Transcript Slide 1
Business Continuity: An introduction Purpose The sole purpose of Business Continuity is to Maintain a minimum level of service while Restoring the organization to business as usual Who needs it? Everyone Commerce and industry need it to protect the customer base Charities need it to assure continued funding Government agencies need it to assure continued funding and existence Managers need it to assure their positions The difference The difference between Business Continuity and Disaster Recovery Business Continuity is PROACTIVE; its focus is to avoid or mitigate the impact of a risk Disaster Recovery is REACTIVE; its focus is to pick up the pieces and to restore the organization to business as usual after a risk occurs Disaster Recovery is an integral part of a Business Continuity plan Why Business Continuity? An organization which fails to provide a minimum level of service to its clients following a disaster event may not have a business to recover Customers may go to a competitor Funding may disappear A need may be re-evaluated and deemed unnecessary What to protect Business functions Functions which provide products or services Critical support functions Functions without which the Business Functions cannot function (e.g. Facilities, IT) Corporate level support functions Functions required for effective operation of Business Functions (e.g. HR, Finance) Most important resource Personnel Why people? Although there are other critical resources, the actual product or service in most organizations depends on actions performed by, and decisions made by, people. Who is involved? In a word, EVERYONE Executive management Mid-level managers Line personnel Support personnel Vendors Municipal Emergency Management Management involvement Executive management Support is required for successful plan Provides high-level overview of organization’s operation Provides long-range planning to assure the Business Continuity plan compliments the organization’s Business Plan Mid-level managers Provide departmental direction Provide department-level overviews Provide an insight into external (to the department/function) interdependencies Offer suggestions on how to enhance critical business processes Identify risks Line personnel Provide operational details Offer suggestions on how to enhance critical business processes Identify risks Support personnel Provide information about services which assure the critical Business Functions can be performed at a minimum level of service or better Provide information about protecting resources Support may include Accounts receivable Accounts payable Communications Documentation Facilities Finance Human Resources IT/MIS Janitorial Legal Mail Room Marketing Public relations Sales Vendors Vendors provide services and products Courier services and mail Communications (telephone, fax, email) Insurance (business, health, property) Necessities (municipal services) Utilities (electricity, fuel) Emergency Management Municipal Emergency management must be included in the plan to Assure personnel safety Mitigate damage from risks Train personnel to avoid risks and to protect themselves and the organization No man – or department – is an island Protect all to protect one In order to protect any single Business Function, the enterprise must be protected. There are too many easily identifiable dependencies to create successful “function-only” or “resource-only” plans. A few risks Aircraft accident Bond rating Civil unrest Communications Competition Customer failure (K-Mart) Debris Drought Electrical failure Epidemic Espionage Fire Flood Hacked database HazMat incident Heat Hurricane Ice Industry image (airlines) A few more risks Internet failure Intranet failure IT/MIS Legal action Lender reluctance Local statues Loss of key personnel Rail accident Recession Regulatory agencies Reputation Snow State law Stock value Tornado Traffic accident Vendor failure Wildfire Work action Ubiquitous “other” Rating a risk Not all risks present the same danger to an organization Risks are rated based on Probability of occurrence Impact on the organization Risk options Avoid the risk Usually the most expensive option Required by some 24*7*365 operations Mitigate the risk Less expensive than avoidance Reduces the impact of the “inevitable” Absorb the risk The process or product is antiquated anyway The plan – Part 2 Create business continuation processes Create organization recovery processes Create a training program Establish a plan maintenance procedure Train, train, and train some more Business continuation Business continuation processes are designed so the organization maintains “at least a minimum level of service” to assure there will be a business to recover Each Business and Support function must have a continuation plan How quickly the process must be functioning depends on the maximum allowable outage Recover the business This may be in multiple stages: Recovery to a minimum level of service Recovery to business as usual There may be intermediate stages between the two recovery stages shown above Training program The training program has two primary goals: To assure personnel will be able to efficiently and effectively respond following a disaster event To develop self-confidence in the personnel to perform their assigned functions Maintenance A plan that lacks maintenance quickly becomes a “non-plan” Plan maintenance is based on the calendar Plan maintenance is based on “trigger” events Personnel change Process, procedure change Etc. Creating a plan Do it yourself Can you think of everything? Can you think objectively? Who will review your plan? Call a professional Experience Network to help think of almost everything Only objective is to create a successful plan Plan Purpose Scope Business Continuity Plan (BCP) Provide procedures for sustaining essential business operations while recovering from a significant disruption Addresses business processes; IT addressed only in the context of supporting business process Business Recovery (or Resumption) Plan (BRP) Provide procedures for recovering business operations immediately following a disaster Addresses business processes; not IT-focused Continuity of Operations Plan Establish procedures and capabilities to sustain an organization’s essential, strategic functions at an alternate site for up to 30 days Addresses subset of an organization’s missions deemed critical; not IT-focused Continuity of Support Plan Establish procedures and capabilities for recovering a major application or general support system Similar to IT contingency plan; addresses IT system disruption; not business process focused Disaster Recovery Plan (DRP) Provide detailed procedures to facilitate recovery of capabilities at an alternate site Often IT-focused; limited to major disruptions with long-term effects Incident Response Plan Define strategies to detect, respond to, and limit consequences of malicious cyber incident Focuses on information security responses to incidents affecting systems and/or networks Occupant Emergency Plan Provide coordinated procedures for minimizing loss of life or injury and protecting property damage in response to a physical threat Focuses on personnel and property particular to the specific facility; not business- or IT-focused 1) Develop a business continuity / disaster recovery plan - Establish a disaster-recovery team of employees who know your business best, and assign responsibilities for specific tasks. - Identify your risks (kinds of disasters you're most likely to experience). - Prioritize critical business functions and how quickly these must be recovered. - Establish a disaster recovery location where employees may work off-site and access critical back-up systems, records and supplies. - Obtain temporary housing for key employees, their families and pets. - Update and test your plan at least annually. 2) Alternative operational locations Determine which alternatives are available. For example: - A satellite or branch office of your business. - The office of a business partner or even an employee. - Home or hotel. 3) Backup site. Equip your backup operations site with critical equipment, data files and supplies: - Power generators. - Computers and software. - Critical computer data files (payroll, accounts payable and receivable, customer orders, inventory). - Phones/radios/TVs. - Equipment and spare parts. - Vehicles, boats and spare parts. - Digital cameras. - Common supplies. - Supplies unique to your business (order forms, contracts, etc.). - Basic first aid/sanitary supplies, potable water and food. 4) Safeguard your property Is your property prepared to survive a hurricane or other disaster: - Your building? - Your equipment? - Your computer systems? - Your company vehicles? - Your company records? - Other company assets? 5) Contact information Do you have current and multiple contact information (e.g., home and cell phone numbers, personal e-mail addresses) for: - Employees? - Key customers? - Important vendors, suppliers, business partners? - Insurance companies? - Is contact information accessible electronically for fast access by all employees? 6) Communications Do you have access to multiple and reliable methods of communicating with your employees: - Emergency toll-free hotline? - Website? - Cell phones? - Satellite phones? - Pagers? - BlackBerry(TM)? - Two-way radios? - Internet? - E-mail? 7) Employee preparation Make sure your employees know: - Company emergency plan. - Where they should relocate to work. - How to use and have access to reliable methods of communication, such as satellite/cell phones, e-mail, voice mail, Internet, text messages, BlackBerry(TM), PDAs. - How they will be notified to return to work. - Benefits of direct deposit of payroll and subscribe to direct deposit. - Emergency company housing options available for them and their family. 8) Customer preparation Make sure your key customers know: - Your emergency contact information for sales and service support (publish on your website). - Your backup business or store locations (publish on your website). - What to expect from your company in the event of a prolonged disaster displacement. - Alternate methods for placing orders. - Alternate methods for sending invoice payments in the event of mail disruption. 9) Evacuation order When a mandatory evacuation is issued, be prepared to grab and leave with critical office records and equipment: - Company business continuity / disaster recovery plan and checklist. - Insurance policies and company contracts. - Company checks, plus a list of all bank accounts, credit cards, ATM cards. - Employee payroll and contact information. - Desktop/laptop computers. - Customer records, including orders in progress. - Photographs/digital images of your business property. - Post disaster contact information inside your business to alert emergency workers how to reach you. - Secure your building and property. 10) Cash management Be prepared to meet emergency cash-flow needs: - Take your checkbook and credit cards in the event of an evacuation. - Keep enough cash on hand to handle immediate needs. - Use Internet banking services to monitor account activity, manage cash flow, initiate wires, pay bills. - Issue corporate cards to essential personnel to cover emergency business expenses. - Reduce dependency on paper checks and postal service to send and receive payments (consider using electronic payment and remote deposit banking services). 11) Post-disaster recovery procedures - Consider how your post-disaster business may differ from today. - Plan whom you will want to contact and when. - Assign specific tasks to responsible employees. - Track progress and effectiveness. - Document lessons learned and best practices.