workflows between key players in crisis management and secure communications, which alert members of crisis teams.
These tools allow effective decision-making by sharing information 24/7. Providing them is essential because if the crisis is caused by a cyber attack, it is important that attackers cannot listen.
Reporting on Phenix-IT has been a particular focus of development in recent years. During each disaster, the software provides graphs for forecasting. It is also integrated with shock simulation functionality, which allows IT teams to test the resilience of the system via Phenix-IT.
In addition to the key role that Phenix-IT plays during crisis simulations, it is also used by IT on a daily basis and has become a standard for the EDF Group.
“Apart from its disaster recovery, impact simulation and secure communications functionality, Phenix-IT has become a vital standard in IT,” says Leyris. “It is available from security officers to gather information and test the resilience of IT systems in quiet times.”
Modernization of Mega Hopex
Phenix-IT is developed on an outdated version of the Mega platform, which is becoming more expensive to support. So, a project to update it was recently launched. After analysis, it was decided to continue with Mega, but to migrate to the Hopex platformwhich is dedicated to management, risk and compliance management.
“This solution has opened up new opportunities for us, while ensuring continuity in our approach,” says Lairis. “And we also went back to the standards we deviated from.”
EDF’s Director of Information Technology is gradually implementing a flexible Mega mode of operation. EDF project managers, developers and sales departments were involved. “Phenix-IT is already in its ninth year of development,” says Leiris. “Many people have been involved in the project, but have always made sure to understand the goals and added value that EDF expects from software during disasters as well as in normal operation.”
The project team produces two main versions per year and they are very limited in terms of deadlines they have to meet. Each basic version must be completed before each exercise.
“Every six months we have a basic version of Phenix-IT for our disaster recovery exercises,” says Leiris. “This is a time and quality limitation because we can’t make Phenix-IT crash during exercise.”
Agile organization allows continuous improvements in Phenix-IT. Outside of DR drilling times, EDF crisis managers are connected through the analysis tool, including between IT and business.
The number of sites is growing by 10% per year
A major challenge for Phenix-IT and the DR plan is the growth – by 10% each year – of elements to be tracked in EDF’s IT systems. The software must constantly integrate data from new sources and this leads to further work on the quality of the data absorbed by Hopex. The increase in raw data and the new functionality that accompanies the growth affect the plan in terms of capacity and availability of the platform.
EDF wants to continue to develop the platform, with the main idea increasingly integrating Phenix-IT with crisis management processes.
“We want to work on ergonomics to make software more intuitive,” says Lairis. “Someone awakened in the middle of the night during a disaster needs an intuitive tool.”
Also, Phenix-IT needs to be improved to make it easier for the business continuity team to work in the event of a ransomware attack.
Phenix-IT is currently running on Hopex v3, but the project team is investigating a possible migration to v5 and is releasing new functionality in this version to work.