Overview
Any event that could negatively impact operations should be included in the plan, such as supply chain interruption, loss of or damage to critical infrastructure (major machinery or computing/network resource). As such, BCP is a subset of risk management. In the U.S., government entities refer to the process as ''continuity of operations planning'' (COOP). A Business Continuity Plan outlines a range of disaster scenarios and the steps the business will take in any particular scenario to return to regular trade. BCP's are written ahead of time and can also include precautions to be put in place. Usually created with the input of key staff as well as stakeholders, a BCP is a set of contingencies to minimize potential harm to businesses during adverse scenarios.Resilience
A 2005 analysis of how disruptions can adversely affect the operations of corporations and how investments in resilience can give a competitive advantage over entities not prepared for various contingencies extended then-common business continuity planning practices. Business organizations such as theContinuity
Plans and procedures are used in business continuity planning to ensure that the critical organizational operations required to keep an organization running continue to operate during events when key dependencies of operations are disrupted. Continuity does not need to apply to every activity which the organization undertakes. For example, under ISO 22301:2019, organizations are required to define their business continuity objectives, the minimum levels of product and service operations which will be considered acceptable and the maximum tolerable period of disruption (MTPD) which can be allowed. A major cost in planning for this is the preparation of audit compliance management documents; automation tools are available to reduce the time and cost associated with manually producing this information.Inventory
Planners must have information about: * Equipment * Supplies and suppliers *Locations, including other offices and backup/work area recovery (WAR) sites * Documents and documentation, including which have off-site backup copies: ** Business documents ** Procedure documentationAnalysis
The analysis phase consists of * impact analysis * threat and risks analysis and * impact scenarios. Quantifying of loss ratios must also include "dollars to defend a lawsuit." It has been estimated that a dollar spent in loss prevention can prevent "seven dollars of disaster-related economic loss."Business impact analysis (BIA)
A Business impact analysis (BIA) differentiates critical (urgent) and non-critical (non-urgent) organization functions/activities. A function may be considered critical if dictated by law. Each function/activity typically relies on a combination of constituent components in order to operate: * Human resources (full-time staff, part-time staff, or contractors) * IT systems * Physical assets (mobile phones, laptops/workstations etc.) * Documents (electronic or physical) For each function, two values are assigned: * Recovery Point Objective (RPO) – the acceptable latency of data that will not be recovered. For example, is it acceptable for the company to lose 2 days of data? The recovery point objective must ensure that the maximum tolerable data loss for each activity is not exceeded. * Recovery Time Objective (RTO) – the acceptable amount of time to restore the functionMaximum RTO
Maximum time constraints for how long an enterprise's key products or services can be unavailable or undeliverable before stakeholders perceive unacceptable consequences have been named as: * (MTPoD) * Maximum Tolerable Downtime (MTD) * Maximum Tolerable Outage (MTO) * Maximum Acceptable Outage (MAO) According to ISO 22301 the terms ''maximum acceptable outage'' and ''maximum tolerable period of disruption'' mean the same thing and are defined using exactly the same words.Consistency
When more than one system crashes, recovery plans must balance the need for data consistency with other objectives, such as RTO and RPO. Recovery Consistency Objective (RCO) is the name of this goal. It applies data consistency objectives, to define a measurement for the consistency of distributed business data within interlinked systems after a disaster incident. Similar terms used in this context are "Recovery Consistency Characteristics" (RCC) and "Recovery Object Granularity" (ROG). While RTO and RPO are absolute per-system values, RCO is expressed as a percentage that measures the deviation between actual and targeted state of business data across systems for process groups or individual business processes. The following formula calculates RCO with "n" representing the number of business processes and "entities" representing an abstract value for business data: 100% RCO means that post recovery, no business data deviation occurs.Threat and risk analysis (TRA)
After defining recovery requirements, each potential threat may require unique recovery steps. Common threats include: The above areas can cascade: Responders can stumble. Supplies may become depleted. During the 2002-2003Impact scenarios
Impact scenarios are identified and documented: * need for medical supplies * need for transportation options * civilian impact of nuclear disasters * need for business and data processing supplies These should reflect the widest possible damage.Tiers of preparedness
SHARE's seven tiers of disaster recovery released in 1992, were updated in 2012 by IBM as an eight tier model: * Tier 0 - No off-site data • Businesses with a Tier 0 Disaster Recovery solution have no Disaster Recovery Plan. There is no saved information, no documentation, no backup hardware, and no contingency plan. Typical recovery time: ''The length of recovery time in this instance is unpredictable''. In fact, it may not be possible to recover at all. *Tier 1 - Data backup with no Hot Site • Businesses that use Tier 1 Disaster Recovery solutions back up their data at an off-site facility. Depending on how often backups are made, they are prepared to accept several days to weeks of data loss, but their backups are secure off-site. However, this Tier lacks the systems on which to restore data. Pickup Truck Access Method (PTAM). *Tier 2 - Data backup with Hot Site • Tier 2 Disaster Recovery solutions make regular backups on tape. This is combined with an off-site facility and infrastructure (known as a hot site) in which to restore systems from those tapes in the event of a disaster. This tier solution will still result in the need to recreate several hours to days worth of data, but ''it is less unpredictable in recovery time''. Examples include: PTAM with Hot Site available, IBM Tivoli Storage Manager. *Tier 3 - Electronic vaulting • Tier 3 solutions utilize components of Tier 2. Additionally, some mission-critical data is electronically vaulted. This electronically vaulted data is typically more current than that which is shipped via PTAM. As a result there is ''less data recreation or loss after a disaster occurs''. *Tier 4 - Point-in-time copies • Tier 4 solutions are used by businesses that require both greater data currency and faster recovery than users of lower tiers. Rather than relying largely on shipping tape, as is common in the lower tiers, Tier 4 solutions begin to incorporate more disk-based solutions. ''Several hours of data loss is still possible'', but it is easier to make such point-in-time (PIT) copies with greater frequency than data that can be replicated through tape-based solutions. *Tier 5 - Transaction integrity • Tier 5 solutions are used by businesses with a requirement for consistency of data between production and recovery data centers. There is ''little to no data loss'' in such solutions; however, the presence of this functionality is entirely dependent on the application in use. *Tier 6 - Zero or little data loss • Tier 6 Disaster Recovery solutions ''maintain the highest levels of data currency''. They are used by businesses with little or no tolerance for data loss and who need to restore data to applications rapidly. These solutions have no dependence on the applications to provide data consistency. *Tier 7 - Highly automated, business-integrated solution • Tier 7 solutions include all the major components being used for a Tier 6 solution with the additional integration of automation. This allows a Tier 7 solution to ensure consistency of data above that of which is granted by Tier 6 solutions. Additionally, recovery of the applications is automated, allowing for restoration of systems and applications much faster and more reliably than would be possible through manual Disaster Recovery procedures.Solution design
Two main requirements from the impact analysis stage are: * For IT: the minimum application and data requirements and the time in which they must be available. * Outside IT: preservation of hard copy (such as contracts). A process plan must consider skilled staff and embedded technology. This phase overlaps with Disaster recovery disaster recovery planning. The solution phase determines: *ISO Standards
There are many standards that are available to support Business continuity planning and management. ISO has for example developed a whole series of standards on Business continuity management systems under responsibility of technical committee ISO/TC 292: * ISO 22300:2021 Security and resilience – Vocabulary * ISO 22301:2019 Security and resilience – Business continuity management systems – Requirements * ISO 22313:2020 Security and resilience – Business continuity management systems – Guidance on the use of ISO 22301 * ISO/TS 22317:2021 Security and resilience – Business continuity management systems – Guidelines for business impact analysis * ISO/TS 22318:2021 Security and resilience – Business continuity management systems – Guidelines for supply chain continuity * ISO/TS 22330:2018 Security and resilience – Business continuity management systems – Guidelines for people aspects on business continuity * ISO/TS 22331:2018 Security and resilience – Business continuity management systems – Guidelines for business continuity strategy * ISO/TS 22332:2021 Security and resilience – Business continuity management systems – Guidelines for developing business continuity plans and procedures * ISO/IEC/TS 17021-6:2015 Conformity assessment – Requirements for bodies providing audit and certification of management systems – Part 6: Competence requirements for auditing and certification of business continuity management systems * ISO/IEC 27031:2011 Security techniques — Guidelines for information and communication technology readiness for business continuity.British standards
The BSI Group British Standards Institution (BSI) released a series of standards: * 1995: BS 7799, peripherally addressed information security procedures. (withdrawn) * 2006: BCP — BS 25999-1 Business Continuity Management. Code of Practice (withdrawn) * 2007: BS 25999-2 Specification for Business Continuity Management, which specifies requirements for implementing, operating and improving a documented business continuity management system (BCMS). (withdrawn) * 2008: BS 25777, specifically to align computer continuity with business continuity. (withdrawn March 2011) These standards has been withdrawn and replaced by the ISO standards above. Within the UK, BS 25999-2:2007 and BS 25999-1:2006 were being used for business continuity management across all organizations, industries and sectors. These documents give a practical plan to deal with most eventualities—from extreme weather conditions to terrorism, IT system failure, and staff sickness. ITIL has defined some of these terms.Civil Contingencies Act
In 2004, following crises in the preceding years, the UK government passed the Civil Contingencies Act of 2004: Businesses must have continuity planning measures to survive and continue to thrive whilst working towards keeping the incident as minimal as possible. The Act was separated into two parts: * Part 1: civil protection, covering roles & responsibilities for local responders * Part 2: emergency powersAustralia and New Zealand
United Kingdom and Australia have incorporated resilience into their continuity planning. In the United Kingdom, resilience is implemented locally by the Local Resilience Forum. In New Zealand, the Canterbury University Resilient Organizations programme developed an assessment tool for benchmarking the Resilience of Organizations. It covers 11 categories, each having 5 to 7 questions. A ''Resilience Ratio'' summarizes this evaluation.Implementation and testing
The implementation phase involves policy changes, material acquisitions, staffing and testing.Testing and organizational acceptance
The 2008 book ''Exercising for Excellence'', published by TheMaintenance
Biannual or annual maintenance cycle maintenance of a BCP manual is broken down into three periodic activities. * Confirmation of information in the manual, roll out to staff for awareness and specific training for critical individuals. * Testing and verification of technical solutions established for recovery operations. * Testing and verification of organization recovery procedures. Issues found during the testing phase often must be reintroduced to the analysis phase.Information and targets
The BCP manual must evolve with the organization, and maintain information about who has to know what: * a series of checklists ** job descriptions, skillsets needed, training requirements ** documentation and document management * definitions of terminology to facilitate timely communication during disaster recovery, * distribution lists (staff, important clients, vendors/suppliers) * information about communication and transportation infrastructure (roads, bridges)Technical
Specialized technical resources must be maintained. Checks include: *Testing and verification of recovery procedures
Software and work process changes must be documented and validated, including verification that documented work process recovery tasks and supporting disaster recovery infrastructure allow staff to recover within the predetermined recovery time objective.See also
References
Further reading
United States
Bibliography
International Organization for Standardization
* ISO 22300:2018 Security and resilience - Vocabulary * ISO 22301:2019 Security and resilience – Business continuity management systems – Requirements * ISO 22313:2013 Security and resilience - Business continuity management systems - Guidance on the use of ISO 22301 * ISO/TS 22315:2015 Societal security – Business continuity management systems – Guidelines for business impact analysis (BIA) * ISO/PAS 22399:2007 Guideline for incident preparedness and operational continuity management (withdrawn) * ISO/IEC 24762:2008 Guidelines for information and communications technology disaster recovery services * ISO/IEC 27001:2013 (formerly BS 7799-2:2002) Information technology — Security techniques — Information security management systems — Requirements * ISO/IEC 27002:2013 Information technology — Security techniques — Code of practice for information security controls * ISO/IEC 27031:2011 Information technology – Security techniques – Guidelines for information and communication technology readiness for business continuity * IWA 5:2006 Emergency Preparedness (withdrawn)British Standards Institution
* BS 25999-1:2006 Business Continuity Management Part 1: Code of practice (superseded, withdrawn) * BS 25999-2:2007 Business Continuity Management Part 2: Specification (superseded, withdrawn)Australia Standards
* HB 292-2006, "A practitioners guide to business continuity management" * HB 293-2006, "Executive guide to business continuity management"Others
* * * * * *External links
*