Transcript Slide 1
BUSINESS CONTINUITY MANAGEMENT THROUGH STANDARDS AND BEST PRACTICES Jasmina Trajkovski, CISA, CISM What is BCM? holistic management process identifies potential impacts framework for resilience and response capability safeguard interests of key stakeholders or more simply… A process that establishes a secure and resilient business environment capable of mounting an immediate and effective response to a major incident. Not just a paper plan, it also requires organisation, planning, assessment, training, rehearsal and more. Objective of business continuity management Level of business Fully tested effective BCM No BCM – ‘lucky’ escape No BCM – likely outcome Critical recovery Time Impact of Downtime Lost Productivity • Number of employees impacted (x hours out * hourly rate) Damaged Reputation • Customers • Suppliers • Financial markets • Banks • Business partners Know the downtime costs (per hour, day, two days...) Lost Revenue • • • • • Direct loss Compensatory payments Lost future revenue Billing losses Investment losses Financial Performance • Revenue recognition • Cash flow • Lost discounts (A/P) • Payment guarantees • Credit rating • Stock price Other Expenses Temporary employees, equipment rental, overtime costs, extra shipping costs, travel expenses... Availability Measurement – Levels of ‘9s’ Availability % Uptime % Downtime Downtime per Year Downtime per Week 98% 2% 7.3 days 3hrs 22 min 99% 1% 3.65 days 1 hr 41 min 99.8% 0.2% 17 hrs 31 min 20 min 10 sec 99.9% 0.1% 8 hrs 45 min 10 min 5 sec 99.99% 0.01% 52.5 min 1 min 99.999% 0.001% 5.25 min 6 sec 99.9999% 0.0001% 31.5 sec 0.6 sec Impact Scenarios 7 Loss or denial of physical space Your work area has been destroyed and/or become inaccessible Access to space, but loss of technology Your area is intact, but without data/power/water/etc. Both Impact Categories 8 Financial The cost to recover all functions + loss of revenue Example: BP oil spill cost billions to clean + lost billions in product Operational The ability to physically execute a critical business function Impact Categories 9 Legal/Regulatory The ability to be fined, sued, or shut down Customer The ability to retain customer base when operating in Emergency Mode Reputation The ability to retain customer base when the story gets out The business continuity plan Emergency response plan A successful outcome Activity Crisis management/ communication plan A Business recovery plan What is wrong with current plans Outdated or gathering dust on the shelves ‰ Reads like a policy vs. a process to restore ‰ Recovery team is not aware of plan contents or been trained ‰ Only addresses restoring IT systems ‰ Lacks an effective plan to: restore connectivity between locations manage communications to customers, local media, employees ‰ Never been tested ‰ A large single document ‰ Saved only on the network ‰ Does not address security incidents ‰ Too much focus on catastrophic disasters or natural disasters ‰ Does not address availability of critical vendors ‰ One plan fits all disruptions Some survey results 2014 One-third of respondents experienced outages reported stated that critical applications were lost for hours and sometimes multiple days. Even more alarming was that one in four respondents said they had lost most, if not all of their datacenter for hours and in some cases days. Nearly one in four respondents never tested their DR plans, and one-third of those surveyed tests their plans only once or twice a year. When companies do test, more than 65% do not pass their own DR tests http://drbenchmark.org/ BUT….. WHERE DO THE STANDARDS COME IN THE PICTURE? Difference in objective / purpose Standards What has to be done Agreed / accepted by a representative number of countries Applicable to all types of organizations Best practices What works well How an activity can be done A compilation of practices from various types of organizations Standards…. ISO 22301:2012, "Societal security -- Business continuity management systems --- Requirements“ BS 25999-2:2007, “Specification for Business Continuity Management” - replaced by ISO 22301:2012. NFPA 1600: Standard on Disaster/Emergency Management and Business Continuity Programs. ASIS/BSI BCM.01:2010 published Dec 2010 ANSI/ASIS SPC.1-2009 Organizational Resilience. Best practices…. Business continuity institute – Good practice guidelines Disaster recovery institute – reference materials BS 25777, “Information and communications technology continuity management. Code of practice” – replaced with ISO27031: 2011, “Guidelines for information and communication technology readiness for business continuity” ISO27002:2013, “Code of practice for information security controls” ISO 22313:2012, "Societal security -- Business continuity management systems – Guidance“ ISO/IEC 27031:2011, "Information security - Security techniques — Guidelines for information and communication technology [ICT] readiness for business continuity“ BS 25999-1:2006, “Business Continuity Management. Code of Practice” – replaced by ISO22313:2012 HB 292-2006: A practitioners guide to business continuity management HB 293-2006: Executive guide to business continuity management And many more…. ISO22301 Elements ISO22301 clauses Standards provides requirements for Determining the context of the organization List of legal, regulatory and other requirements Scope of the BCMS (Business Continuity Management System) and explanation of exclusions Business continuity policy and Business continuity objectives Competences of personnel Communication with interested parties Process for business impact analysis and risk assessment Business continuity procedures Incident response procedures Procedures for restoring and returning business from temporary measures PDCA cycle BCI Good Practice Guidelines Management practices Policy and program management Embedding business continuity Technical practices Analysis Design Implementation Validation Best practices Final words Do not just make the plan…. ….. Test to see if it works …. If it provides the required continuity …. And if the right people know how to use it. JASMINA TRAJKOVSKI, CISA, CISM [email protected]