1

Business Continuity Management

Presenter:

Mike Jackson

Agenda

Slide 2

Serial Subject Slides1 Definition 3 - 42 Responsibility 5 – 63 Major Phases of BCM 74 International Standards 85 Key Questions to Ask 9 – 126 Before the Consultants Arrive 13 – 167 Deliverables 178 Testing 189 Public Domain Statistics 19

10 Questions 20

What is Business Continuity Management?

A good, although lengthy definition in BS 25999-1 is: ◦ "A holistic management process that identifies potential threats to an

organization and the impacts to business operations that those threats, if realized, might cause, and which provides a framework for building organizational resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities“

It is also called Business Continuity & Resiliency Planning

In Plain language – Working out how to stay in business in the event of a significant occurrence

Definition

Slide 3

An interesting recent aspect of this topic is that some consultants are grouping the approaches of Risk Management and Business Continuity Management together.

In my experience, there are benefits to be had by grouping these aspects since there is commonality in the early processes, and therefore cost savings, but the outcomes are strategically different and must must be exercised to assure the corresponding deliverables.

For example, In the case of a glass being half full or half empty, RM will see it as probably half full and BCM will worry about the contents being hazardous or if the glass breaks how long it will take to clear up

Definition

Slide 4

Business continuity and disaster recovery planning is a key governance responsibility. The UK Companies Act 2006 gives statutory force to what has long been the worldwide common law duty of directors, which is to exercise due care in relation to their companies. Specifically, directors must "exercise reasonable care, skill and diligence“  

Principle responsibility lies with the CEO and his Executive Management team for their companies Business Continuity Management . The board of directors is accountable for ensuring that the organization has developed and tested business continuity and disaster recovery plans that deal with all the likely risks that face the organization.  

Senior Management is responsible for providing BCM strategies that are necessary for the continuation of Business Critical functions

Responsibility

Slide 5

Principle responsibility lies with the CEO and his Executive Management team for their companies Business Continuity Management

Senior Management is responsible for providing BCM strategies that are necessary for the continuation of Business Critical functions

Responsibility

Slide 6

Four Phases:

1. Understanding the organisation

2. Determine the Business Continuity Strategy

3. Develop and implementing BCM response

4. Exercising maintaining and reviewing

Major Phases of BCM

Slide 7

There are 2 widely recognised standards:

1. BS25999 Two parts:

BS-25999-1 (2006) Code of Practice (Guide) BS-25999-2 (2007) Specification

2. ISO/PAS 22399 (2007) Societal Security

International Standards

Slide 8

What activities in your organisation, if stopped, cause the most impact to your business?

Impact may be on: ◦ Cash Flow◦ Reputation◦ Meeting Statutory and Legal requirements

Key Questions to ask

Slide 9

How are these activities delivered and what resources are used to support them?

Resources may be: ◦ People◦ Plant and Machinery◦ Premises and Furniture◦ Computing and Telecommunications◦ Data and Information◦ Suppliers and Distributors

Key Questions to ask (2)

Slide 10

Some other key questions are:

◦ Who is essential?◦ What equipment, IT, Telecomms and other systems are

necessary to continue to function?◦ Who does the Org rely upon to carry out key activities?◦ Who depends upon the Organisation?◦ Are there any service levels, legal or regulatory

obligations?◦ Do Disaster Recovery, Business Continuity and emergency

plans already exist?◦ Are there any natural fluctuations of operational activity

e.g. Month-end payroll or end of year for accounts

Key Questions to ask (3)

Slide 11

You then need to consider:

◦ How long can your business manage without key activities? (This is important as this dictates what you focus on first)

◦ How essential is a departments work to the overall performance of the business on a day to day basis?

◦ Having identified key resources – consider the likelihood that these resources may be lost i.e. what are the risks to these resources?

Key Questions to ask (4)

Slide 12

There are a number of things you can do before you bring in the consultant(s)

1. Understand your business Identify what makes your business profitable

Map and document these processes Get agreement with the rest of the board team

2. Conduct a high level SWOT analysis Determine what and where your vulnerabilities are

that affect your productivity and profit Understand which resources are necessary for the

business to continue

Before the Consultants Arrive

Slide 13

3. Identify Possible scenarios • Determine how long it takes to replace• Avoid doom and gloom – be realistic

4. Establish and Understand replacement times Place Profit Processes in a priority order

You can do this in term of frequency of use or profitability or ease – whatever you decide

• Determine how long it takes to replace Personnel Resources Manufacturing Materials Suppliers Buildings Power, heating / cooling and lighting

Before the Consultants Arrive

Slide 14

Theft

Fire

Flood

5. Develop a Risk Analysis Quadrant

Before the Consultants Arrive

Slide 15

Probability

Low

High

Low High

CEO Kidnapped

Service Denialattack

Production Machine

Breakdown

Impact

OperatorKilled

OperatorInjured

MaterialsUnavailabl

e

SalesmanKilled

ReputationDestroyed

PoliticalUpheaval

6. Outline options for mitigating the identified business continuity risks

7. Bring in your BCM consultants to review and document your findings and to add their own experience and value

Before the Consultants Arrive

Slide 16

8. They should design and develop the Business Continuity Plan and recommend how it should be initiated and maintained

You should expect the following outputs from this exercise:

Identified Risks and associated mitigations Business Continuity Plan BCP Test scenarios and Test plans Outline Test schedule Crisis Management/Emergency Response/Incident

Management procedures Outline DR Plans and Test scenario plans

Deliverables

Slide 17

You should test aspects of your BCP and the underlying Incident management and DR responses

Use an external consultant where possible, as they should remain impartial and observe and report the outcome of the planned scenario

Test

Slide 18

80% of organizations with a tried and tested business continuity plan are likely to survive a major business discontinuity; only 20% of those without a business continuity plan are likely to survive.

Over 90% of organizations that suffer a significant data loss are not in business two years later.

The latest data indicates that many of the existing plans are not comprehensive and that maintenance (testing and updating) is generally inadequate.

'Backup' is not the same as a business continuity plan, and terrorism should be specifically addressed.

Public Domain Statistics

Slide 19

Questions

Slide 20

Thank youShukran