140 likes | 143 Views
Learn how to develop, test, and maintain a comprehensive business continuity plan to ensure survival in the face of disasters. Explore the necessary sections, supporting requirements, training, testing strategies, and ongoing maintenance.
E N D
Business ContinuityA matter of survivalSession 5Develop, test and maintainthe Plan
Stage 3 Develop plan Training On- going Review & update Testing System changes Developing and testing the Plan
Developing the Plan • Object - the completed plan must contain everything that is necessary to recover the business following a disaster. • What constitutes a disaster? Depends on - • economic strength • private or public sector • nature of impact (e.g financial loss, loss of life, loss of control)
Sections of the Plan • Administration - • authority to invoke the plan • guidance on when to invoke the plan • Emergency Control Centre • emergency response teams - roles, personnel • IT infrastructure - lists of suppliers and contractors, system configuration details • Support contracts - disaster recovery, equipment replacement
Sections of the Plan • Remote media store - location, items held, arrangements for gaining access • Computer operations - instructions for service restoration, service relaxation(s) • Personnel - personnel to be re-located at standby site, welfare arrangements, sources of additional personnel • Home site - security and salvage • Standby site - contacts, transport, facilities • Return to normal - roles & responsibilities
Supporting requirements • Evacuation procedures • Emergency Control Centre • Re-locating personnel • Re-establishing support services • Vital records - security of essential paper documents • Salvage
Training • Limited value if staff are unaware of - • need for a plan? • emergency arrangements - scenarios • what would happen if plan activated • roles & responsibilities • who to contact/where • re-location sites, accommodation, transport • Specialist training for response teams
Testing the Plan • What use is a plan that doesn’t work when needed? • Testing is essential to prove that the plan works
Testing • Factors to consider - • cost • business disruption • what changes have taken place? (new systems, changes, locations) • any changes to the threat environment? (severe weather forecast, industrial action expected, terrorist activity increasing)
Testing strategy - full testing • Most effective way to uncover flaws • Impose near as possible disaster conditions • Set performance targets • Record - • times to achieve targets • problems • Post mortem • Update
Testing strategy - restricted testing • Cheaper, less disruptive • Provides limited assurance • Periodically - • test standby utilities - weekly? • carry out “dry runs” - monthly? • recover from backup - quarterly? • practice evacuations - 6 monthly? • arrange visits to standby site - annual?
Maintaining the Plan • Accountability - need for an “Owner” • Annual budget to maintain the plan • Managing changing - • business priorities • IS/IT • locations • On-going need for - • training/awareness • testing
Summary • “Business continuity” requires a comprehensive plan • Training - specialists & others • Live testing - costly but necessary • Restricted testing - cheaper, but provides only limited assurance • Accountability - need for an “Owner” • On-going maintenance
Audit considerations • Are business systems adequately backed up? • Are backup copies held in a secure and remote media store? (go and see for yourself!) • Is there evidence that the backing up strategy works in practice? • Is there an appropriate disaster recovery plan? • Is it based on thorough risk assessment? • How do personnel know their role in the plan? • How is the Plan maintained? • Is the Plan demonstrably workable?