1. Business Continuity Planning and IT Risk Management
Nazim Kasumzade
Head of IT Department
State Treasury Agency

2. WHAT IS IT?
BCP (business continuity planning) – is a framework to prevent potential threats and ensure recovery in the event of a disaster.

3. WHY IS IT NEEDE?
Serves as a formal set of rules in the event of a disaster
Defines the notion of disaster (scope)
Appoints disaster managers
Identifies disaster management working groups and their chiefs, and reporting lines in the event of a disaster.
Appoints those in charge of public relations
Identifies resources and procedures required for disaster recovery
Identifies key organizations which must be notified (suppliers and budget organizations)
Documents procedures for testing and recovery to minimize the likelihood of misunderstanding and miscommunication during recovery
Identifies alternative sources of delivery and suppliers
Identifies key data storage, security, and recovery principles

4. HOW IS IT DONE?
Assessing and classifying risks
Measuring the business impact of each risk
Designing a business continuity plan
Testing - > Updating - > Testing - > …….. - > Finalizing
Identifying emergency communication lines and an emergency contact list
Holding regular training sessions

5. HOW MUCH WILL IT COST?
The cost will depend on a variety of factors – not least on recovery point objective and recovery time objective.
The cost will also depend on the level of technical support. The significance of the system (core business applications, non-core software, etc.) will define the level of technical support:
24/7 – response time < 30 minutes for hardware
24/7 – response time < 30 minutes for OS
24/7 – response time < 30 for applications
The next banking day – for non-core applications and auxiliary hardware

6. HOW CAN I BE SURE THAT IT WORKS?
KPIs & KRIs may be used to understand how well the BCP system works
KPIs are used for:
Monitoring and analysis of the current business status
Identifying required changes
Detailing the list of necessary steps
Measuring results
Measurable:
% of recovered capacity
Recovery time
% of capacity restored in the organization
…….
Non- Measurable:
Recovery quality
Organization’s satisfaction with recovery time

7. WHERE DID IT ORIGINATE AND WHAT ARE THE GUIDELINES FOR DESIGINING A BCP?
BCP originated in the IТ industry.
The original standards were designed by the American National Standard Institute (ANSI), International Standards Organization (ISO), and the National Institute of Standards and Technology (NIST).
Modern BCP basics:
ISO – BCMS – Requirements
ISO – BCMS – Guidelines
ISO – BCMS – BIA Guidelines
BCMS Template
Proprietary data center certification:
Staff training: