Business

Continuity Plan
 The business continuity guideline is a tool to allow
organizations to consider the factors and steps necessary to
prepare for a crisis so that it can manage and survive and
take all appropriate actions to help ensure the organization’s
viability.
The advisory portion of the guideline is divided into two

parts:-
1. The planning Process
2. Successful implementation & Maintenance

Introduction
 Needs: CEO’s &
Earlier: Draft a response plan Shareholders must be
for
prepared for
§ Natural Disasters §Budget
§ Intentional caused disasters §Secure Necessary resources
§ Accidents §Administrative Structure
Now: Require the creation of §Be volunteer regardless of
process that is §Profit/Non-profit
§ Ongoing §Faith
§ Interactive §Government
§ Assure the continuation of core §Higher SMEs from outside
activities of org.
§ Before §Delegate Authorities for
§ During decision making to
§ After major crises someone responsible

Purpose of Business Continuity

Plan (BCP) Understand Major Terms
 1. Assign accountability
2. Perform risk assessment
3. Conduct business impact analysis
Developing the plan
4. Agree on strategic plan
5. Crisis management & Response Team development
6. Mitigation Strategies
7. Avoidance, Deterrence & Detection
8. Potential crisis recognition
9. Communication
10.Resource Management
11.Financial Support
12.Financial Issues and Insurance
13.Supplier/Service Providers
14.Mutual Aid Agreement
15.Damage and impact assessment

Practice Advisory-1
16.Resumption of critical & Remaining Process
17.Return to normal operations
(The Planning Process)
1. Corporate Policy
2. Ownership of Systems, Processes, Resources
3. Communicate BCP

Assign Accountability
1. Review types of risks that could impact the business
(Matrix Analysis)

Perform Risk Assessment

1. Identify Critical Process
2. Assess Impact if Crisis were to happen
3. Define Maximum Allowable Outage & Recovery time
Objectives
4. Identify Resources Required for Resumption and
Recovery

Conduct Business Impact

Analysis (BIA)
1. Methods to Mitigate
2. Plans & procedures to respond
1. Attainable
2. Highly probable
3. Verifiable
4. Cost Effective
5. Appropriate

Agree on strategic plan

1. Contact Information
2. Compliance with corporate policy

Crisis Management and

Response Team
development
1. Device Mitigation Strategies
2. Resources needed for mitigation
3. Monitoring Systems and Resources
1. Emergency Equipment
2. Alarms
3. Local Resources and Vendors
4. Alternate Work Sites
5. Maps & Floor plans
6. System backups and offsite storage

Mitigation Strategies
1. Workplace Violence
2. Activism, Protests, Riots
3. Hostile Takeover
4. Terrorism
5. Lawsuits

Avoidance, Deterrence
and Detection
1. Identification and recognition of Danger Sign
2. Responsibility to recognize and report potential crisis
3. Notify the terms
4. Parameter for notification
5. Custody and updates to contact Information
6. Types of Notification
7. Assess the situation
8. Declare the crisis
9. Execute the plan

Potential Crisis
Recognition
1. Identify the Audiences
2. Internal/External
3. Communicating with Audiences
4. Official Spoke Person

Communication
1. The human element
2. Accounting for all individuals
3. Notification of Next-of-Kin
4. Family Representatives
5. Crisis counseling

Resource Management
1. Payroll
2. Logistics
3. Crisis management centers
4. Alternate Worksite
5. Offsite Storage

Financial Support
1. Funding
2. Insurance
3. Transportation
1. Evacuation of personal
2. Transport to alternate worksite
3. Supplies to site/alternate site
4. Transportation of critical data
5. Transportation of staff with special needs
4. Medical

Financial Issues and

Insurance
1. List of critical vendors
2. Contact Information of vendors
3. Pass-Codes
4. Credit Limits

Supplies and Service

Providers
1. Borrowing Resources
2. Mutual Supports
3. Legally Sound & Well Documented
4. Representatives

Mutual Aid Agreement

1. Crisis Involving Physical Damage
2. Crisis Involving Non-Physical Damages

Damage and impact

Assessment
1. Resumption of critical Processes
2.Resumption of Remaining Processes

Resumption of critical &

Remaining Process
1. Crisis officially declared over
2. Back to New Normal
1. Restructured Structure
2. Redefined Policies and Standards
3. Back into productive Work

Return to Operations
1. Educate & train
2. Test the BCP
3. Develop BCP Review Schedule
4. Develop BCP Maintenance Schedule

Practice Advisory-2
(Implementation and maintenance)
 1. Educate & Train teams
2. Educate & Train all personals

Educate and train

 1. Benefits of testing
2. Goal & Expectations
3. Planning & Development
4. Timeline
5. Scope of testing
6. Test Monitoring
7. Test & Exercise Scenarios
8. Test & Exercise Roles
9. Test & Exercise Participation
10.Test & Exercise Evaluation
11.Ongoing Development of Test Schedule

Test the BCP

 1. Risk Assessment
2. Sector/Industry trends
3. Regulatory Requirements
4. Event Experience
5. Test/Exercise Results

Develop BCP Review

Schedule
 1. HW/SW Changes
2. Org./Business Process Change
3. Personnel Change
4. Supplier Change
5. Critical Lessons learned from testing
6. Issues discovered during implementation of plan in
crisis
7. Change to External Environment
8. Other items noted/identified during review of plan and
risk assessment

Develop BCP
Maintenance Schedule