Tag: business continuity plan

Understanding IT Business Continuity Plan

A business continuity plan in information technology is a documented plan indicating how a business will continue to operate if IT operation is affected by adverse conditions, such as a storm, fire, interruptions or malicious damage. Such a plan typically explains how the business would operate at the time of disaster and recover from disaster.

In December 2006, the British Standards Institution (BSI) released an independent standard for BCP — BS 25999-1. Prior to the introduction of BS 25999, BCP professionals relied on information security standard BS 7799, which only peripherally addressed BCP to improve an organization’s information security procedures. BS 25999’s applicability extends to all organizations. In 2007, the BSI published BS 25999-2 “Specification for Business Continuity Management”, which specifies requirements for implementing, operating and improving a documented business continuity management system (BCMS).

Which one you need? Business Continuity or Disaster Recovery?

If you ask me, I would prefer to have a Business Continuity Plan that includes a disaster recovery with a smooth fail-over and fail-back option and a service continuity procedures as if disaster never happened.

Most organization will presume that they have Symantec/CommVault/Veeam Backup which protect them from disaster hence they have a disaster recovery plan. This is not the case “Disaster Recovery Plan” or “Business Continuity Plan” does not mean having just only a backup product and presume you have it all.

Note! Disaster Recovery is just part of Business Continuity. My previous post on disaster recovery plan differentiate between disaster recovery and business continuity.

Objectives:

  • To ensure maximum possible service levels are maintained
  • To ensure a smooth recovery from interruptions as quickly as possible
  • To minimize the likelihood and impact (risk) of interruptions
  • To minimize IT/IS service desk intervention with end user in the event of disaster

Identifying Risk (Example):

Create a spreadsheet and a database of business application, systems, network and other assets that likely be impacted by an event. Here is a sample spread sheet.

List of Assets Disaster/Event Priority Action ID Responsibility Procedure Document ID Mitigation Procedure Document ID
Microsoft Exchange Server Medium EXCH0001 Exchange Admin IT-EXCH-DR-001 IT-EXCH-BC-001

Technology Acquisition as BC Plan (Example):

Technology Provider Purpose Contract Reference Warranty & Support
Smart Host Symantec Backup MX and email archive up to 30 days XX-SS-XX 3 Years
Site Recovery Manager VMware Infrastructure Fail-over & Fail-back XX-SS-XX 3 Years
Storage Replication EMC Infrastructure Fail-over & Fail-back XX-SS-XX 3 Years
Data Backup EMC Bare Metal Instant Recovery XX-SS-XX 3 Years
SQL Cluster Microsoft Active-Active cluster Enterprise Agreement 3 Years
SharePoint Cluster Microsoft Active-Active cluster Enterprise Agreement 3 Years

Risk Work Sheet (Example):

Risk Loss of Building
Probability Low
Impact High
Likely Scenario Fire
Action
  • Auto-activate infrastructure failover to DR Site
  • Auto-activate cloud based smart host for Microsoft messaging
  • Automatically failover clustered telephony to DR site
  • Auto-answering machine and voice mail continue to operate via smart host and Lync services
  • Clustered core switch continue to operate in DR site
  • End user continue to operate seamlessly
Responsibility List of onsite engineer

List of on call Engineer

Service Delivery Manager

Operation Manager
Mitigation Test controlled fail-over

Test clustered systems and network

Monitor health of the systems and network
Resources List of documents and location where they stored

Third Party Contact (Example):

Technology Vendor Technical Support
Microsoft Exchange Microsoft 132058
IPVPN Provider Company X Xxxxxx
Smart Host Symantec Xxxxxx

IT Contact List (Example):

Name Designation Contact Number Email Address
Mr. X XX 12345678

Business Continuity Document: A Business Continuity Plan contain the following information. An example is shown below.

  1. Title
  2. Sub-Title
  3. Corporate Logo
  4. Document history.
  5. Corporate Copyright Info
  6. Table of Content
  7. Executive Summary
  8. Introduction
  9. Terminology
  10. Roles and responsibilities.
  11. Risk Management Plan
  12. Business Impact Analysis
  13. Incident Response Plan
  14. Plan activation.
  15. Communication Procedures
  16. Logic Diagram
  17. Recovery Plan
  18. Test & Evaluate
  19. Appendixes.