1. Business Continuity A matter of survival Session 5 Develop, test and maintain the Plan

2. Developing and testing the Plan
Develop plan
Training
Testing
Review &
update
Stage 3
On-
going
System
changes

3. Developing the Plan
Object - the completed plan must contain everything that is necessary to recover the business following a disaster.
What constitutes a disaster? Depends on -
economic strength
private or public sector
nature of impact (e.g financial loss, loss of life, loss of control)

4. Sections of the Plan Administration -
authority to invoke the plan
guidance on when to invoke the plan
Emergency Control Centre
emergency response teams - roles, personnel
IT infrastructure - lists of suppliers and contractors, system configuration details
Support contracts - disaster recovery, equipment replacement

5. Sections of the Plan
Remote media store - location, items held, arrangements for gaining access
Computer operations - instructions for service restoration, service relaxation(s)
Personnel - personnel to be re-located at standby site, welfare arrangements, sources of additional personnel
Home site - security and salvage
Standby site - contacts, transport, facilities
Return to normal - roles & responsibilities

6. Supporting requirements
Evacuation procedures
Emergency Control Centre
Re-locating personnel
Re-establishing support services
Vital records - security of essential paper documents
Salvage

7. Training Limited value if staff are unaware of -
need for a plan?
emergency arrangements - scenarios
what would happen if plan activated
roles & responsibilities
who to contact/where
re-location sites, accommodation, transport
Specialist training for response teams

8. Testing the Plan What use is a plan that doesn’t work when needed?
Testing is essential to prove that the plan works

9. Testing Factors to consider - cost business disruption
what changes have taken place? (new systems, changes, locations)
any changes to the threat environment? (severe weather forecast, industrial action expected, terrorist activity increasing)

10. Testing strategy - full testing
Most effective way to uncover flaws
Impose near as possible disaster conditions
Set performance targets
Record -
times to achieve targets
problems
Post mortem
Update

11. Testing strategy - restricted testing
Cheaper, less disruptive
Provides limited assurance
Periodically -
test standby utilities - weekly?
carry out “dry runs” - monthly?
recover from backup - quarterly?
practice evacuations - 6 monthly?
arrange visits to standby site - annual?

12. Maintaining the Plan Accountability - need for an “Owner”
Annual budget to maintain the plan
Managing changing -
business priorities
IS/IT
locations
On-going need for -
training/awareness
testing

13. Summary “Business continuity” requires a comprehensive plan
Training - specialists & others
Live testing - costly but necessary
Restricted testing - cheaper, but provides only limited assurance
Accountability - need for an “Owner”
On-going maintenance

14. Audit considerations Are business systems adequately backed up?
Are backup copies held in a secure and remote media store? (go and see for yourself!)
Is there evidence that the backing up strategy works in practice?
Is there an appropriate disaster recovery plan?
Is it based on thorough risk assessment?
How do personnel know their role in the plan?
How is the Plan maintained?
Is the Plan demonstrably workable?