Business Continuity & Disaster Recovery Planning - Using BS 25999 – 1 Code Of Practice As A Model

1. Business Continuity & Disaster Recovery Planning Using BS 25999 – 1 Code Of Practice As A Model Presenter: Dipankar Ghosh Date: 16/11/2008

4. The BCM Lifecycle

6. The BCM Lifecycle

9. The BCM Lifecycle

11. The BCM Lifecycle

13. Understanding The Incident Timeline INCIDENT OCCURS INCIDENT RESPONSE BUSINESS CONTINUITY RECOVERY/RESUMPTION – BUSINESS AS USUAL TIMELINE Incident Timeline – 3 main phases over time WITHIN MINUTES TO HOURS: STAFF/VISITORS ACCOUNTED FOR, CASUALTIES DEALT WITH DAMAGE CONTAINMENT/LIMITATION, DAMAGE ASSESSMENT, INVOCATION OF BCP WITHIN MINUTES TO DAYS: CONTACT STAFF, CUSTOMERS, SUPPLIERS ETC., RECOVERY OF CRITICAL BUSINESS PROCESSES, REBUILD LOST WORK IN PROGRESS WITHIN WEEKS TO MONTHS: DAMAGE REPAIR/REPLACEMENT, RELOCATION TO PERMANENT PLACE OF WORK, RECOVERY OF COSTS FROM INSURERS Overall Recovery Objective: Back to normal as quickly as possible PURPOSE OF PLAN – MANAGE THE INITIAL, ACUTE PHASE OF THE INCIDENT PURPOSE OF PLAN – RECOVER/MAINTAIN ACTIVITIES TO REACH NORMAL BUSINESS OPERATIONS

16. The BCM Lifecycle

19. Exercising (Testing), Maintaining And Reviewing Types and methods of exercising BCM strategies ANUALLY OR LESS DEFINED OPERATIONS FROM ALTERNARIVE SITE FOR A FIXED TIME INVOCATION IN CONTROLLED SITUATION – NOT DISRUPT NORMAL BUSINESS EXERCISE CRITICAL ACTIVITIES MEDIUM ANUALLY OR LESS - BUILDING/CAMPUS/EXCLUSION ZONE-WIDE EXERCISE EXERCISE FULL BCP INCLUDING INCIDENT MANAGEMENT ANNUALLY/BI-ANNUALLY INCOPRPORATE ASSOCIATED PLANS USE OF ‘ARITIFICIAL’ SITUATION TO VALIDATE BCP TO VERFY THAT RECOVERY WILL BE SUCCESSFUL SIMULATION ANNUALLY INCLUDE INTERACTION AND VALIDATE PARTICIAPNT’S ROLE CHALLENEGE BCP CONTENT WALK-THROUGH OF PLAN COMPLEX AT LEAST ANNUALLY ANNUALLY UPDATE/ VALIDATION AUDIT/ VERIFICATION REVIEW/AMEND CONTENT CHALLENGE BCP CONTENT DESK CHECK SIMPLE GOOD PRACTICE FREQUENCY VARIANTS PROCESS EXERCISE COMPLEXITY

20. The BCM Lifecycle