PBSi Business Continuity Planning

Transcription

1 Business Continuity Planning

2 Definition Business Continuity planning is a planning process designed to reduce the risk that disruptive failures or events could seriously harm your business. It is designed to safeguard your business by ensuring the continuity of a minimum set of business functions and a smooth return to normal operating conditions when the crisis is over.

3 Causes of Failure Failures or events may be external or internal in nature External: Loss of power, communications, flooding, interruption of supply chain Internal: Loss of information, fire, corrupted IT systems, loss of key personnel

4 Purpose Provide predetermined actions to Allow prompt resumption of critical functions Reduce decision making during recovery operations Allow return to normal operating conditions at the earliest possible time Minimize financial loss and hardship Minimize the extent of interruption

5 Required By US Securities Exchange Commission for companies >$10M Emergency Preparedness Canada for all Government Departments National Contingency Planning Group and Treasury Board Secretariat for Mission Critical government functions for Y2K Fortune 500 Companies best practices

6 Business Plans, Policies, Objectives, Procedures Integration Plans Business Continuity Planning Requirements Analysis (scoping study) Business Continuity Management Plan Lifecycle Maintenance Update Risk Assessments Project Risk Assessment Strategic Risk Assessment Implementation Strategy Test / Validate / Update Plans Update Risk Assessments Integrated Risk Assessment Risk Management Options Risk Assessment Business Risk Assessment Business Impact Analysis (BIA) Aggregate Continuity Plan Options Analysis

7 Benefits of Contingency Planning Successfully deal with threats to survival Successfully deal with threats to continuing operations Successfully deal with interruptions of critical functions Allows comprehensive planning and implementation of procedures that do not have to be invented in time of crisis

8 Business Continuity Planning Readiness Posture Risk Mitigation Contingency Planning Preparedness / Prevention Determine Workarounds Stockpile Establish Redundant Systems Remediate / Replace Current Systems Crisis Response Posture Contingency Planning (Disaster Recovery) Crisis Response Execute Established Procedures Transition and Recovery Posture Business Resumption Planning Return to Normalcy Restore Failed Systems Return to Pre-Crisis Operations AIM: Prevent Failure of Critical Business Functions AIM:To Restore a Minimum Level of Service Within the Required Timeframe AIM: To restore Normal Operating Conditions Normal Service Level Minimum Service Level Time

9 Process Diagram Risk Assessment Business Function Analysis Contingency Planning Crisis Response Recovery Planning Training Testing

10 Process Steps Risk Assessment Business Function Analysis Contingency Planning Crisis Response Recovery Planning Training Test / Validate / Update Plans

11 Risk Assessment Appraisal/review of existing documents, policies, business plans and disaster recovery plans Risk identification ensures that risks associated with all facets of business operations are captured Risk register is produced

12 Business Function Analysis Define business functions and relative criticality Map assets and interdependencies of critical business functions Determine consequence of failures and identify key vulnerabilities Determine the minimum service level and identify gaps in ability to deliver minimum service level in a crisis.

13 Assets & Interdependencies Critical Function Assets IT Systems IT Infrastructure End User Computing Internal/ External Interfaces Embedded Systems Facilities Others Functional Interdependencies Employees Clients Companies Suppliers Other Government Departments Others Infrastructure Interdependenci es Utilities Services Transportation Safety Communication Government Services Others

14 Contingency Plan Define options for the plan wrt to function, process, system and people Define responsibility and reporting Identify resources required to invoke plan and procedures Cost benefit analysis to select cost effective procedures

15 Crisis Response Crisis response activities include reporting and management response Developing plans and procedures to assess failures Describing thresholds for invoking contingencies Describing individual responsibilities and authorities

16 Recovery Planning Defines the planning necessary to return to normal operating conditions after a crisis. Dependent on the nature of business and contingency plans developed todate

17 Business Continuity Plan Contingency Plan Overview Training, Test & Maintenance Plan Departmental Crisis Definition Contingency Plan Crisis Response Plan Business Resumption Plan Crisis Scenarios Contingency Procedures & Triggers Crisis Response Procedures Business Resumption Procedures

18 Training Develop training plan Conduct the training for the implementation of the business continuity plan Record lessons learned Make recommendations for changes to business continuity plan and procedures

19 Testing Design test program, write test scenarios and exercises, and conduct the test of business continuity plans Tests may be structured walkthrough, operational or live exercise Assess performance Validate test and gather lessons learned Develop recommendations and implement

20 Network Timeline Risk Assessment Business Function Analysis Contingency Planning Crisis Response Recovery Planning Training Testing Business Continuity Plan