Definitions[]
A business continuity plan (BCP)
| “ | [is t]he documentation of a predetermined set of instructions or procedures that describe how an organization’s business functions will be sustained during and after a significant disruption.[1] | ” |
| “ | [is a] comprehensive written plan to maintain or resume business in the event of a disruption. BCP includes both the technology recovery capability (often referred to as disaster recovery) and the business unit(s) recovery capability.[2] | ” |
| “ | [is the] process of documenting a predetermined set of instructions or procedures that describe how an organization's business functions will be sustained during and after a significant disruption.[3] | ” |
| “ | describes what actions and decisions are needed to ensure critical business operations will continue in the event of a disaster or facility problem. The plan should discuss who has the authority to initiate the activities described in the plan, which operations should be continued, and how to re-establish the operations.[4] | ” |
Overview[]
Business continuity planning addresses the overall issue of maintaining or reestablishing production in the case of an interruption. These interruptions may take the form of a natural disaster (e.g., hurricane, tornado, earthquake, flood), an unintentional man-made event (e.g., accidental equipment damage, fire or explosion, operator error), an intentional man-made event (e.g., attack by bomb, firearm or vandalism, attacker or virus), or an equipment failure. From a potential outage perspective, this may involve typical time spans of days, weeks, or months to recover from a natural disaster, or minutes or hours to recover from a malware infection or a mechanical/electrical failure.
Because there is often a separate discipline that deals with reliability and electrical/mechanical maintenance, some organizations choose to define business continuity in a way that excludes these sources of failure. Because business continuity also deals primarily with the long-term implications of production outages, some organizations also choose to place a minimum interruption limit on the risks to be considered.
Before creating a business continuity plan to deal with potential outages, it is important to specify the recovery objectives for the various systems and subsystems involved based on typical business needs. There are two distinct types of objectives:
Once the recovery objectives are defined, a list of potential interruptions should be created and the recovery procedure developed and described. For most of the smaller scale interruptions, repair and replace activities based on a critical spares inventory will prove adequate to meet the recovery objectives. When this is not true, contingency plans need to be developed. Due to the potential cost and importance of these contingency plans, they should be reviewed with the managers responsible for business continuity planning to verify that they are justified. Once the recovery procedures are documented, a schedule should be developed to test part or all of the recovery procedures. Particular attention must be paid to the verification of backups of system configuration data and product or production data. Not only should these be tested when they are produced, but the procedures followed for their storage should also be reviewed periodically to verify that the backups are kept in environmental conditions that will not render them unusable and that they are kept in a secure location, so they can be quickly obtained by authorized individuals when needed.
References[]
- ↑ NIST Special Publication 800-34.
- ↑ FFIEC, IT Examination Handbook Infobase, Glossary (full-text).
- ↑ DHS Lexicon Terms and Definitions, at 71.
- ↑ California Office of Systems Integration, Definitions (full-text).