Description
The disruption COVID-19 caused has made businesses more aware of the importance of business continuity planning (BCP) for effective disruption-related preparation, response and recovery.
Although the term “business continuity” is often used as a synonym for IT Disaster recovery (DR), business continuity planning extends well beyond technology-related disruptions.
Businesses that do not effectively prepare for potential business disruptions are exposed to substantial loss of life, assets, revenues and reputation and may even fail to survive the disruption.
This document serves as a guide for business continuity planning (BCP) as part of holistic business continuity management (BCM) program.
Contents
Overview
– Context
– Key definitions
– Relationship between key business continuity activities
– Business continuity activation and escalation path
– Overall business continuity planning process
1. Initial Preparation
– Key elements
– Business continuity policy inputs and output
2. Business Impact Analysis
– Key steps
– Inputs and outputs
– Identify critical business functions and resources
– Identify critical business functions and dependencies
– Impact of and recovery from a sudden disruption
– Impact of and recovery from a gradual disruption
– Identify impact of disruption on critical business functions over time
– Identify impact of disruption on critical business functions at RTO
– Methods to utilize
3. Continuity Risk Assessment (CRA)
– High level risk management (RA) process
– Inputs and outputs
– Examples of hazards/threats
– High-level process
– Key steps
– Threats before existing mitigation
– Threats after existing mitigation
– Risk likelihood versus impact matrix
– Single dimension likelihood criteria example-
– Single dimension impact criteria example
– Multiple impact criteria example
– Risk rating matrix
– Organizational risk tolerance
4. Business Continuity Strategies
– Risk treatment options
– Common strategy types
– Examples of strategies
– Role of the BIA and CRA
– Immediate mitigation by critical business function/hazard type
– Ongoing mitigation by critical business function/hazard type
5. Plan development
– Multiple coordinated plans
– Emergency response activities over time
– Common Business continuity plan elements
– Example communications plan
6. Awareness and Training
– Examples of awareness mechanisms
– Training audience and topics
7. Exercising and Testing
– Benefits
– Key steps
– Examples of methods
8. Audit and Review
– Aims
– Examples of types
9. Maintenance
– Aims
– Key steps
