Business Continuity Planning Project

“Kick-off Meeting”

September 15, 2010

Robert T. Warren, Technical Risk Services, Inc.

Paul Cleary, Horn IT Solutions, Inc.

Objectives of Today’s Meeting

• Discuss the importance of business continuity planning

• Provide an overview of the business continuity planning process

• Discuss project plan including composition of working groups

Business Continuity Planning

Definitions:Emergency Plan – what to do when it hits the

fanDisaster Recovery Plan – what to do to get it

back to normalCrisis Management Plan – what to tell peopleBusiness Continuity Plan – what to do in the

meantime

Business Continuity Planning

Business Continuity Planning

“A business continuity plan should be an essential element of any business strategy… I cannot think of any reason not to be prepared, but 60 billion reasons why we should.”

Perrin Beatty, President & CEO, CME

Reasons to Plan• Protect your investment

• Protect your livelihood

• Legal obligations

• Fulfill essential services

• Stakeholder obligations

• Satisfy financial partners

• Reputation

• Meet increased demand

Business Continuity Planning

Understanding the Risks

Risks Associated with People

Risks Associated with Weather

Risks Associated with Outside Forces

Understanding YOUR Risks

What risks are you most vulnerable to?

Understanding YOUR Risks

Consider:

• The location of your operations.• Nature of your business activities.• Likelihood of an event occurring. • Severity of the consequences.

Business Impact Analysis

Identify Business Processes:

If you lose this process…

• What is the impact to the organization?

• What is the tolerable downtime?

Identify Critical Business Processes

Business Impact Analysis Criteria:

• Customer Service• Legal Obligations• Revenue • Expenses • Stakeholders• Reputation

Identify Resources Required to Maintain Critical

Processes• Documentation• Human resources• Equipment• Facilities• Supplies• IT and communications infrastructure• Applications• Transportation

Strategies for Business Recovery

How do we temporarily replace the necessary resources…

• In the most efficient manner, and

• Within the tolerable recovery timeframe

Disaster Avoidance Strategies

Some examples…

• Backup and recovery strategies• Off-site storage• Fire suppression• Physical security• Network security• Information life-cycle management – know what

information is important and where it is• Equipment life-cycle management – service contracts,

warranties, service level agreements• Redundancy - elimination of single points of failure

Notification Strategies

Establish BCP Team and emergency communications such as…

• Public broadcasters/Emergency broadcasters• Phone trees• Emails• Blackberry PIN messages• Text messages• Web site postings• Employee polling/roll call• Notification Services (e.g. Message One)

Communication and Collaboration Strategies

• Contact lists• Cell phones• VoIP – voice over IP• Telecommuting/VPN remote access• Laptop policy – home every night• On-line collaborative tools (e.g. Sharepoint)• Instant Messenger• Video conferencing

Human Capital Continuity Strategies

• Cross training• Mutual aid• Contractors• Temp agencies• Outsourcing• Employment policies – sick leave, on-

call

Equipment Continuity Strategies

• Inventory lists – know what you need• Warranties, service guarantees, and

service level agreements• Equipment sparing/caching• Clustering• Virtualization

Facility Continuity Strategies

• Temporary facilities

• Mutual aid

• Geographic diversity

Application Continuity Strategies

• Backup and recovery• Off-site storage• Co-location• Data synchronization• Redundancy – clustering• Virtualization• Monitoring• Geographic diversity• Outsourcing

Records Continuity Strategies

• Life-cycle management• Off-site storage• Electronic storage • On-line access• Version control

Writing the Plan

• Have a Program not a Plan• Use a collaboration tool• Make it accessible in times of

emergency• Consider using BCP software

Maintaining and Testing the Plan

• Bake the maintenance of the plan into your other business processes

• Set up a routine testing cycle• Vary the types of testing you do –

desktop reviews to full scenario simulations

• Use resources from outside your organization

Next Steps: Develop Project Plan

• Select participants for each stage of the project.

• Establish project timelines.

• Schedule the working group sessions.

Thank you!