Project Planning
The aim of the Project Planning phrase is to start the BCP project in
your organization. It is primarily used to educate your executive
management about the purpose, process and importance of BCP.
The first step in implementing business continuity is to set up the
required business continuity management structure to support the
implementation process, seek heads of business units and their staff
members' commitment and resources and involve these business units'
representative(coordinators) in the BCP process.
BCP Project Manager will develop the framework confirm the business
units and functions of your organization to be included in the BCP
project, and their roles and responsibilities of each coordination
during the entire project, to ensure timely completion of the project. A
project initiation proposed to executive management containing the
mission, scope, assumptions, roles and responsibility, appointment of
business continuity team, project schedule.
Back to Services
Risk Analysis
A risk analysis identifies the type of threats/risks that a organization
or a specific location is likely to encounter. It examines the physical
infrastructure within the building and within a specific surroundings.
A relative weightage is assigned to each category of disaster and
estimates of duration are noted. A statement of risk is completed and
this in turn determines what areas should be examined further to
mitigate the risks.
Dr. Goh's comments on Risk Analysis
Back to Services
Business Impact Analysis
After the risk analysis and review has been performed, a BIA is
undertaken. It involves determining the cost of not being able to
continue transact business. The information is usually not
straightforward as the input can be fairly abstract. In many occasions,
the heads of business units will have to estimate the loss. In any
event, the purpose is not to get an exact answer, but to identify what
is critical to keep the organization in business. This step will
determine the breadth of the business continuity plan. Overprotecting
will cost excess funds while under-protecting will give the organization
a false sense of security.
Assessment of the effects of a business interruption on your
organization is developed in the BIA. The BIA provides your executive
management with information required to make sound decisions about what
business functions are critical and need to be recovered, how quickly,
and how much to spend to achieve recovery. It identifies very
specifically the resources - people, systems, software, records and
equipment - that would be required to continue your operations following
any disaster declaration.
The BIA also helps your organization to identify vulnerabilities, to
determine estimates of dollar loss amounts, and to determine minimum
resources needed during a crisis for each business function. The BIA
also suggests for each business function, the number of hours or days a
business unit can go without functioning before it incurs financial or
legal penalties. These are questions answered by managers in
interviews, with the BCP Project Manager's advice and help.
Some business functions of your organization will require immediate
recovery and resumption of operations, while others may be able to
recover gradually, in stages. Through interviews with heads of
businesses and staff members, the BCP Project Manager identifies the
damage, which could result from a disruption. In addition, any exposure
identified will be reviewed and alternative practices or policies may be
suggested. This step provides essential information for all subsequent
decisions that must be made in the development of the actual recovery
strategy and plans. The BCP Project Manager will confirm the decisions
you made on the number of hours or days a business unit can go without
functioning, and determine the requirements for recovery accordingly.
Back to Services
Recovery Strategy
During recovery strategy development, the BCP Project Manager in
consultation with the business units will develop possible recovery
strategy or alternatives to maintain continuity of critical business
functions. It will also include the protection of the facilities,
critical services, people, technology and voice and data communication,
given the budget and commitment level of the executive management.
Throughout the entire development process, the worst-case key disaster
scenario is assumed, that is, all critical business functions are
rendered incapable of performing daily operations at its most critical
timing.
The BCP Project Manager assumes that the organization will need one or
more alternative locations from which to continue business operations
after a disaster declaration. A determination of the type of recovery
site or sites required will be made based on decisions made by the
executive management after review of the BIA. If the organization
already owns premises and offices that can serve as recovery sites, it
should always examine that first. If a suitable facility does not
exist, outsourcing the facility may be recommended.
Whichever alternatives or options the organization chooses, the
alternative recovery location must be suitably equipped and the recovery
team personnel be made familiar to the location and equipment. The
recovery teams must rehearse or test the relocating to the alternative
office location to ensure that all the BCP assumptions made are correct.
Testing occurs in a later stage of the BCP process.
Finally, the recovery strategy report for both the corporate and
business units will be presented to the executive management for
approval.
Back to Services
Plan Development
The recovery procedures document is created at the plan development
stage. Here, the business units prepare plans to respond to crises,
resume, recover and restore the business following a crisis. This
document lists the tasks to be performed, notifications required, and
resources needed, in a timetable identifying the deadlines by which each
element must be completed in order to ensure optimal recovery. Each
business unit has its own written plan. Written plans for the business
units combined together comprise the business continuity plan for the
organization.
Plan development will enable the organization to:
- Ensure a timely resumption of critical business operations in a
disaster
- Minimize impact on the organization and its key stakeholders
- Minimize financial loss
The organization is divided into business unit recovery teams and the
corporate recovery teams. Business unit recovery teams are to develop
and execute recovery procedures for immediate, short-term and long-term
recovery of business operations while corporate services recovery teams,
for example, for administration and information technology, are to
develop and execute procedures to support the business unit recovery
teams.
The documentation of the plan can take several forms. Most
organizations use PC based word processors. Others use commercially
available software.
Once the decision to have a PC based word processing or a BCP
specialized software has been made, the template to write the business
continuity plan will be printed and used as a guide after a disaster
declaration. These recovery actions are listed starting with the
critical actions to be taken immediately after a disaster declaration.
These documents will become a valuable tool for the organization in:
- Training new hires
- Documenting all aspects of the recovery to ensure that a well
thought-out sequence of actions can be taken in the event of a disaster
Back to Services
Training
Current employees and new employees should learn or be updated in their
roles and responsibilities in the event of a disaster. This process
will help to:
- Communicate the plan throughout the organization
- Develop training and conduct training for current employees and new staff
BCP awareness should become an integral part of employee performance
reviews. The BCP Project Manager together with the business and
corporate services units will suggest ways to increase and maintain the
employees' BCP awareness.
Back to Services
Exercising
Once the procedures are written, testing (or exercising) is the most
vital part of every successful business continuity plan. The primary
goals of the testing phase are to identify:
- Test strategies
- Test planning steps
- Required changes in the recovery plan
Testing is intended to find errors and omissions, which can be
corrected. Plan testing also prepares the recovery teams to function at
the alternate site and verifies the adequacy of the site. Plan testing
will ensure that appropriate procedures have been written to handle all
likely situations.
Tests can be performed on all aspects of a plan, such as operating at
alternative locations, IT system switch over, notification call 'trees'
and evacuation methods. These types of tests will be discussed with the
organization's staff to determine the most appropriate model and the
test schedule. Testing can and should identify vulnerabilities as well
as changes to the organizational environment, which require updates.
Any test that does not uncover planning weaknesses did not challenge the
true recovery needs of the organization.
In order to ensure that the business continuity plan will work when you
need it, the plan needs to be tested and updated periodically. The BCP
Project Manager recommends that each member of a recovery team be
involved in some form of test - two times per year. A testing policy
and an overall test schedule (for the next few years) to upgrade the
readiness of disaster plans will be provided. Distribution of revised
plans should be done on a regular basis.
Back to Services
Maintenance
It is the key objective to ensure that change management procedures for
business continuity are in place upon completion of the plan. To
enhance the confidence that the business continuity plans will work when
it is needed, the plan needs to be updated and maintained. Maintenance
of the plans includes the following:
- Establish a change management policy
- Identify sources of changes in the environment
- Define maintenance procedures
- Review recovery plan documentation
- Evaluate adequacy of maintenance plans
Back to Services
|
|
|
|
