Business continuity planning
Any event that could negatively impact operations is included in the plan, such as supply chain interruption, loss of or damage to critical infrastructure (major machinery or computing /network resource). As such, BCP is a subset of risk management. In the US, government entities refer to the process as continuity of operations planning (COOP). A Business Continuity Plan outlines a range of disaster scenarios and the steps the business will take in any particular scenario to return to regular trade. BCP's are written ahead of time and can also include precautions to be put in place. Usually created with the input of key staff as well as stakeholders, a BCP is a set of contingencies to minimize potential harm to businesses during adverse scenarios.
- 1 Analysis
- 2 Tiers of preparedness
- 3 Solution design
- 4 Current British standards
- 5 Implementation and testing
- 6 Maintenance
- 7 See also
- 8 References
- 9 Further reading
- 10 External links
The analysis phase consists of impact analysis, threat analysis and impact scenarios.
Quantifying of loss ratios must also include "dollars to defend a lawsuit." It has been estimated that a dollar spent in loss prevention can prevent "seven dollars of disaster-related economic loss."
Business impact analysis (BIA)
A Business impact analysis (BIA) differentiates critical (urgent) and non-critical (non-urgent) organization functions/activities. A function may be considered critical if dictated by law.
For each function, two values are assigned:
- Recovery Point Objective (RPO) – the acceptable latency of data that will not be recovered. For example, is it acceptable for the company to lose 2 days of data? The recovery point objective must ensure that the maximum tolerable data loss for each activity is not exceeded.
- Recovery Time Objective (RTO) – the acceptable amount of time to restore the function.
Maximum time constraints for how long an enterprise's key products or services can be unavailable or undeliverable before stakeholders perceive unacceptable consequences have been named as:
- Maximum Tolerable Period of Disruption (MTPoD)
- Maximum Tolerable Downtime (MTD)
- Maximum Tolerable Outage (MTO)
- Maximum Allowable Outage (MAO)
According to ISO 22301 the terms maximum acceptable outage and maximum tolerable period of disruption mean the same thing and are defined using exactly the same words.
Threat and risk analysis (TRA)
After defining recovery requirements, each potential threat may require unique recovery steps. Common threats include:
- Cyber attack
- Sabotage (insider or external threat)
- Hurricane or other major storm
- Power outage
- Water outage (supply interruption, contamination)
- Telecomms outage
- IT outage
- War/civil disorder
- Theft (insider or external threat, vital information or material)
- Random failure of mission-critical systems
- Single point dependency
The above areas can cascade: Responders can stumble. During the 2002-2003 SARS outbreak, some organizations compartmentalized and rotated teams to match the incubation period of the disease. They also banned in-person contact during both business and non-business hours. This increased resiliency against the threat.
Impact scenarios are identified and documented:
- need for medical supplies
- need for transportion options
- civilian impact of nuclear disasters
These should reflect the widest possible damage.
Tiers of preparedness
- Tier 0 - Nothing off-site... "recovery time .. unpredictable ..." - possibly not possible.
- Tier 1 - What IBM calls "PTAM (Pickup Truck Access Method)" - but a hot site (backup hardware).
- Tier 2 - Hot site - will require hours or even days to load the most recent backup tapes.
- Tier 3 - Transaction data at the off-site is kept relatively current via an ongoing high-speed data link (electronic vaulting) and "an automated tape library at the remote site."
- Tier 4 - "Point-in-time copies" so that less reprocessing of transactions will be needed.
- Tier 5 - "Transaction integrity" - the hot site is kept as up-to-the-moment as possible.
- Tier 6 - "Zero or Near-zero data loss"
- Tier 7 - "Highly automated" recovery - few if any manual steps following a main site failure; rollover to running at the hot site is automatic.
Two main requirements from the impact analysis stage are:
- For IT: the minimum application and data requirements and the time in which they must be available.
- Outside IT: preservation of hard copy (such as contracts). A process plant must consider skilled staff and embedded technology.
This phase overlaps with disaster recovery planning.
The solution phase determines:
- crisis management command structure
- telecommunication architecture between primary and secondary work sites
- data replication methodology between primary and secondary work sites
- Backup site - applications, data and work space required at the secondary work site
Current British standards
The British Standards Institution (BSI) released a series of standards:
- BS 7799, peripherally addressed information security procedures.
- 2006: BCP—BS 25999-1,
- 2007: BS 25999-2 "Specification for Business Continuity Management", which specifies requirements for implementing, operating and improving a documented business continuity management system (BCMS).
- 2008: BS25777, specifically to align computer continuity with business continuity. (withdrawn March 2011)
- 2011: ISO/IEC 27031 - Security techniques — Guidelines for information and communication technology readiness for business continuity.
- July 2014: BS EN ISO 22301:2014, the current standard for business continuity planning.
Within the UK, BS 25999-2:2007 and BS 25999-1:2006 used for business continuity management across all organizations, industries and sectors. These documents give a practical plan to deal with most eventualities—from extreme weather conditions to terrorism, IT system failure, and staff sickness.
Civil Contingencies Act
In 2004, following crises in the preceding years, the UK government passed the Civil Contingencies Act of 2004: Businesses must have continuity planning measures to survive and continue to thrive whilst working towards keeping the incident as minimal as possible.
The Act was separated into two parts:
- Part 1: civil protection, covering roles & responsibilities for local responders
- Part 2: emergency powers
Implementation and testing
The implementation phase involves policy changes, material acquisitions, staffing and testing.
Testing and organizational acceptance
The 2008 book Exercising for Excellence, published by The British Standards Institution identified three types of exercises that can be employed when testing business continuity plans.
- Tabletop exercises - a small number of people concentrate on a specific aspect of a BCP. Another form involves a single representative from each of several teams.
- Medium exercises - Several departments, teams or disciplines concentrate on multiple BCP aspects; the scope can range from a few teams from one building to multiple teams operating across dispersed locations. Pre-scripted "surprises" are added.
- Complex exercises - All aspects of a medium exercise remain, but for maximum realism no-notice activation, actual evacuation and actual invocation of a disaster recovery site is added.
While start and stop times are pre-agreed, the actual duration might be unknown if events are allowed to run their course.
Biannual or annual maintenance cycle maintenance of a BCP manual is broken down into three periodic activities.
- Confirmation of information in the manual, roll out to staff for awareness and specific training for critical individuals.
- Testing and verification of technical solutions established for recovery operations.
- Testing and verification of organization recovery procedures.
Issues found during the testing phase often must be reintroduced to the analysis phase.
The BCP manual must evolve with the organization, and maintain information about who has to know what
- a series of checklists
- definitions of terminology to facilitate timely communication during disaster recovery,
- distribution lists (staff, important clients, vendors/suppliers)
- information about communication and transportation infrastructure (roads,bridges)
Specialized technical resources must be maintained. Checks include:
- Virus definition distribution
- Application security and service patch distribution
- Hardware operability
- Application operability
- Data verification
- Data application
Testing and verification of recovery procedures
Software and work process changes must be (re)documented and validated, including verification that documented work process recovery tasks and supporting disaster recovery infrastructure allow staff to recover within the predetermined recovery time objective.
- "How to Build an Effective and Organized Business Continuity Plan". Forbes. June 26, 2015.
- "Surviving a Disaster" (PDF). American Bar.org (American Bar Association). 2011.
- Elliot, D.; Swartz, E.; Herbane, B. (1999) Just waiting for the next big bang: business continuity planning in the UK finance sector. Journal of Applied Management Studies, Vol. 8, No, pp. 43–60. Here: p. 48.
- Intrieri, Charles (10 September 2013). "Business Continuity Planning". Flevy. Retrieved 29 September 2013.
- "Guidance & Directives - FEMA.gov".
- "Business Continuity Planning (BCP) for Businesses of all Sizes". 19 April 2017.
- "Emergency Planning" (PDF).
- Helen Clark (August 15, 2012). "Can your Organization survive a natural disaster?" (PDF). RI.gov.
- May, Richard. "Finding RPO and RTO". Archived from the original on 2016-03-03.
- "Maximum Acceptable Outage (Definition)". riskythinking.com. Albion Research Ltd. Retrieved 4 October 2018.
- "BIA Instructions, BUSINESS CONTINUITY MANAGEMENT - WORKSHOP" (PDF). driecentral.org. Disaster Recovery Information Exchange (DRIE) Central. Retrieved 4 October 2018.
- "Plain English ISO 22301 2012 Business Continuity Definitions". praxiom.com. Praxiom Research Group LTD. Retrieved 4 October 2018.
- "Medical supply location and distribution in disasters". SCHOLAR.google.com.
- "transportation planning in disaster recovery". SCHOLAR.google.com.
- "PLANNING SCENARIOS Executive Summaries" (PDF).
- developed by SHARE's Technical Steering Committee, working with IBM
- Ellis Holman (March 13, 2012). "A Business Continuity Solution Selection Methodology" (PDF). IBM Corp.
- British Standards Institution (2014). Societal security – Business continuity management Systems – Requirements: London
- "ITIL® glossary and abbreviations".
- British Standards Institution (2006). Business continuity management-Part 1: Code of practice :London
- Cabinet Office. (2004). overview of the Act. In: Civil Contingencies Secretariat Civil Contingencies Act 2004: a short. London: Civil Contingencies Secretariat
- "Glossary of Business Continuity Terms".
- "Disaster Recovery Plan Checklist" (PDF). CMS.gov.
- Othman. "Validation of a Disaster Management Metamodel (DMM)". SCHOLAR.google.com.
- Business Continuity Planning, FEMA, Retrieved: June 16, 2012
- Continuity of Operations Planning (no date). U.S. Department of Homeland Security. Retrieved July 26, 2006.
- Purpose of Standard Checklist Criteria For Business Recovery (no date). Federal Emergency Management Agency. Retrieved July 26, 2006.
- NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity Programs (2010). National Fire Protection Association.
- United States General Accounting Office Y2k BCP Guide (August 1998). United States Government Accountability Office.
International Organization for Standardization
- ISO/IEC 27001:2005 (formerly BS 7799-2:2002) Information Security Management System
- ISO/IEC 27002:2005 (renumerated ISO17999:2005) Information Security Management – Code of Practice
- ISO/IEC 27031:2011 Information technology – Security techniques – Guidelines for information and communication technology readiness for business continuity
- ISO/PAS 22399:2007 Guideline for incident preparedness and operational continuity management
- ISO/IEC 24762:2008 Guidelines for information and communications technology disaster recovery services
- IWA 5:2006 Emergency Preparedness
- ISO 22301:2012 Societal security – Business continuity management systems – Requirements
- ISO 22313:2012 Societal security – Business continuity management systems – Guidance
- ISO/TS 22315:2015 Societal security – Business continuity management systems – Guidelines for business impact analysis (BIA)
British Standards Institution
- BS 25999-1:2006 Business Continuity Management Part 1: Code of practice
- BS 25999-2:2007 Business Continuity Management Part 2: Specification
- James C. Barnes. A Guide to Business Continuity Planning. ISBN 978-0471530152.
- Kenneth L Fulmer. Business Continuity Planning, A Step-by-Step Guide. ISBN 978-1931332217.
- Richard Kepenach. Business Continuity Plan Design, 8 Steps for Getting Started Designing a Plan.
- Judy Bell. Disaster Survival Planning: A Practical Guide for Businesses. ISBN 978-0963058003.
- Dimattia, S. (November 15, 2001). "Planning for Continuity". Library Journal: 32–34.
- The tiers of Disaster Recovery and TSM. Charlotte Brooks, Matthew Bedernjak, Igor Juran, and John Merryman. In, Disaster Recovery Strategies with Tivoli Storage Management. Chapter 2. Pages 21–36. Red Books Series. IBM. Tivoli Software. 2002.
- SteelStore Cloud Storage Gateway: Disaster Recovery Best Practices Guide. Riverbed Technology, Inc. October 2011.
- Disaster Recovery Levels. Robert Kern and Victor Peltz. IBM Systems Magazine. November 2003.
- Business Continuity: The 7-tiers of Disaster Recovery. Recovery Specialties. 2007.
- Continuous Operations: The Seven Tiers of Disaster Recovery. Mary Hall. The Storage Community (IBM). 18 July 2011. Retrieved 26 March 2013.</ref>
- Maximum Tolerable Period of Disruption (MTPOD)
- Maximum Tolerable Period of Disruption (MTPOD): BSI committee response