Presentation on theme: "BUSINESS CONTINUITY MANAGEMENT THROUGH STANDARDS AND BEST PRACTICES Jasmina Trajkovski, CISA, CISM."— Presentation transcript:
BUSINESS CONTINUITY MANAGEMENT THROUGH STANDARDS AND BEST PRACTICES Jasmina Trajkovski, CISA, CISM
What is BCM? holistic management process identifies potential impacts framework for resilience and response capability safeguard interests of key stakeholders or more simply…
Not just a paper plan, it also requires organisation, planning, assessment, training, rehearsal and more. A process that establishes a secure and resilient business environment capable of mounting an immediate and effective response to a major incident.
Objective of business continuity management Time Level of business Critical recovery point Fully tested effective BCM No BCM – ‘lucky’ escape No BCM – likely outcome
Impact of Downtime Lost Revenue Know the downtime costs (per hour, day, two days...) Number of employees impacted (x hours out * hourly rate) Damaged Reputation Customers Suppliers Financial markets Banks Business partners Financial Performance Revenue recognition Cash flow Lost discounts (A/P) Payment guarantees Credit rating Stock price Other Expenses Temporary employees, equipment rental, overtime costs, extra shipping costs, travel expenses... Direct loss Compensatory payments Lost future revenue Billing losses Investment losses Lost Productivity
Availability Measurement – Levels of ‘9s’ Availability % Uptime% DowntimeDowntime per YearDowntime per Week 98%2%7.3 days3hrs 22 min 99%1%3.65 days1 hr 41 min 99.8%0.2%17 hrs 31 min20 min 10 sec 99.9%0.1%8 hrs 45 min10 min 5 sec 99.99%0.01%52.5 min1 min 99.999%0.001%5.25 min6 sec 99.9999%0.0001%31.5 sec0.6 sec
Impact Scenarios 7 Loss or denial of physical space Your work area has been destroyed and/or become inaccessible Access to space, but loss of technology Your area is intact, but without data/power/water/etc. Both
Impact Categories 8 Financial The cost to recover all functions + loss of revenue Example: BP oil spill cost billions to clean + lost billions in product Operational The ability to physically execute a critical business function
Impact Categories 9 Legal/Regulatory The ability to be fined, sued, or shut down Customer The ability to retain customer base when operating in Emergency Mode Reputation The ability to retain customer base when the story gets out
The business continuity plan Emergency response plan Activity Crisis management/ communication plan Business recovery plan Time objective A A successful outcome
What is wrong with current plans Outdated or gathering dust on the shelves Reads like a policy vs. a process to restore Recovery team is not aware of plan contents or been trained Only addresses restoring IT systems Lacks an effective plan to: restore connectivity between locations manage communications to customers, local media, employees Never been tested A large single document Saved only on the network Does not address security incidents Too much focus on catastrophic disasters or natural disasters Does not address availability of critical vendors One plan fits all disruptions
Some survey results 2014 One-third of respondents experienced outages reported stated that critical applications were lost for hours and sometimes multiple days. Even more alarming was that one in four respondents said they had lost most, if not all of their datacenter for hours and in some cases days. Nearly one in four respondents never tested their DR plans, and one-third of those surveyed tests their plans only once or twice a year. When companies do test, more than 65% do not pass their own DR tests http://drbenchmark.org/ http://drbenchmark.org/
Difference in objective / purpose What has to be done Agreed / accepted by a representative number of countries Applicable to all types of organizations What works well How an activity can be done A compilation of practices from various types of organizations StandardsBest practices
Standards…. ISO 22301:2012, "Societal security -- Business continuity management systems --- Requirements“ BS 25999-2:2007, “Specification for Business Continuity Management” - replaced by ISO 22301:2012. NFPA 1600: Standard on Disaster/Emergency Management and Business Continuity Programs. ASIS/BSI BCM.01:2010 published Dec 2010 ANSI/ASIS SPC.1-2009 Organizational Resilience.
Best practices…. Business continuity institute – Good practice guidelines Disaster recovery institute – reference materials BS 25777, “Information and communications technology continuity management. Code of practice” – replaced with ISO27031: 2011, “Guidelines for information and communication technology readiness for business continuity” ISO27002:2013, “Code of practice for information security controls” ISO 22313:2012, "Societal security -- Business continuity management systems – Guidance“ ISO/IEC 27031:2011, "Information security - Security techniques — Guidelines for information and communication technology [ICT] readiness for business continuity“ BS 25999-1:2006, “Business Continuity Management. Code of Practice” – replaced by ISO22313:2012 HB 292-2006: A practitioners guide to business continuity management HB 293-2006: Executive guide to business continuity management And many more….
Standards provides requirements for Determining the context of the organization List of legal, regulatory and other requirements Scope of the BCMS (Business Continuity Management System) and explanation of exclusions Business continuity policy and Business continuity objectives Competences of personnel Communication with interested parties Process for business impact analysis and risk assessment Business continuity procedures Incident response procedures Procedures for restoring and returning business from temporary measures PDCA cycle
BCI Good Practice Guidelines Policy and program management Embedding business continuity Analysis Design Implementation Validation Management practicesTechnical practices