-
8/9/2019 7.3-Business Continuity Planning Presentation 1
1/22
BCPBCP
PGDBM Family BusinessPGDBM Family Business
NMIM & HSNMIM & HS
Hemant BinnaniHemant Binnani
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
2/22
What is a BCP?What is a BCP?
Planning for disaster and determining in advance what should bePlanning for disaster and determining in advance what should bedone so decisions are made without haste and mistakes.done so decisions are made without haste and mistakes.
It is NOT a Task It is a Project It must be treated likeIt is NOT a Task It is a Project It must be treated likeone. It must be funded and approved at the highest levels of theone. It must be funded and approved at the highest levels of the
organization.organization. If you are going to gain the benefits of the BCP process youIf you are going to gain the benefits of the BCP process you
must do it right. Your livelihood, your employees livelihood,must do it right. Your livelihood, your employees livelihood,your customers, your vendors, and all of these peoples familiesyour customers, your vendors, and all of these peoples familiesare relying on you to do it right.are relying on you to do it right.
You must go through the Critical Thinking of the Plan inYou must go through the Critical Thinking of the Plan inorder to reap the rewards.order to reap the rewards.
Planning is not narrowly focused. It is thinking through all thatPlanning is not narrowly focused. It is thinking through all thatcan go wrong.can go wrong.
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
3/22
Planning vs. Failing to PlanPlanning vs. Failing to Plan
The companies that have planned you neverThe companies that have planned you never
hear about they handled the disaster with littlehear about they handled the disaster with little
interruptioninterruption Banks, FI, MNC , Deluge of 26/7 etcBanks, FI, MNC , Deluge of 26/7 etc
The companies that fail to planMake theThe companies that fail to planMake theheadlinesheadlines
Boston GlobeBoston Globe Released credit card informationReleased credit card information
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
4/22
Making The CaseMaking The Case You MUSTYou MUST
Answer These Questions!Answer These Questions! What are we getting for our money and time?What are we getting for our money and time? What measurable results will we be gaining from thisWhat measurable results will we be gaining from this
investment?investment? How can we be assured that it will be effectiveHow can we be assured that it will be effective What are the consequences if we do not do this at all, or put itWhat are the consequences if we do not do this at all, or put it
off for another month or year or until we have more time?off for another month or year or until we have more time?
What are the alternatives?What are the alternatives?
Who willWho will championchampion the project?the project? In the event of a disaster, how important is it for us to deliver onIn the event of a disaster, how important is it for us to deliver on
our mission statement promises?our mission statement promises? Why is it important now? We have gone all these years withoutWhy is it important now? We have gone all these years without
it. What has changed?it. What has changed?
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
5/22
Purpose ofBusiness Continuity PlanPurpose ofBusiness Continuity Plan
Provide for continuity of critical functions and systems in the event of aProvide for continuity of critical functions and systems in the event of adisaster.disaster.
Minimize the impact of a disaster.Minimize the impact of a disaster. Maximize uptime of critical functions.Maximize uptime of critical functions. Build better understanding of the business and risks to the business byBuild better understanding of the business and risks to the business by
owners, managers and staff.owners, managers and staff. Provide an efficient transition from normal to emergency conditions and backProvide an efficient transition from normal to emergency conditions and back
again.again. Provide guidelines for complex and unpredictable issues.Provide guidelines for complex and unpredictable issues. Provide checklists for courses of action to ensure consistency in actionProvide checklists for courses of action to ensure consistency in action Establish a threshold for which an emergency response is triggered.Establish a threshold for which an emergency response is triggered.
Determine who may authorized a response and who does what during theDetermine who may authorized a response and who does what during theresponse.response.
Prevent activity inconsistent with the philosophy of your company.Prevent activity inconsistent with the philosophy of your company. Teaching your employees how to think through issues and determineTeaching your employees how to think through issues and determine
potential plans.potential plans.
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
6/22
Threats to Business ContinuityThreats to Business Continuity
P
otential
Disasters???P
otential
Disasters???
PhysicalPhysical Hurricanes, Earthquakes, Tornadoes, Floods, Tornado, Drought, VolcanoHurricanes, Earthquakes, Tornadoes, Floods, Tornado, Drought, Volcano Arsonist, Terrorist, Pandemic (Bird Flu or other)Arsonist, Terrorist, Pandemic (Bird Flu or other)
Mistakes (Fire, Flood, etc)Mistakes (Fire, Flood, etc) Loss of PowerLoss of Power
Loss of key employee's), loss of critical partners/suppliers, loss of criticalLoss of key employee's), loss of critical partners/suppliers, loss of critical
customercustomer TechnicalTechnical
Device Failure, Loss of Communications LinesDevice Failure, Loss of Communications Lines Hackers (Obtaining your database and using it for Identity theft, Paralyzing yourHackers (Obtaining your database and using it for Identity theft, Paralyzing your
computer systems)computer systems) Others: Backup not working when you need to do a restore,, Failure to meetOthers: Backup not working when you need to do a restore,, Failure to meet
regulatory requirements,W
hat else?regulatory requirements,W
hat else? EmotionalEmotional
Employee Strike, Vandals, Disgruntled EmployeesEmployee Strike, Vandals, Disgruntled Employees
Office Pool winning the lotteryOffice Pool winning the lottery Customer Data Compromised causing major law suit and/or public humiliationCustomer Data Compromised causing major law suit and/or public humiliation
and subsequent loss of large percentage of customersand subsequent loss of large percentage of customers
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
7/22
Lesson we learnLesson we learn
Some companies never recoverSome companies never recoverHowever, those that plan can recover.However, those that plan can recover.
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
8/22
ExamplesExamples
Hurricanes hit Florida in 2004Hurricanes hit Florida in 2004 extensive damageextensive damage Indian Ocean tsunami Dec 2004Indian Ocean tsunami Dec 2004 struck with complete surprisestruck with complete surprise California summer 2001California summer 2001 Rolling power outages Many companies simplyRolling power outages Many companies simply
were not preparedwere not prepared Attacks Sept 11, 2001Attacks Sept 11, 2001 The world was shocked! Thousands loose their lifeThe world was shocked! Thousands loose their life
and thousands of businesses went under. Most of the businesses that wentand thousands of businesses went under. Most of the businesses that wentunder were not even in NY. The economic crash after this horrific eventunder were not even in NY. The economic crash after this horrific eventforced them under.forced them under.
CitiGroup (June 2005) tells 3.9 million customers it has lost backup tapesCitiGroup (June 2005) tells 3.9 million customers it has lost backup tapeswhich has their personal information including loan applicationswhich has their personal information including loan applications
Hurricane and ensuing floods that hit the southern US in 2005 devastatedHurricane and ensuing floods that hit the southern US in 2005 devastated
hundreds of thousands of people and put thousands of companies out ofhundreds of thousands of people and put thousands of companies out ofbusiness.business. 26/7 , floods in Bombay26/7 , floods in Bombay
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
9/22
Critical ThinkingCritical Thinking Do You Have APlan?Do You Have APlan? Equipment malfunction or unavailable equipmentEquipment malfunction or unavailable equipment Unavailable utilities (HVAC, power, Communications lines)Unavailable utilities (HVAC, power, Communications lines)
Facility becomes unavailableFacility becomes unavailable Inspectors find asbestos in your ceiling and you are required to close immediatelyInspectors find asbestos in your ceiling and you are required to close immediately
Water main bursts outside your officeWater main bursts outside your office
Power line hit by a truck and falls on your front doorPower line hit by a truck and falls on your front door
Power transformer blows outside your front doorPower transformer blows outside your front door
Gas leak from next doorGas leak from next door Building next door burns downBuilding next door burns down
Critical personnel become unavailableCritical personnel become unavailable
Vendors and service providers become unavailableVendors and service providers become unavailable Software and / or data corruptionSoftware and / or data corruption
Bad Publicity!!!!Bad Publicity!!!! MultiMulti--million dollar lawsuitmillion dollar lawsuit
Customers go to competition in drovesCustomers go to competition in droves
True or otherwise and your stock plummetsTrue or otherwise and your stock plummets
Competitor under cuts you to try to put you out of business!!!Competitor under cuts you to try to put you out of business!!!
Your biggest local competitor goes out of business because of a disaster Can youYour biggest local competitor goes out of business because of a disaster Can youhandle the influx of new customers?handle the influx of new customers?
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
10/22
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
11/22
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
12/22
Start To Finish ProcessStart To Finish Process
Project Initiation and ManagementProject Initiation and Management Risk Evaluation and ControlRisk Evaluation and Control Business Impact AnalysisBusiness Impact Analysis
Developing Business Continuity Management StrategiesDeveloping Business Continuity Management Strategies
Emergency Response and OperationsEmergency Response and Operations Developing and Implementing Business Continuity and CrisisDeveloping and Implementing Business Continuity and Crisis
ManagementManagement
Awareness and Training ProgramsAwareness and Training Programs
Maintaining and Exercising PlansMaintaining and Exercising Plans Crisis CommunicationsCrisis Communications
Coordination with External AgenciesCoordination with External Agencies
Test, Tweak, Test, Tweak Do not let it get stale.Test, Tweak, Test, Tweak Do not let it get stale.
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
13/22
Project Initiation ActivitiesProject Initiation Activities
Review of Existing BCPReview of Existing BCP (if available)(if available) [no matter how lacking it may be][no matter how lacking it may be]
Benefits of Developing a Business Continuity PlanBenefits of Developing a Business Continuity Plan
BCP Policy StatementBCP Policy Statement
Establish Preliminary GoalsEstablish Preliminary Goals
Preliminary BCP Project BudgetPreliminary BCP Project Budget
Financial BuyFinancial Buy--inin
Identify the TeamIdentify the Team Procedure for Approving BCP ContentProcedure for Approving BCP Content
Communication on BCP Project to All EmployeesCommunication on BCP Project to All Employees
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
14/22
Selecting The TeamSelecting The Team
Thought ProcessThought Process By DepartmentBy Department By Area of ResponsibilityBy Area of Responsibility
By Critical ComponentBy Critical Component
Team LeaderTeam Leader Self motivatedSelf motivated Big PictureBig Picture Organizational SkillsOrganizational Skills
Effective CommunicatorEffective Communicator Have or given authority to make decisionsHave or given authority to make decisions
Able to assign tasks and followAble to assign tasks and follow--up: Including pushing others to do their tasksup: Including pushing others to do their tasks
Able to multiAble to multi--task (must think about BCP all day every day)task (must think about BCP all day every day) Team MembersTeam Members
Member from each department (does not have to be the manager)Member from each department (does not have to be the manager) Must have companies best interest at heart and not individual or departmentMust have companies best interest at heart and not individual or department
desiresdesires
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
15/22
PlanPlan Recovery and continuity planning requirementsRecovery and continuity planning requirements Business impact analysisBusiness impact analysis
Selecting developing and implementing disasterSelecting developing and implementing disaster
and continuity plansand continuity plansTypes of drills and testsTypes of drills and tests
Final Steps to insure plan does not go staleFinal Steps to insure plan does not go stale
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
16/22
WorksheetsWorksheets
Password Lists / Rules to manage sensitive listPassword Lists / Rules to manage sensitive list Administrator RulesAdministrator Rules Phone List / Vendor ListsPhone List / Vendor Lists
Critical Elements Application FunctionsCritical Elements Application Functions Risk AssessmentRisk Assessment Skills Inventory ListSkills Inventory List Packing List / LocationsPacking List / Locations
Disaster Initiation Roles / Responsibilities / SequenceDisaster Initiation Roles / Responsibilities / Sequence Communication TreeCommunication Tree Recovery Initiation Roles / Responsibility / SequenceRecovery Initiation Roles / Responsibility / Sequence
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
17/22
Helpful InformationHelpful Information
Local PoliceLocal Police
Local FireLocal Fire
Local HospitalLocal Hospital ICE nos.ICE nos.
Escalation MatrixEscalation Matrix
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
18/22
Tips Of The Day!Tips Of The Day!
Backup media and important business records should be stored in an offBackup media and important business records should be stored in an off--sitesitefacility at least 50 miles away!facility at least 50 miles away!
All tape backups should be password protected!All tape backups should be password protected! All tapes and/or other important business information should be transportedAll tapes and/or other important business information should be transported
keeping them safe. (If using nonkeeping them safe. (If using non--secure vehicle, put them in a portable safesecure vehicle, put them in a portable safe
for transport)for transport) You should TEST your backup strategy at least monthly!You should TEST your backup strategy at least monthly! When to develop Activate your BCP Make sure you move CriticalWhen to develop Activate your BCP Make sure you move Critical
Functions to the alternate location FIRST. When you Recover from yourFunctions to the alternate location FIRST. When you Recover from youralternate location move your Critical Functions back LAST!alternate location move your Critical Functions back LAST!
You must go through the Critical Thinking of the Plan in order to reap theYou must go through the Critical Thinking of the Plan in order to reap the
rewards so make a commitment today to get it started.rewards so make a commitment today to get it started. Dont put off till tomorrow what can be done today!Dont put off till tomorrow what can be done today! Take a look at the next two slides!!!Take a look at the next two slides!!!
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
19/22
Action Items: Next Step Action Items: Next Step Do you understand the costs associated with this project? To get the project started, the costs are almost ($0.00) zero dollDo you understand the costs associated with this project? To get the project started, the costs are almost ($0.00) zero dollarsars. The. The
initial commitment is in time. You may need help from a consultant to get you started but this presentation was more informainitial commitment is in time. You may need help from a consultant to get you started but this presentation was more informatiotionnthat you could get out of your first 8 hours with a consultant. Use it to your advantage. If you cannot get started Spend athat you could get out of your first 8 hours with a consultant. Use it to your advantage. If you cannot get started Spend a lilittlettlemoney to get help, once it is done you will be the hero for being so concerned about the company and doing things right!money to get help, once it is done you will be the hero for being so concerned about the company and doing things right!
Review all the slides to get ideas of what fits in your organizationReview all the slides to get ideas of what fits in your organization
Review Slide #3 Answer as many questions as you can. The most important is: What are we getting for our money and time?Review Slide #3 Answer as many questions as you can. The most important is: What are we getting for our money and time?
Remember ROI If you cannot find the ROI, you will not be successful. In order to do this you may haveRemember ROI If you cannot find the ROI, you will not be successful. In order to do this you may haveto review the mission statement and even casually interview executives to find out what is important toto review the mission statement and even casually interview executives to find out what is important tothem. (tell them it is for a school project if you have to in order to get their cooperation) During thisthem. (tell them it is for a school project if you have to in order to get their cooperation) During this
interview ask questions that make them think Such as:interview ask questions that make them think Such as: What would we do if our closest and biggest competitor went out of business because of a fire orWhat would we do if our closest and biggest competitor went out of business because of a fire or
whatever? Would we be able to capitalize on the new business? Is there a plan or is the plan to justwhatever? Would we be able to capitalize on the new business? Is there a plan or is the plan to justscramble? If there is not a plan, ask Do you think we would be in better shape if we had a plan inscramble? If there is not a plan, ask Do you think we would be in better shape if we had a plan inplace? How much business do you think we could handle? If we had a plan, how much bigger mightplace? How much business do you think we could handle? If we had a plan, how much bigger mightthat number be? How long would it take us to bring the new business on? Would those newthat number be? How long would it take us to bring the new business on? Would those newprospects wait for us to get to them or would they go elsewhere?prospects wait for us to get to them or would they go elsewhere?
If Avian Bird Flu hits our area and 40% of our workforce is at home or in the hospital and anotherIf Avian Bird Flu hits our area and 40% of our workforce is at home or in the hospital and another20% is out because of illness in the family, do we have a plan to continue on? What kind of impact20% is out because of illness in the family, do we have a plan to continue on? What kind of impact
would this have on our organization? If of these people were out for 6 weeks or more and somewould this have on our organization? If of these people were out for 6 weeks or more and somedied, do we have a plan to deal with the emotional stresses of this environment?died, do we have a plan to deal with the emotional stresses of this environment?
Did you know that we (MA) are on a major fault line? Do you know the projections for damage if anDid you know that we (MA) are on a major fault line? Do you know the projections for damage if anEarthquake happens in the Bombay area? Does the company have a plan on how to deal with thisEarthquake happens in the Bombay area? Does the company have a plan on how to deal with thisdisaster?disaster?
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
20/22
Very Important..Review..Very Important..Review..
If we had a fire at our locationIf we had a fire at our location
What would be the result in terms of customer satisfaction, our mission, livelihood of our employees and theirWhat would be the result in terms of customer satisfaction, our mission, livelihood of our employees and theirfamilies?families?
Would something like this put us out of business?Would something like this put us out of business? Where would we setup shop?Where would we setup shop? Where is the data we would need to continue on?Where is the data we would need to continue on? If nothing survived the fire, would we still be able to get to the data (through offsite backup)?If nothing survived the fire, would we still be able to get to the data (through offsite backup)? How long would we be out of business?How long would we be out of business? How many customer would we lose in this amount of time?How many customer would we lose in this amount of time? How many prospects would we lose in this amount of time.How many prospects would we lose in this amount of time. What is the cost associated with this type of loss?What is the cost associated with this type of loss? What would your first call be? Second call?What would your first call be? Second call? Would everyone know what to do?Would everyone know what to do? If everyone did know what to do, how much quicker do you think we could be back up and running?If everyone did know what to do, how much quicker do you think we could be back up and running? What is the cost difference between knowing what to do and not knowing in terms of lost sales, emotionalWhat is the cost difference between knowing what to do and not knowing in terms of lost sales, emotional
stress, customer confidence, etc?stress, customer confidence, etc?
When presenting it is usually the simple things that go wrong and you fix that is the mainWhen presenting it is usually the simple things that go wrong and you fix that is the mainselling point. Because people do not believe the big things can happen to them.selling point. Because people do not believe the big things can happen to them.
Organize the team yourself and get input from others to help you sell the concept. Just likeOrganize the team yourself and get input from others to help you sell the concept. Just likethese questions have made you think Make them think!!! This is the most important part ofthese questions have made you think Make them think!!! This is the most important part ofthe entire process.the entire process.
If there is already a plan for any of these issues, some of your work is already done. Get theIf there is already a plan for any of these issues, some of your work is already done. Get thedetails and add it to your overall plan!details and add it to your overall plan!
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
21/22
Credits Where the info came fromCredits Where the info came from
Book: The Disaster Recovery HandbookBook: The Disaster Recovery Handbook Michael Wallace and Lawrence WebberMichael Wallace and Lawrence Webber
Book: Business Continuity PlanningBook: Business Continuity Planning Kenneth L. FulmerKenneth L. Fulmer
Book: Diaster Recovery PlanningBook: Diaster Recovery Planning Jon WilliamJon WilliamToigoToigo
Book: CISSPBook: CISSP All In OneAll In One Shon HarrisShon Harris Many years of personal and professionalMany years of personal and professional
experienceexperience
-
8/9/2019 7.3-Business Continuity Planning Presentation 1
22/22
Any Questions ??Any Questions ??
Thank u..Thank u..