Effective Continuity Planning 1

1
Business Continuity PlanningLifecycle
2
What is Business Continuity Planning?

• Business Continuity Planning is a suite of
  processes followed to ensure that an organization
  does not experience unacceptable interruptions in
  any of its essential operations

3
Why do you need to do it?

• The changing threat environment has dramatically
  highlighted the need for organizations to enhance
  their capabilities for continuing essential
  functions no matter what

4
Business Continuity Planning Life Cycle
Risk Assessment

• Assess potential for business interruption due
  to
• Loss of facilities
• Loss of computer systems
• Loss of data
• Loss of communications
• Loss of key personnel, etc.

5
Business Continuity Planning Life Cycle
Risk Assessment
Business Impact Analysis

• Identify time-dependent impacts of business
  interruption, such as
• Loss of revenue
• Loss of market share
• Loss of reputation
• Loss of productivity
• Regulatory non-compliance, etc.

6
Business Continuity Planning Life Cycle
Risk Assessment
Business Impact Analysis
Continuity Strategy Selection

• Select and implement appropriate strategies for
• Reducing risks
• Mitigating impacts
• Recovering systems and data
• Resuming business

7
Business Continuity Planning Life Cycle
Risk Assessment
Business Impact Analysis
Continuity Strategy Selection
Computer Recovery Plan Development

• Develop plans for recovering essential systems,
  which address
• Alternate data center facilities
• Computer hardware replacement
• Software and data recovery
• System connectivity
• Physical and logical security, etc.

8
Business Continuity Planning Life Cycle
Risk Assessment
Business Impact Analysis
Continuity Strategy Selection
Computer Recovery Plan Development
Operations Resumption Plan Development

• Develop plans for resuming essential functions,
  which include
• Resource requirements definition
• Team member contact info.
• Activity lists
• Detailed activity documentation
• Off-site materials list, etc.

9
Business Continuity Planning Life Cycle

• Establish a BC team structure consisting of
• an Incident Management Team
• Response Teams
• Business Unit Teams
• IT Teams
• Support Teams

Establish BC Teams
10
Business Continuity Planning Life Cycle

• Develop a framework for managing a crisis,
  including
• Emergency response procedures
• Communication procedures
• Decision-making criteria
• Executive succession
• HR policies, etc.

Establish BC Teams
Implement Incident Management Framework
11
Business Continuity Planning Life Cycle

• Establish processes for testing plans and
  exercising teams such as
• Desk checks, peer reviews
• Structured walkthroughs
• Call tree tests, operational tests
• Table top and simulation exercises
• Operational exercises
• Drills, mock disasters

Establish BC Teams
Implement Incident Management Framework
Testing and Exercising
12
Business Continuity Planning Life Cycle

• Establish an on-going program for
• Training BC planners and BC teams
• Maintaining employee and management awareness

Establish BC Teams
Implement Incident Management Framework
Testing and Exercising
Training and Awareness
13
Business Continuity Planning Life Cycle

• Establish on-going processes for
• Updating plan contents
• Distributing plan updates
• Controlling plan access
• Evaluating plan effectiveness
• Auditing BCP processes
• Maintaining contracts, etc.

Establish BC Teams
Implement Incident Management Framework
Testing and Exercising
Training and Awareness
Maintenance and Evaluation
14
Business Continuity Planning Life Cycle
Program Management
Risk Assessment
Business Impact Analysis
Continuity Strategy Selection
Computer Recovery Plan Development
Operations Resumption Plan Development

• Establish a permanent framework for managing the
  on-going program
• Issue policies and standards
• Assign accountability
• Create a steering committee
• Set annual budgets and objectives
• Monitor and enforce compliance

Establish BC Teams
Implement Incident Management Framework
Testing and Exercising
Training and Awareness
Maintenance and Evaluation
15
Summary

• Business Continuity Planning is not just a
  one-time event
• It is only one aspect of an on-going program to
  manage risk and maintain an organizations
  ability to withstand potentially disastrous
  incidents
• As such, it requires
• permanent management commitment,
• the assignment of accountability,
• establishment of an annual budget, and
• the provision of adequate resources