Business Continuity Planning Exam With Complete Solution

Business Continuity Planning What does Business Continuity Planning address? - The preservation and recovery of the business in the event of outages to normal business operations. What is a disaster? - 1) Something that interrupts normal business process. -A sudden, unplanned calamitous event that brings about great damage or loss. -In the business environment, it is any event that creates an inability on an organization's part to support critical business functions for some predetermined period of time. Potentially Disastrous Events - -Natural (i.e,. earthquakes, storms) -System/Technical (i.e., outages, malicious code) -Supply Systems (i.e., electrical power problems) -Human-Made/Political (i.e., disgruntled employees, riots, vandalism) Defining a BCP - An approved set of advanced arrangements and procedures that enable an organization to: -Ensure the safety of people. -Minimize the amount of loss. -Facilitate the recovery of business operations to reduce the overall impact of an event, while at the same time resuming the critical business functions within a predetermined period of time. -Repair or replace the damaged facilities as soon as possible. -Traditionally, recovery plans focused on the recovery of critical computer systems running at data centers. -Today, recovery plans must also focus on the critical computer systems operating in a distributed environment involving personal computers, LANs, telecommunications, etc. -Essentially, continuity plans address every critical function of an enterprise. Requirements of Business Continuity Planning - -Provide an immediate, accurate, and measured response to emergency situations, with the overall goal of ensuring the safety of individuals. -Mitigate the damage you are experiencing as a result of the disaster. -Ensure the survivability of the business. -Provide procedures and a listing of resources to assist in the recovery process. -Identify vendors that may be needed in the recovery process and put agreements in place with selected vendors. -Avoid confusion experienced during a crisis by documenting, testing, and training plan procedures. -Clear guidance for declaring a disaster. -Provide the necessary direction to ensure the timely resumption of critical services. -Document storage, safeguarding, and retrieval procedures for critical systems and supporting functions. -Describe the actions, resources, and materials required to restore critical operations at an alternate site in the event that the primary site(s) has suffered a serious outage. -Document recovery procedures so they can be executed by knowledgeable people. Define BCP Scope - Should cover all aspects of an organization, including: -Personnel -Facilities -Infrastructure -Support systems -Information systems Define Business Continuity Management - -A strategic and operational framework to review the way an organization provides its products and services while increasing its resilience to disruption, interruption or loss. -Provides a framework for building resilience and the capability for an effective response which safeguards the interests of a company's key stakeholders, reputation, brand and value creating activities. Phase I: Project Management and Initiation - 1) Establish the need for a BCP. -Perform a focused risk analysis to identify and document potential outages to critical systems. 2)Obtain management support. 3)Identify strategic internal and external resources to ensure that BCP matches overall business and technology plans. 4)Establish the project management work plan that includes the: -Scope of the project -Identification of objectives -Determination of methods for organizing and managing development of the BCP -Identification of related tasks and responsibilities -Scheduling of formal meetings and task completion dates 5)Determine the need for automated data collection tools, including plans to provide training on how to use the software. 6)Establish members of the BCP team, both technical and functional representatives. 7)Prepare and present an initial report to management on how the BCP will meet the objectives. What does a BCP Planner/Coordinator do? - -Ensures that all elements of the plan are thoroughly addressed and an appropriate level of planning, preparation, and training have been accomplished. -Serves as leader for the development team. -Has direct access and authority to interact with all employees necessary to complete the plans. -Is in a position within the organization to balance the needs of the organization with the needs of the individual business units that may be affected. -Has knowledge of the business to be able to understand how a disaster can affect the organization. -Has easy access to management. -Is able to review the charter, mission statement, and executive viewpoint. -Has the credibility and ability to influence senior management when decisions need to be made. Define Team Members - Representatives also include, but are not limited to: -Senior Management, Chief Financial Officer, etc. -Legal Staff -Business Unit/Functions -Support Systems -Recovery Team Leaders -Information Security Department -Data Communications Department -Communications Department The same people who would be responsible for executing the plan in the event of an outage, must also be involved in preparing the BCP. Define Project Plan - 1)Identify and develop business continuity plan phases similar to traditional project plan phases. -Including problem investigation, problem definition, feasibility study, systems description, implementation, installation, and evaluation. 2)Establish business continuity plan project characteristics. -Such as goals/objectives, tasks, resources (personnel, financial), time schedules, budget estimates, and critical success factors Phase II: Business Impact Analysis (BIA) - A functional analysis that identifies the impacts should an outage occur. Impact is measured by the following: -Allowable Business Interruption - the Maximum Tolerable Downtime -Financial and Operational Considerations -Regulatory Requirements -Organizational Reputation -The BIA sets the stage for determining a business-oriented judgment concerning the appropriation of resources for recovery planning efforts. Eight Steps of the BIA - Step 1: Select Interviewees Step 2: Determine information gathering techniques Step 3: Customize questionnaire to gather economic and operational impact information (quantitative and qualitative questions) Step 4: Analyze information Step 5: Determine time-critical business systems Step 6: Determine maximum tolerable downtimes Step 7: Prioritize critical business systems based on maximum tolerable downtimes Step 8: Document findings and report recommendations Phase III: Recovery Strategies - A set of pre-defined and management approved actions that will be followed and implemented in response to a business interruption.