Business Continuity A matter of survival Session 5 Develop, test and maintain the Plan

Developing and testing the Plan Develop plan Training Testing Review & update Stage 3 On- going System changes

Developing the Plan Object - the completed plan must contain everything that is necessary to recover the business following a disaster. What constitutes a disaster? Depends on - economic strength private or public sector nature of impact (e.g financial loss, loss of life, loss of control)

Sections of the Plan Administration - authority to invoke the plan guidance on when to invoke the plan Emergency Control Centre emergency response teams - roles, personnel IT infrastructure - lists of suppliers and contractors, system configuration details Support contracts - disaster recovery, equipment replacement

Sections of the Plan Remote media store - location, items held, arrangements for gaining access Computer operations - instructions for service restoration, service relaxation(s) Personnel - personnel to be re-located at standby site, welfare arrangements, sources of additional personnel Home site - security and salvage Standby site - contacts, transport, facilities Return to normal - roles & responsibilities

Supporting requirements Evacuation procedures Emergency Control Centre Re-locating personnel Re-establishing support services Vital records - security of essential paper documents Salvage

Training Limited value if staff are unaware of - need for a plan? emergency arrangements - scenarios what would happen if plan activated roles & responsibilities who to contact/where re-location sites, accommodation, transport Specialist training for response teams

Testing the Plan What use is a plan that doesn’t work when needed? Testing is essential to prove that the plan works

Testing Factors to consider - cost business disruption what changes have taken place? (new systems, changes, locations) any changes to the threat environment? (severe weather forecast, industrial action expected, terrorist activity increasing)

Testing strategy - full testing Most effective way to uncover flaws Impose near as possible disaster conditions Set performance targets Record - times to achieve targets problems Post mortem Update

Testing strategy - restricted testing Cheaper, less disruptive Provides limited assurance Periodically - test standby utilities - weekly? carry out “dry runs” - monthly? recover from backup - quarterly? practice evacuations - 6 monthly? arrange visits to standby site - annual?

Maintaining the Plan Accountability - need for an “Owner” Annual budget to maintain the plan Managing changing - business priorities IS/IT locations On-going need for - training/awareness testing

Summary “Business continuity” requires a comprehensive plan Training - specialists & others Live testing - costly but necessary Restricted testing - cheaper, but provides only limited assurance Accountability - need for an “Owner” On-going maintenance

Audit considerations Are business systems adequately backed up? Are backup copies held in a secure and remote media store? (go and see for yourself!) Is there evidence that the backing up strategy works in practice? Is there an appropriate disaster recovery plan? Is it based on thorough risk assessment? How do personnel know their role in the plan? How is the Plan maintained? Is the Plan demonstrably workable?