Business Continuity Planning

Phase II: *Business Impact Analysis* (BIA)

- A *functional analysis* that identifies the impacts should an outage occur. - Sets the stage for determining a business-oriented judgment concerning the appropriation of resources for recovery planning efforts.

Types of Plan Testing Strategies

1. Checklist 2. Structured Walk-Through 3. Simulation 4. Parallel 5. Full Interruption

Business Continuity Management

A *framework* for: - reviewing the way an organization provides its products and services. - building resilience and the capability for an effective response which creates safeguards.

Phase III: *Recovery Strategies*

A set of *pre-defined* and management *approved* actions that will be followed and implemented in response to a business interruption.

Phase IV: *Plan Design and Development*

In this phase the team *prepares* and *documents* a detailed plan for recovery of critical business systems.

Recovery Strategies Key Element

Key element is to base it on the *recovery time* for mission critical business systems -- as outlined in the Business Impact Analysis.

BCP Document

The final aspect of this phase is to combine all of the various steps into the organization's BCP. This plan should then be interfaced with the organization's other emergency plans.

Business Continuity Planning (BCP)

- Addresses the *preservation* and *recovery* of the business in the event of outages to normal business operations. - An approved set of advanced *arrangements* and *procedures*.

Operational Recovery

- Determine the necessary equipment and data configurations. - Outline alternative strategies for technical capabilities, such as network infrastructure components.

Phase I: *Project Management and Initiation*

- Establish the *need* for a BCP: • Perform a focused risk analysis to identify and document potential outages - Establish the project management work plan.

User Recovery

- Focus is on personnel requirements. - Provide certain procedures for employees to follow during the outage.

Project Plan

- Identify and develop business continuity plan phases similar to traditional project plan phases. - Establish business continuity plan project characteristics.

Phase V: *Plan Testing*

- Plans for testing and maintaining the BCP are implemented and also awareness and training procedures are executed - Ensures that the business continuity capability remains effective, regardless of the disaster.

BCP Scope

-Personnel -Facilities -Infrastructure -Support systems -Information systems

Categories of Recovery Strategies

1. Business Recovery 2. Facility and Supply 3. User 4. Operational 5. Data

Facility and Supply Recovery

Focus is on *restoration* and *recovery*

Business Recovery

Focus is on the *critical resources* and the maximum tolerable downtime for each business/support unit system.

Software and Data Recovery

Focus is on the recovery of information - the data.

Damage Assessment

If the time estimated to resume operations exceeds the *Maximum Tolerable Downtime* (MTD) for critical business functions, then management should consider declaring a disaster and implementing the BCP.

Restoration Actions

Involve restoring the primary site to normal operation conditions.

Disaster

Something that *interrupts* normal business process.