Scribd
Upload
31 views

How To Preserve Critical Business Functions in The Face of A Disaster

This document outlines the key aspects of business continuity planning (BCP) and disaster recovery planning (DRP). It discusses how BCP aims to allow for the continuation of critical business processes in the event of a disaster through preparation, testing, and maintenance of recovery plans. The five phases of BCP are described as project initiation, business impact analysis to determine maximum tolerable downtimes, defining recovery strategies, plan development and implementation, and ongoing testing, training and maintenance. Technical recovery strategies can include subscription recovery sites, mutual aid agreements, redundant processing centers, and service bureaus.

Uploaded by

caport
Copyright
© © All Rights Reserved
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
31 views

How To Preserve Critical Business Functions in The Face of A Disaster

This document outlines the key aspects of business continuity planning (BCP) and disaster recovery planning (DRP). It discusses how BCP aims to allow for the continuation of critical business processes in the event of a disaster through preparation, testing, and maintenance of recovery plans. The five phases of BCP are described as project initiation, business impact analysis to determine maximum tolerable downtimes, defining recovery strategies, plan development and implementation, and ongoing testing, training and maintenance. Technical recovery strategies can include subscription recovery sites, mutual aid agreements, redundant processing centers, and service bureaus.

Uploaded by

caport
Copyright
© © All Rights Reserved
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
You are on page 1/ 32

Business Continuity Planning

(BCP) & Disaster Recovery


Planning (DRP)

How to preserve critical


business functions in the
face of a disaster.
Overview

Strategic

Diagram

Chart

Overview

Review

Summary

The BCP domain addresses:


Continuation of critical business
processes when a disaster
destroys data processing
capabilities
Preparation, testing and
maintenance of specific actions to
recover normal processing (the
BCP)

Disasters natural, man-made


Fire, flood, hurricane, tornado,
earthquake, volcanoes
Plane crashes, vandalism, terrorism,
riots, sabotage, loss of personnel, etc.
Anything that diminishes or destroys
normal data processing capabilities

Disasters are defined in terms of


the business
If it harms critical business
processes, it may be a disaster
Time-based definition how long
can the business stand the pain?
Probability of occurrence

Broad BCP objectives - CIA


Availability the main focus
Confidentiality still important
Integrity still important

BCP objective
Create, document, test, and
update a plan that will:
Allow timely recovery of critical
business operations
Minimize loss
Meet legal and regulatory
requirements

Scope of BCP
Used to be just the data center
Now includes:
Distributed operations
Personnel, networks, power
All aspects of the IT environment

Creating a BCP
Is an on-going process, not a project
with a beginning and an end
Creating, testing, maintaining, and updating
Critical business functions may evolve

The BCP team must include both


business and IT personnel
Requires the support of senior
management

The five BCP phases


Project management & initiation
Business Impact Analysis (BIA)
Recovery strategies
Plan design & development
Testing, maintenance, awareness,
training

I - Project management &


initiation
Establish need (risk analysis)
Get management support
Establish team (functional, technical, BCC
Business Continuity Coordinator)
Create work plan (scope, goals, methods,
timeline)
Initial report to management
Obtain management approval to proceed

II - Business Impact Analysis


(BIA)
Goal: obtain formal agreement
with senior management on the
MTD for each time-critical
business resource
MTD maximum tolerable
downtime, also known as MAO
(Maximum Allowable Outage)

II - Business Impact Analysis


(BIA)
Quantifies loss due to business
outage (financial, extra cost of
recovery, embarassment)
Does not estimate the probability
of kinds of incidents, only
quantifies the consequences

II - BIA phases
Choose information gathering methods
(surveys, interviews, software tools)
Select interviewees
Customize questionnaire
Analyze information
Identify time-critical business functions

II - BIA phases (continued)


Assign MTDs
Rank critical business functions
by MTDs
Report recovery options
Obtain management approval

III Recovery strategies


Recovery strategies are based on
MTDs
Predefined
Management-approved

III Recovery strategies


Different technical strategies
Different costs and benefits
How to choose?
Careful cost-benefit analysis
Driven by business requirements

III Recovery strategies


Strategies should address
recovery of:
Business operations
Facilities & supplies
Users (workers and end-users)
Network, data center (technical)
Data (off-site backups of data and
applications)

III Recovery strategies


Technical recovery strategies scope
Data center
Networks
Telecommunications

III Recovery strategies


Technical recovery strategies
methods
Subscription services
Mutual aid agreements
Redundant data centers
Service bureaus

III Recovery strategies


Technical recovery strategies
subscription service sites
Hot fully equipped
Warm missing key components
Cold empty data center
Mirror full redundancy
Mobile trailer full of computers

III Recovery strategies


Technical recovery strategies
mutual aid agreements
Ill help you if youll help me!
Inexpensive
Usually not practical

III Recovery strategies


Technical recovery strategies
redundant processing centers
Expensive
Maybe not enough spare capacity
for critical operations

III Recovery strategies


Technical recovery strategies
service bureaus
Many clients share facilities
Almost as expensive as a hot site
Must negotiate agreements with
other clients

III Recovery strategies


Technical recovery strategies
data
Backups of data and applications
Off-site vs. on-site storage of media
How fast can data be recovered?
How much data can you lose?
Security of off-site backup media
Types of backups (full, incremental,
differential, etc.)

IV BCP development /
implementation
Detailed plan for recovery
Business & service recovery plans
Maintenance
Awareness & training
Testing

IV BCP development /
implementation
Sample plan phases
Initial disaster response
Resume critical business ops
Resume non-critical business ops
Restoration (return to primary site)
Interacting with external groups
(customers, media, emergency
responders)

V BCP final phase


Testing
Maintenance
Awareness
Training

V BCP final phase - testing


Until its tested, you dont have a plan
Kinds of testing
Structured walk-through
Checklist
Simulation
Parallel
Full interruption

V BCP final phase maintenance

Fix problems found in testing


Implement change management
Audit and address audit findings
Annual review of plan
Build plan into organization

V BCP final phase - training


BCP team is probably the DR
team
BCP training must be on-going
BCP training needs to be part of
the standard on-boarding and part
of the corporate culture

References
Official (ISC)2 Guide to the CISSP
Exam

Tips for passing the CISSP exam


Dont underestimate the difficulty
Dont procrastinate studying
Do take practice exams
Do read at least one of the prep books
cover to cover twice
Do form a study group
Do use active study methods

You might also like