Phases of BCP
The BCP process can be divided into thefollowing life cycle phases:
–Creation of a business continuity and disasterrecovery policy.
–Business impact analysis.
–Classification of operations and criticality analysis.
–Development of a business continuity plan anddisaster recovery procedures.
–Training and awareness program.
–Testing and implementation of plan.
–Monitoring.
Business Continuity and DisasterRecovery Policy
•A business continuity and disaster recoverypolicy should be proactive and encompasspreventive, detective and correctivecontrols.
•The business continuity plan is the mostcritical corrective control.
•It is dependent on other controls, beingeffective, in particular
–incident management, and
–media backup
Incident Management
•Definition of incident:
“An incident is any unexpected event, even if it causesno significant damage.“
•Incident and crises are dynamic by nature. Theyevolve, change with time and circumstances, and areoften rapid and unforeseeable.
•Because of this, their management must be dynamic,proactive and well documented. Depending on anestimation of the level of consequential damage to thebusiness, all types of incidents should be categorized.
Incident Management
•Incidents may vary from causing nodamage to serious impacts on thecontinued functioning of the business.Hence they should be documented,classified, and followed up on untilcorrected or resolved. This is a dynamicprocess, as a major incident maydeescalate momentarily and yet laterexpand to become a major crisis.
Media Back up
•Taking back up on regular basis ofbusiness transactions and other data fromthe IS is very critical to an effective BCP.
Business Impact Analysis (BIA)
•In this phase, identification of the potential impact ofuncontrolled non specific events on the institutions businessprocesses and outcomes. Consideration of all departments andbusiness functions not just data processing and estimation ofmaximum allowable downtime and acceptable level of data andfinancial losses.
•To perform this phase successfully, one should obtain anunderstanding of the organization, key business processes, andIT resource used by the organization to support the keybusiness process.
•The criticality of the information resources (e.g. applications,data, networks, system software) that support an organization’sbusiness processes must be established with seniormanagement approval.
•Approaches to perform a BIA
–Questionnaire
–Interview group of key users
–Discuss with IT staff and end users together
Classification of operations andcriticality analysis
•During this phase, risks and threats are analyzed.
•Impacts of these risks on the system are alsocomputed.
•For instance
–The Risk: The system will suffer a serious disruption overthe next five years:
–Chance of Occurrence: 10% or 0.1
–Assessed impact of disruption: Rs. 10 million x 0.1percent = Rs. 10000 over five years
•Based on these assessed impacts, the risks areranked so that suitable recovery strategies can bedeveloped.
Recovery Strategies
•There are various strategies for recoveringcritical information resources.
•The strategy is considered to be appropriate if
–Cost of implementation is acceptable
–Recovery time taken by the strategy is acceptable
–Cost and recovery time are also reasonablecompared to the impact and likelihood ofoccurrence as determined in the business impactanalysis.
Types of recovery Strategies
•Disaster recovery must meet two requirementswhich are
–The minimum application and application datarequirements
–The time frame in the application and applicationsdata requirements must be made available
Types of recovery Strategies
•Following are the various recoverystrategies.
–Cold Site
–Hot Site
–Warm Site
–Reciprocal agreement
–Third Party arrangements
Cold sites
•If an organization can tolerate some downtime,cold sites backup might be appropriate.
•A cold site has all the facilities needed to installa information system raised floors, airconditioning, power, communication lines andso on.
•The cold site is ready to receive equipment, butdoes not offer any components at the site inadvance of the need.
• Activation of site is may take several weeksdepending on the size of information processingfacility.
Hot sites
•If fast recovery is critical, an organization mightneed hot-site backup.
•All hardware and operations facilities will beavailable at the hot site.
•In some cases, software, data, and suppliesmight also be stored there.
•Hot sites are expensive to maintain. Theyusually are shared with other organizations thathave same hot site needs
Warm sites
•They are partially configured, usually with networkconnections and selected peripheral equipment,such as disk drives, tape drives and controllers, butwithout the main computer.
•Sometimes a warm site is equipped with a lesspowerful CPU, than the one generally used.
•The assumption behind the warm site concept is thatthe computer can usually be obtained quickly foremergency installation and since, the computer isthe most expensive unit, such a arrangement is lesscostly than a hot site.
•After the installation of the needed components thesite can be ready for service within hours; however,the location and installation of the CPU and othermissing units could take several days or weeks.
Reciprocal Agreement
•Two or more organization might agree toprovide backup facilities to each other in theevent of one suffering a disaster.
•This backup option is relatively cheap, but eachparticipate must maintain sufficient capacity tooperate another’s critical systems.
•Reciprocal agreements are often informal innature.
Third Party arrangements
•Apart from having a give-and-take relationshipwith other organizations, an agreement may alsobe signed with third party vendors so as tooutsource the disaster recovery process.
•The responsibility of the site development liescompletely with the third party.
•The shift in responsibility can help organizationto stop worrying of the recovery site all the time.
DEVELOPMENT OF BUSINESS CONTINUITYAND DISASTER RECOVERY PLANS
•In this phase, a detailed business continuity anddisaster recovery plan should be developed.
•It should address all issues involved ininterruption to business processes, includingrecovering from a disaster.
DEVELOPMENT OF BUSINESSCONTINUITY AND DISASTER RECOVERYPLANS
•The various factors that should be consideredwhile developing the plan are:
–Pre disaster readiness covering incidence responsemanagement to address all incidence affectingbusiness processes and analysis
–Evacuation procedure
–Procedure for declaring a disaster
–Circumstances under which a disaster should bedeclared. All interruptions are not disasters, but asmall incident if not addressed in a timely or propermanner may lead to a disaster. For example, a virusattack not recognized and contained in time maybring down the entire IT facility.
DEVELOPMENT OF BUSINESS CONTINUITYAND DISASTER RECOVERY PLANS
•The various factors that should be consideredwhile developing the plan are:
–The clear identification of the responsibilities in theplan
–The clear identification of the person responsible foreach function in the plan
–The clear identification of contract information.
–The step by step explanation of the recovery option
–The clear identification of the various resourcesrequired for recovery and continued operation ofthe organization.
–The step by step application of the constitutionphase.
Training and awareness program
•Now the employees need to be made aware ofthe policies which have been devise.
•Initially the program will be an organization wideactivity.
•Subsequently all new recruitments should betrained under the program
Testing and implementation of plan
•Since BCP is a plan devised for any emergencysituation emerging, employees should be madeto face mocked situations so as to be preparedwhat to do when an emergency comes up.
•Certain issued may need to be resolved even ifthere is no undesirable situation.
For example
Where an organization opts for hot sitestrategy, basic equipment should be availableall the time and ready to be used in the case ofemergency.
Monitoring
•Once the plan has been tested and implemented, itneeds to be monitored and updated on regular basisfor following reasons.
–Changes in business strategy may alter the significance ofcritical application or deem additional applications as critical.
–Changes in the software or hardware environment maymake current provisions obsolete or inappropriate
–Incidents emerging and affecting the organizations businesscontinuity issues.
–Reassessing the risks, their impact and likelihood ofoccurrence
–Identifying any newly emerged risks and including them inthe BCP
–Training of the new recruits as and when they are employed.