7.3-business continuity planning presentation 1

8/9/2019 7.3-Business Continuity Planning Presentation 1

1/22

BCPBCP

PGDBM Family BusinessPGDBM Family Business

NMIM & HSNMIM & HS

Hemant BinnaniHemant Binnani


2/22

What is a BCP?What is a BCP?

Planning for disaster and determining in advance what should bePlanning for disaster and determining in advance what should bedone so decisions are made without haste and mistakes.done so decisions are made without haste and mistakes.

It is NOT a Task It is a Project It must be treated likeIt is NOT a Task It is a Project It must be treated likeone. It must be funded and approved at the highest levels of theone. It must be funded and approved at the highest levels of the

organization.organization. If you are going to gain the benefits of the BCP process youIf you are going to gain the benefits of the BCP process you

must do it right. Your livelihood, your employees livelihood,must do it right. Your livelihood, your employees livelihood,your customers, your vendors, and all of these peoples familiesyour customers, your vendors, and all of these peoples familiesare relying on you to do it right.are relying on you to do it right.

You must go through the Critical Thinking of the Plan inYou must go through the Critical Thinking of the Plan inorder to reap the rewards.order to reap the rewards.

Planning is not narrowly focused. It is thinking through all thatPlanning is not narrowly focused. It is thinking through all thatcan go wrong.can go wrong.


3/22

Planning vs. Failing to PlanPlanning vs. Failing to Plan

The companies that have planned you neverThe companies that have planned you never

hear about they handled the disaster with littlehear about they handled the disaster with little

interruptioninterruption Banks, FI, MNC , Deluge of 26/7 etcBanks, FI, MNC , Deluge of 26/7 etc

The companies that fail to planMake theThe companies that fail to planMake theheadlinesheadlines

Boston GlobeBoston Globe Released credit card informationReleased credit card information


4/22

Making The CaseMaking The Case You MUSTYou MUST

Answer These Questions!Answer These Questions! What are we getting for our money and time?What are we getting for our money and time? What measurable results will we be gaining from thisWhat measurable results will we be gaining from this

investment?investment? How can we be assured that it will be effectiveHow can we be assured that it will be effective What are the consequences if we do not do this at all, or put itWhat are the consequences if we do not do this at all, or put it

off for another month or year or until we have more time?off for another month or year or until we have more time?

What are the alternatives?What are the alternatives?

Who willWho will championchampion the project?the project? In the event of a disaster, how important is it for us to deliver onIn the event of a disaster, how important is it for us to deliver on

our mission statement promises?our mission statement promises? Why is it important now? We have gone all these years withoutWhy is it important now? We have gone all these years without

it. What has changed?it. What has changed?


5/22

Purpose ofBusiness Continuity PlanPurpose ofBusiness Continuity Plan

Provide for continuity of critical functions and systems in the event of aProvide for continuity of critical functions and systems in the event of adisaster.disaster.

Minimize the impact of a disaster.Minimize the impact of a disaster. Maximize uptime of critical functions.Maximize uptime of critical functions. Build better understanding of the business and risks to the business byBuild better understanding of the business and risks to the business by

owners, managers and staff.owners, managers and staff. Provide an efficient transition from normal to emergency conditions and backProvide an efficient transition from normal to emergency conditions and back

again.again. Provide guidelines for complex and unpredictable issues.Provide guidelines for complex and unpredictable issues. Provide checklists for courses of action to ensure consistency in actionProvide checklists for courses of action to ensure consistency in action Establish a threshold for which an emergency response is triggered.Establish a threshold for which an emergency response is triggered.

Determine who may authorized a response and who does what during theDetermine who may authorized a response and who does what during theresponse.response.

Prevent activity inconsistent with the philosophy of your company.Prevent activity inconsistent with the philosophy of your company. Teaching your employees how to think through issues and determineTeaching your employees how to think through issues and determine

potential plans.potential plans.


6/22

Threats to Business ContinuityThreats to Business Continuity

P

otential

Disasters???P

otential

Disasters???

PhysicalPhysical Hurricanes, Earthquakes, Tornadoes, Floods, Tornado, Drought, VolcanoHurricanes, Earthquakes, Tornadoes, Floods, Tornado, Drought, Volcano Arsonist, Terrorist, Pandemic (Bird Flu or other)Arsonist, Terrorist, Pandemic (Bird Flu or other)

Mistakes (Fire, Flood, etc)Mistakes (Fire, Flood, etc) Loss of PowerLoss of Power

Loss of key employee's), loss of critical partners/suppliers, loss of criticalLoss of key employee's), loss of critical partners/suppliers, loss of critical

customercustomer TechnicalTechnical

Device Failure, Loss of Communications LinesDevice Failure, Loss of Communications Lines Hackers (Obtaining your database and using it for Identity theft, Paralyzing yourHackers (Obtaining your database and using it for Identity theft, Paralyzing your

computer systems)computer systems) Others: Backup not working when you need to do a restore,, Failure to meetOthers: Backup not working when you need to do a restore,, Failure to meet

regulatory requirements,W

hat else?regulatory requirements,W

hat else? EmotionalEmotional

Employee Strike, Vandals, Disgruntled EmployeesEmployee Strike, Vandals, Disgruntled Employees

Office Pool winning the lotteryOffice Pool winning the lottery Customer Data Compromised causing major law suit and/or public humiliationCustomer Data Compromised causing major law suit and/or public humiliation

and subsequent loss of large percentage of customersand subsequent loss of large percentage of customers


7/22

Lesson we learnLesson we learn

Some companies never recoverSome companies never recoverHowever, those that plan can recover.However, those that plan can recover.


8/22

ExamplesExamples

Hurricanes hit Florida in 2004Hurricanes hit Florida in 2004 extensive damageextensive damage Indian Ocean tsunami Dec 2004Indian Ocean tsunami Dec 2004 struck with complete surprisestruck with complete surprise California summer 2001California summer 2001 Rolling power outages Many companies simplyRolling power outages Many companies simply

were not preparedwere not prepared Attacks Sept 11, 2001Attacks Sept 11, 2001 The world was shocked! Thousands loose their lifeThe world was shocked! Thousands loose their life

and thousands of businesses went under. Most of the businesses that wentand thousands of businesses went under. Most of the businesses that wentunder were not even in NY. The economic crash after this horrific eventunder were not even in NY. The economic crash after this horrific eventforced them under.forced them under.

CitiGroup (June 2005) tells 3.9 million customers it has lost backup tapesCitiGroup (June 2005) tells 3.9 million customers it has lost backup tapeswhich has their personal information including loan applicationswhich has their personal information including loan applications

Hurricane and ensuing floods that hit the southern US in 2005 devastatedHurricane and ensuing floods that hit the southern US in 2005 devastated

hundreds of thousands of people and put thousands of companies out ofhundreds of thousands of people and put thousands of companies out ofbusiness.business. 26/7 , floods in Bombay26/7 , floods in Bombay


9/22

Critical ThinkingCritical Thinking Do You Have APlan?Do You Have APlan? Equipment malfunction or unavailable equipmentEquipment malfunction or unavailable equipment Unavailable utilities (HVAC, power, Communications lines)Unavailable utilities (HVAC, power, Communications lines)

Facility becomes unavailableFacility becomes unavailable Inspectors find asbestos in your ceiling and you are required to close immediatelyInspectors find asbestos in your ceiling and you are required to close immediately

Water main bursts outside your officeWater main bursts outside your office

Power line hit by a truck and falls on your front doorPower line hit by a truck and falls on your front door

Power transformer blows outside your front doorPower transformer blows outside your front door

Gas leak from next doorGas leak from next door Building next door burns downBuilding next door burns down

Critical personnel become unavailableCritical personnel become unavailable

Vendors and service providers become unavailableVendors and service providers become unavailable Software and / or data corruptionSoftware and / or data corruption

Bad Publicity!!!!Bad Publicity!!!! MultiMulti--million dollar lawsuitmillion dollar lawsuit

Customers go to competition in drovesCustomers go to competition in droves

True or otherwise and your stock plummetsTrue or otherwise and your stock plummets

Competitor under cuts you to try to put you out of business!!!Competitor under cuts you to try to put you out of business!!!

Your biggest local competitor goes out of business because of a disaster Can youYour biggest local competitor goes out of business because of a disaster Can youhandle the influx of new customers?handle the influx of new customers?


10/22


11/22


12/22

Start To Finish ProcessStart To Finish Process

Project Initiation and ManagementProject Initiation and Management Risk Evaluation and ControlRisk Evaluation and Control Business Impact AnalysisBusiness Impact Analysis

Developing Business Continuity Management StrategiesDeveloping Business Continuity Management Strategies

Emergency Response and OperationsEmergency Response and Operations Developing and Implementing Business Continuity and CrisisDeveloping and Implementing Business Continuity and Crisis

ManagementManagement

Awareness and Training ProgramsAwareness and Training Programs

Maintaining and Exercising PlansMaintaining and Exercising Plans Crisis CommunicationsCrisis Communications

Coordination with External AgenciesCoordination with External Agencies

Test, Tweak, Test, Tweak Do not let it get stale.Test, Tweak, Test, Tweak Do not let it get stale.


13/22

Project Initiation ActivitiesProject Initiation Activities

Review of Existing BCPReview of Existing BCP (if available)(if available) [no matter how lacking it may be][no matter how lacking it may be]

Benefits of Developing a Business Continuity PlanBenefits of Developing a Business Continuity Plan

BCP Policy StatementBCP Policy Statement

Establish Preliminary GoalsEstablish Preliminary Goals

Preliminary BCP Project BudgetPreliminary BCP Project Budget

Financial BuyFinancial Buy--inin

Identify the TeamIdentify the Team Procedure for Approving BCP ContentProcedure for Approving BCP Content

Communication on BCP Project to All EmployeesCommunication on BCP Project to All Employees


14/22

Selecting The TeamSelecting The Team

Thought ProcessThought Process By DepartmentBy Department By Area of ResponsibilityBy Area of Responsibility

By Critical ComponentBy Critical Component

Team LeaderTeam Leader Self motivatedSelf motivated Big PictureBig Picture Organizational SkillsOrganizational Skills

Effective CommunicatorEffective Communicator Have or given authority to make decisionsHave or given authority to make decisions

Able to assign tasks and followAble to assign tasks and follow--up: Including pushing others to do their tasksup: Including pushing others to do their tasks

Able to multiAble to multi--task (must think about BCP all day every day)task (must think about BCP all day every day) Team MembersTeam Members

Member from each department (does not have to be the manager)Member from each department (does not have to be the manager) Must have companies best interest at heart and not individual or departmentMust have companies best interest at heart and not individual or department

desiresdesires


15/22

PlanPlan Recovery and continuity planning requirementsRecovery and continuity planning requirements Business impact analysisBusiness impact analysis

Selecting developing and implementing disasterSelecting developing and implementing disaster

and continuity plansand continuity plansTypes of drills and testsTypes of drills and tests

Final Steps to insure plan does not go staleFinal Steps to insure plan does not go stale


16/22

WorksheetsWorksheets

Password Lists / Rules to manage sensitive listPassword Lists / Rules to manage sensitive list Administrator RulesAdministrator Rules Phone List / Vendor ListsPhone List / Vendor Lists

Critical Elements Application FunctionsCritical Elements Application Functions Risk AssessmentRisk Assessment Skills Inventory ListSkills Inventory List Packing List / LocationsPacking List / Locations

Disaster Initiation Roles / Responsibilities / SequenceDisaster Initiation Roles / Responsibilities / Sequence Communication TreeCommunication Tree Recovery Initiation Roles / Responsibility / SequenceRecovery Initiation Roles / Responsibility / Sequence


17/22

Helpful InformationHelpful Information

Local PoliceLocal Police

Local FireLocal Fire

Local HospitalLocal Hospital ICE nos.ICE nos.

Escalation MatrixEscalation Matrix


18/22

Tips Of The Day!Tips Of The Day!

Backup media and important business records should be stored in an offBackup media and important business records should be stored in an off--sitesitefacility at least 50 miles away!facility at least 50 miles away!

All tape backups should be password protected!All tape backups should be password protected! All tapes and/or other important business information should be transportedAll tapes and/or other important business information should be transported

keeping them safe. (If using nonkeeping them safe. (If using non--secure vehicle, put them in a portable safesecure vehicle, put them in a portable safe

for transport)for transport) You should TEST your backup strategy at least monthly!You should TEST your backup strategy at least monthly! When to develop Activate your BCP Make sure you move CriticalWhen to develop Activate your BCP Make sure you move Critical

Functions to the alternate location FIRST. When you Recover from yourFunctions to the alternate location FIRST. When you Recover from youralternate location move your Critical Functions back LAST!alternate location move your Critical Functions back LAST!

You must go through the Critical Thinking of the Plan in order to reap theYou must go through the Critical Thinking of the Plan in order to reap the

rewards so make a commitment today to get it started.rewards so make a commitment today to get it started. Dont put off till tomorrow what can be done today!Dont put off till tomorrow what can be done today! Take a look at the next two slides!!!Take a look at the next two slides!!!


19/22

Action Items: Next Step Action Items: Next Step Do you understand the costs associated with this project? To get the project started, the costs are almost ($0.00) zero dollDo you understand the costs associated with this project? To get the project started, the costs are almost ($0.00) zero dollarsars. The. The

initial commitment is in time. You may need help from a consultant to get you started but this presentation was more informainitial commitment is in time. You may need help from a consultant to get you started but this presentation was more informatiotionnthat you could get out of your first 8 hours with a consultant. Use it to your advantage. If you cannot get started Spend athat you could get out of your first 8 hours with a consultant. Use it to your advantage. If you cannot get started Spend a lilittlettlemoney to get help, once it is done you will be the hero for being so concerned about the company and doing things right!money to get help, once it is done you will be the hero for being so concerned about the company and doing things right!

Review all the slides to get ideas of what fits in your organizationReview all the slides to get ideas of what fits in your organization

Review Slide #3 Answer as many questions as you can. The most important is: What are we getting for our money and time?Review Slide #3 Answer as many questions as you can. The most important is: What are we getting for our money and time?

Remember ROI If you cannot find the ROI, you will not be successful. In order to do this you may haveRemember ROI If you cannot find the ROI, you will not be successful. In order to do this you may haveto review the mission statement and even casually interview executives to find out what is important toto review the mission statement and even casually interview executives to find out what is important tothem. (tell them it is for a school project if you have to in order to get their cooperation) During thisthem. (tell them it is for a school project if you have to in order to get their cooperation) During this

interview ask questions that make them think Such as:interview ask questions that make them think Such as: What would we do if our closest and biggest competitor went out of business because of a fire orWhat would we do if our closest and biggest competitor went out of business because of a fire or

whatever? Would we be able to capitalize on the new business? Is there a plan or is the plan to justwhatever? Would we be able to capitalize on the new business? Is there a plan or is the plan to justscramble? If there is not a plan, ask Do you think we would be in better shape if we had a plan inscramble? If there is not a plan, ask Do you think we would be in better shape if we had a plan inplace? How much business do you think we could handle? If we had a plan, how much bigger mightplace? How much business do you think we could handle? If we had a plan, how much bigger mightthat number be? How long would it take us to bring the new business on? Would those newthat number be? How long would it take us to bring the new business on? Would those newprospects wait for us to get to them or would they go elsewhere?prospects wait for us to get to them or would they go elsewhere?

If Avian Bird Flu hits our area and 40% of our workforce is at home or in the hospital and anotherIf Avian Bird Flu hits our area and 40% of our workforce is at home or in the hospital and another20% is out because of illness in the family, do we have a plan to continue on? What kind of impact20% is out because of illness in the family, do we have a plan to continue on? What kind of impact

would this have on our organization? If of these people were out for 6 weeks or more and somewould this have on our organization? If of these people were out for 6 weeks or more and somedied, do we have a plan to deal with the emotional stresses of this environment?died, do we have a plan to deal with the emotional stresses of this environment?

Did you know that we (MA) are on a major fault line? Do you know the projections for damage if anDid you know that we (MA) are on a major fault line? Do you know the projections for damage if anEarthquake happens in the Bombay area? Does the company have a plan on how to deal with thisEarthquake happens in the Bombay area? Does the company have a plan on how to deal with thisdisaster?disaster?


20/22

Very Important..Review..Very Important..Review..

If we had a fire at our locationIf we had a fire at our location

What would be the result in terms of customer satisfaction, our mission, livelihood of our employees and theirWhat would be the result in terms of customer satisfaction, our mission, livelihood of our employees and theirfamilies?families?

Would something like this put us out of business?Would something like this put us out of business? Where would we setup shop?Where would we setup shop? Where is the data we would need to continue on?Where is the data we would need to continue on? If nothing survived the fire, would we still be able to get to the data (through offsite backup)?If nothing survived the fire, would we still be able to get to the data (through offsite backup)? How long would we be out of business?How long would we be out of business? How many customer would we lose in this amount of time?How many customer would we lose in this amount of time? How many prospects would we lose in this amount of time.How many prospects would we lose in this amount of time. What is the cost associated with this type of loss?What is the cost associated with this type of loss? What would your first call be? Second call?What would your first call be? Second call? Would everyone know what to do?Would everyone know what to do? If everyone did know what to do, how much quicker do you think we could be back up and running?If everyone did know what to do, how much quicker do you think we could be back up and running? What is the cost difference between knowing what to do and not knowing in terms of lost sales, emotionalWhat is the cost difference between knowing what to do and not knowing in terms of lost sales, emotional

stress, customer confidence, etc?stress, customer confidence, etc?

When presenting it is usually the simple things that go wrong and you fix that is the mainWhen presenting it is usually the simple things that go wrong and you fix that is the mainselling point. Because people do not believe the big things can happen to them.selling point. Because people do not believe the big things can happen to them.

Organize the team yourself and get input from others to help you sell the concept. Just likeOrganize the team yourself and get input from others to help you sell the concept. Just likethese questions have made you think Make them think!!! This is the most important part ofthese questions have made you think Make them think!!! This is the most important part ofthe entire process.the entire process.

If there is already a plan for any of these issues, some of your work is already done. Get theIf there is already a plan for any of these issues, some of your work is already done. Get thedetails and add it to your overall plan!details and add it to your overall plan!


21/22

Credits Where the info came fromCredits Where the info came from

Book: The Disaster Recovery HandbookBook: The Disaster Recovery Handbook Michael Wallace and Lawrence WebberMichael Wallace and Lawrence Webber

Book: Business Continuity PlanningBook: Business Continuity Planning Kenneth L. FulmerKenneth L. Fulmer

Book: Diaster Recovery PlanningBook: Diaster Recovery Planning Jon WilliamJon WilliamToigoToigo

Book: CISSPBook: CISSP All In OneAll In One Shon HarrisShon Harris Many years of personal and professionalMany years of personal and professional

experienceexperience


22/22

Any Questions ??Any Questions ??

Thank u..Thank u..

7.3-business continuity planning presentation 1

Documents