Phases of BCPThe BCP process can be divided into the

following life cycle phases:– Creation of a business continuity and disaster

recovery policy.– Business impact analysis. – Classification of operations and criticality analysis.– Development of a business continuity plan and

disaster recovery procedures.– Training and awareness program.– Testing and implementation of plan.– Monitoring.

Business Continuity and Disaster Recovery Policy

• A business continuity and disaster recovery policy should be proactive and encompass preventive, detective and corrective controls.

• The business continuity plan is the most critical corrective control.

• It is dependent on other controls, being effective, in particular – incident management, and – media backup

Incident Management• Definition of incident:

“An incident is any unexpected event, even if it causes no significant damage.“

• Incident and crises are dynamic by nature. They evolve, change with time and circumstances, and are often rapid and unforeseeable.

• Because of this, their management must be dynamic, proactive and well documented. Depending on an estimation of the level of consequential damage to the business, all types of incidents should be categorized.

Incident Management

• Incidents may vary from causing no damage to serious impacts on the continued functioning of the business. Hence they should be documented, classified, and followed up on until corrected or resolved. This is a dynamic process, as a major incident may deescalate momentarily and yet later expand to become a major crisis.

Media Back up

• Taking back up on regular basis of business transactions and other data from the IS is very critical to an effective BCP.

Business Impact Analysis (BIA)• In this phase, identification of the potential impact of

uncontrolled non specific events on the institutions business processes and outcomes. Consideration of all departments and business functions not just data processing and estimation of maximum allowable downtime and acceptable level of data and financial losses.

• To perform this phase successfully, one should obtain an understanding of the organization, key business processes, and IT resource used by the organization to support the key business process.

• The criticality of the information resources (e.g. applications, data, networks, system software) that support an organization’s business processes must be established with senior management approval.

• Approaches to perform a BIA– Questionnaire– Interview group of key users– Discuss with IT staff and end users together

Classification of operations and criticality analysis

• During this phase, risks and threats are analyzed.• Impacts of these risks on the system are also

computed.• For instance

– The Risk: The system will suffer a serious disruption over the next five years:

– Chance of Occurrence: 10% or 0.1– Assessed impact of disruption: Rs. 10 million x 0.1

percent = Rs. 10000 over five years

• Based on these assessed impacts, the risks are ranked so that suitable recovery strategies can be developed.

Recovery Strategies• There are various strategies for recovering

critical information resources.

• The strategy is considered to be appropriate if – Cost of implementation is acceptable– Recovery time taken by the strategy is acceptable– Cost and recovery time are also reasonable

compared to the impact and likelihood of occurrence as determined in the business impact analysis.

Types of recovery Strategies• Disaster recovery must meet two requirements

which are– The minimum application and application data

requirements– The time frame in the application and applications

data requirements must be made available

Types of recovery Strategies

• Following are the various recovery strategies.– Cold Site– Hot Site– Warm Site– Reciprocal agreement– Third Party arrangements

Cold sites• If an organization can tolerate some downtime,

cold sites backup might be appropriate. • A cold site has all the facilities needed to install

a information system raised floors, air conditioning, power, communication lines and so on.

• The cold site is ready to receive equipment, but does not offer any components at the site in advance of the need.

• Activation of site is may take several weeks depending on the size of information processing facility.

Hot sites• If fast recovery is critical, an organization might

need hot-site backup.

• All hardware and operations facilities will be available at the hot site.

• In some cases, software, data, and supplies might also be stored there.

• Hot sites are expensive to maintain. They usually are shared with other organizations that have same hot site needs

Warm sites• They are partially configured, usually with network

connections and selected peripheral equipment, such as disk drives, tape drives and controllers, but without the main computer.

• Sometimes a warm site is equipped with a less powerful CPU, than the one generally used.

• The assumption behind the warm site concept is that the computer can usually be obtained quickly for emergency installation and since, the computer is the most expensive unit, such a arrangement is less costly than a hot site.

• After the installation of the needed components the site can be ready for service within hours; however, the location and installation of the CPU and other missing units could take several days or weeks.

Reciprocal Agreement• Two or more organization might agree to

provide backup facilities to each other in the event of one suffering a disaster.

• This backup option is relatively cheap, but each participate must maintain sufficient capacity to operate another’s critical systems.

• Reciprocal agreements are often informal in nature.

Third Party arrangements

• Apart from having a give-and-take relationship with other organizations, an agreement may also be signed with third party vendors so as to outsource the disaster recovery process.

• The responsibility of the site development lies completely with the third party.

• The shift in responsibility can help organization to stop worrying of the recovery site all the time.

DEVELOPMENT OF BUSINESS CONTINUITY AND DISASTER RECOVERY PLANS

• In this phase, a detailed business continuity and disaster recovery plan should be developed.

• It should address all issues involved in interruption to business processes, including recovering from a disaster.

DEVELOPMENT OF BUSINESS CONTINUITY AND DISASTER

RECOVERY PLANS• The various factors that should be considered

while developing the plan are:– Pre disaster readiness covering incidence response

management to address all incidence affecting business processes and analysis

– Evacuation procedure– Procedure for declaring a disaster– Circumstances under which a disaster should be

declared. All interruptions are not disasters, but a small incident if not addressed in a timely or proper manner may lead to a disaster. For example, a virus attack not recognized and contained in time may bring down the entire IT facility.

DEVELOPMENT OF BUSINESS CONTINUITY AND DISASTER RECOVERY PLANS

• The various factors that should be considered while developing the plan are:– The clear identification of the responsibilities in the

plan– The clear identification of the person responsible for

each function in the plan– The clear identification of contract information.– The step by step explanation of the recovery option– The clear identification of the various resources

required for recovery and continued operation of the organization.

– The step by step application of the constitution phase.

Training and awareness program • Now the employees need to be made aware of

the policies which have been devise.

• Initially the program will be an organization wide activity.

• Subsequently all new recruitments should be trained under the program

Testing and implementation of plan • Since BCP is a plan devised for any emergency

situation emerging, employees should be made to face mocked situations so as to be prepared what to do when an emergency comes up.

• Certain issued may need to be resolved even if there is no undesirable situation.

For exampleWhere an organization opts for hot site strategy, basic equipment should be available all the time and ready to be used in the case of emergency.

Monitoring• Once the plan has been tested and implemented, it

needs to be monitored and updated on regular basis for following reasons.– Changes in business strategy may alter the significance of

critical application or deem additional applications as critical.– Changes in the software or hardware environment may

make current provisions obsolete or inappropriate – Incidents emerging and affecting the organizations business

continuity issues.– Reassessing the risks, their impact and likelihood of

occurrence– Identifying any newly emerged risks and including them in

the BCP– Training of the new recruits as and when they are employed.