Common Systems Group (CSG)
Meeting Summary
Tuesday, September 25, 2007

CSG Attendees: Sue Abeles, Julie Austin, Ross Bollens, Mark Bower (on behalf of Mike Schilling), Jim Davis, Steve Duim, Jackson Jeng, Bill Jepson, Carol King, Max Kopelevich, Michelle Lew, Kathleen O’Kane, Sean Pine, Tom Phelan, Nick Reddingius, Terry Ryan, David Snow, Mike Van Norman, Kent Wada, Don Worth

Guests: Julio Feliciano, Karen Melick, Margo Reveil, Karen Ribback

The meeting was called to order at 2:09 p.m.

Agenda Item 1: Update on disaster recovery work and proposal to CITI

(Don Worth, Jack Ewart, Karen Melick).

Karen Melick gave a brief overview of the Disaster Recovery Expansion proposal to CITI, and the project’s current status. After much risk assessment, business impact analysis, and current recoverability assessment, they have currently finished their engagement with IBM to look at different strategies and ways to go about implementation and plan development. Copies of the project’s Powerpoint slides were distributed to the CSG as Karen explained each slide.

UCLA conducted a Business Impact Analysis (BIA) to identify and prioritize its business processes and applications with the goal to balance potential risks and impacts of a disaster against the costs of mitigating efforts.

There are 15 functional areas that they have been covering:

Karen discussed the 5 different Tiers for Recovery Time Objectives:

  • Tier 5-Recovery in greater than 14 days

    • Karen explained that a part of business analysis is looking at financial impacts. However, an important factor that is overlooked is the severe increase in intangible impacts over the course of time. Intangible impacts (i.e. loss of research and education quality) are extremely damaging since time and valuable information can never be recovered.

    Karen gave a summary of the Recoverability Assessments and pointed out that our current plans won’t meet the Recovery Time Objectives for the following reasons:

    Karen went over the Recovery Strategy Development plan. There are two location options to consider—either going to a vendor site or to a UC system site, which makes more sense. Three recovery methods are under consideration: tape restoration, warm mirroring, and hot mirroring. Tape restoration would take too long, warm mirroring is not in production, and hot mirroring is in the production mix but is not running.

    Some recommendations included:

    Karen went over the next steps in Recovery Strategy. Currently, they have a contract with IBM in which a yearly test is conducted to bring up the recovery level, but there is a problem getting the test to run within 24 hours. IBM is recommending a solution that does not meet their requirements. As a result, they are continuing to work with IBM to redo the final results and recommendations for that study as well as finishing IBM strategy plans and options to provide quick shipping options with vendors to allow for acquisition of hardware in 48 hours. There will be an executive presentation of IBM on October 11th to get approval for Phase 1. Phase 1 will establish the infrastructure to carry plans out at UC Berkeley because they have the people and resources at hand. There will be a sanity check to review all Tiers and RTO’s for applications. After analyzing cost estimates, recommendations will be made for management approval and funding. Finally, implementation plans will be developed.

    The project Cost Estimates that Karen and Jack concluded were as follows:

    The last slide is an evaluation of the project’s standing to the score criteria for disaster recovery.

    Project Justifications:

    1. Strategic impact- without disaster recovery in place, many campus functions will not be operable in the event of a disaster (i.e. if data center is destroyed by a fire)
    2. Compliance Requirements- UCOP IS-12 Continuity Planning and Disaster Recovery
    3. User Impact- most students, faculty and staff are affected by this project.
    4. Workload impact- there is incremental work to implement and test disaster recovery plans but by coordinating them across campus, workload and money is saved.
    5. Financial Impact- The IBM BIA study estimated a 14 day outage would cost approximately $15 million and a 30 day outage would be over $35 million.

    Don Worth mentioned Berkeley’s emergency website and people locator application that was implemented as a solution to losses in a disaster. UC’s have started to mirror their mainframes on each other’s sites. A lot of these proposals have been discussed on their UC web pages as well.

    There was a consensus from the CSG that Disaster Recovery remains an important issue that is broader than just an IT perspective. Specific to research, years of data can be destroyed instantaneously. Tools, resources, and convenience must be provided as a solution to back up such data.

    Bill Jepson suggested that there be specific numbers to identify the differences in potential costs, both monetary and intangible between various tiers so that appropriate decisions can be made. Karen will be continuing to get more information from IBM.

    Agenda Item 2: Cell phone policy changes being examined due to IRS requirements on employee cell phone usage.

    Don Worth briefly summarized the situation that UCLA is facing with the new IRS regulations governing cell phones. The IRS is viewing personal usages of employer-provided cell phones as compensation. As a result, the IRS wants to collect income taxes from these employees regardless of whether the percentage of personal usage is large or not. Don emphasized the significance of the matter as a nationwide issue for UC systems, and UCLA is still undecided over which options to take in revising our policies.

    Kent Wada provided background information regarding the payroll tax audit currently underway at UCLA. The IRS has proposed a tax assessment related to the personal use of cell phones furnished by the University to its employees. In addition to paying the tax assessment, the University must agree to change its policy to bring it into compliance with regulations governing employer-provided cell phones, effective January 1, 2008, or they will be liable for tax penalties. Certain conditions must be met in order for the payment to be excluded from the employee’s gross income. If a cell phone is provided by an employer as a working condition fringe benefit, the taxpayer must document all calls.

    The issue of conflict is between University owned devices and personal usage—trying to preserve only having a single device instead of all 3. Kent discussed the recommendations from the campus controllers for revising the Business and Finance Bulletin G-46 (Guidelines for the Purchase and Use of Cellular Phones and Other Portable Electronic Resources), to provide for a taxable cash allowance that would be used by employees to purchase a cell for use in conducting University Business. Since the allowance would be treated as wages, employers would not have to account for the use of the funds other than demonstrating that they have purchased a cell phone—eliminating the burden.

    There are two options that cell phone allowances could be calculated under; only one selection will be adopted for all employees:

    Option 1: Standard allowances inclusive of all charges with the plan level, including an estimate for employee taxes, would be offered based on the expected level of business minutes needed by the employee.

    Option 2: Cell phone allowances would be calculated individually for each employee based on the cost of his or her plan and marginal income tax rate.

    In addition, two alternative proposals were considered but were deemed too burdensome:

    1. UC-provided Cell Phone-Under this proposal, each employee is required to review the phone bill each month, highlight any personal calls, and reimburse the employer for the cost.
    2. Reimbursement for Business Use of Personal Cell Phone- Under this proposal, employees would be required to document and provide explanations for each business call in order to receive a reimbursement.

    The CSG came to a consensus that a detail draft of the rules should be made so that everyone can give input over the matter.

    Kent advised the CSG to contact Sue Abeles for questions, concerns, or input. In addition, Steve Duim advised that questions or comments about the proposed revision to the Cell Phone Policy should be sent directly to Phebe Arlen by 5 p.m. Friday, September 28th.

    3. UCOP initiative on accessibility. A new system-wide policy on the accessibility of technology, first focusing on web sites, is being proposed, with an informal comment period in effect until October 26.

    Margo Reveil provided background information about the University policy on accessibility in the electronic environment. The University must ensure that its services, programs, and informational materials are made accessible to all individuals including those with disabilities. Presently, UCOP is offering recommendations on various resources and tools on their website for web developers.

    UCOP’s Associate Vice President of Information Resources and Communications, Kristine Hafner, launched an initiative that establishes a University-wide policy which sets forth guidelines for web developers to ensure that IT resources meet the University standards. The Electronic Policy Review group was convened to comment, review, and guide the development of the proposed policy.

    This initial draft:

    However, there are still a lot of grey areas, and questions that arise:

    The implications of the policy and its affects on web-developers, faculty, and users are significant. There was consensus that the initiative needs further specifics and guidance so that appropriate measures can be taken. Currently, the immediate steps needed to be taken are:

    1. Spreading awareness by holding training sessions to inform people about the various tools and resources available to comply with the University of California standards.
    2. Formation of an oversight committee so that we can revise our policies and procedures before the UC will be held liable for noncompliance.
    3. Looking at major UC websites; URSA, MYUCLA

    The DCP can help students access materials off the web, but there is not enough time or funding in order to do this for everyone.

    Margo encourages everyone to send feedback or any comments regarding this draft as soon as possible so that appropriate changes can be made.

    4. Security audits update and start-up plan.

    Ross Bollens gave an update on security audits and the start-up plan regarding this matter.

    5. Data center proposal overview.

    Bill Labate gave an overview of the Data Center proposal made to CITI. Right now there is not enough data storage space for the amount of data that we have, which is increasing at an alarming rate. A group inclusive of OIT, AIS, and Medical Enterprise was put together to evaluate the data gathered from different data centers around campus. The results were shocking because the university will run out of data space in about a year. A proposal was made to CITI to bring in consultants to analyze the situation and resolve the big underlying question: whether to go to an outside source to store data, or should we construct more data storage space within UCLA. This process would take about 4 months to finish, and an additional 2 years to complete the construction.

    Currently, they are looking at the amount of power we have and the rate at which this power is being utilized. They will be giving CITI some estimates on October 9th; the costs to launch this proposal could amount up to 30 million dollars. However, there still remain several questions as to how we go about these revisions. At a UC level, there is limited space. We must also look at how we can improve these numbers by aggregating the resources and increasing the utility rate.

    Jim Davis notes that on Thursday, they will be looking into different data storage facilities outside of the campus.