Business Continuity A matter of survival Session 5 Develop, test and maintain the Plan

1. Business ContinuityA matter of survivalSession 5Develop, test and maintainthe Plan

2. Stage 3 Develop plan Training On- going Review & update Testing System changes Developing and testing the Plan

3. Developing the Plan • Object - the completed plan must contain everything that is necessary to recover the business following a disaster. • What constitutes a disaster? Depends on - • economic strength • private or public sector • nature of impact (e.g financial loss, loss of life, loss of control)

4. Sections of the Plan • Administration - • authority to invoke the plan • guidance on when to invoke the plan • Emergency Control Centre • emergency response teams - roles, personnel • IT infrastructure - lists of suppliers and contractors, system configuration details • Support contracts - disaster recovery, equipment replacement

5. Sections of the Plan • Remote media store - location, items held, arrangements for gaining access • Computer operations - instructions for service restoration, service relaxation(s) • Personnel - personnel to be re-located at standby site, welfare arrangements, sources of additional personnel • Home site - security and salvage • Standby site - contacts, transport, facilities • Return to normal - roles & responsibilities

6. Supporting requirements • Evacuation procedures • Emergency Control Centre • Re-locating personnel • Re-establishing support services • Vital records - security of essential paper documents • Salvage

7. Training • Limited value if staff are unaware of - • need for a plan? • emergency arrangements - scenarios • what would happen if plan activated • roles & responsibilities • who to contact/where • re-location sites, accommodation, transport • Specialist training for response teams

8. Testing the Plan • What use is a plan that doesn’t work when needed? • Testing is essential to prove that the plan works

9. Testing • Factors to consider - • cost • business disruption • what changes have taken place? (new systems, changes, locations) • any changes to the threat environment? (severe weather forecast, industrial action expected, terrorist activity increasing)

10. Testing strategy - full testing • Most effective way to uncover flaws • Impose near as possible disaster conditions • Set performance targets • Record - • times to achieve targets • problems • Post mortem • Update

11. Testing strategy - restricted testing • Cheaper, less disruptive • Provides limited assurance • Periodically - • test standby utilities - weekly? • carry out “dry runs” - monthly? • recover from backup - quarterly? • practice evacuations - 6 monthly? • arrange visits to standby site - annual?

12. Maintaining the Plan • Accountability - need for an “Owner” • Annual budget to maintain the plan • Managing changing - • business priorities • IS/IT • locations • On-going need for - • training/awareness • testing

13. Summary • “Business continuity” requires a comprehensive plan • Training - specialists & others • Live testing - costly but necessary • Restricted testing - cheaper, but provides only limited assurance • Accountability - need for an “Owner” • On-going maintenance

14. Audit considerations • Are business systems adequately backed up? • Are backup copies held in a secure and remote media store? (go and see for yourself!) • Is there evidence that the backing up strategy works in practice? • Is there an appropriate disaster recovery plan? • Is it based on thorough risk assessment? • How do personnel know their role in the plan? • How is the Plan maintained? • Is the Plan demonstrably workable?