SEC 420 - Data Integrity and Disaster Recovery

Introduction to Business Continuity Management

• What Is Business Continuity Management?
• How Is Business Continuity Implemented?
• Criticality
• Severity Levels
• Scenarios and Risks
• The Five Possible Outcome Scenarios
• The Importance of Time
• Who Does What?
• When Do You Do BCM?
• Standards
• BCM vs. Disaster Recovery
• Where Do You Stand Today? Take the Continuity Assessment
• Start with the Essentials
• Senior Management Involvement
• Employee Buy-in Plan

Foundations of Disaster Recovery and Business Planning

• Understand What’s Critical
• Completing a BIA
• Analyzing the BIA
• Risk Analysis
• Residual Risk
• What a Business Continuity Plan Should Include
• Essential Ingredients of a BCP
• Structuring Your BCP
• Identify What Will Trigger Your BCP
• Create Battle Boxes and Grab Bags
• Create a One-Page Wallet Plan
• Mitigate Risk
• Identify Roles
• Have Accountable Managers Approve Plans
• What Is DR?
• Risks and Issues Associated with DR
• DR Solutions for IT
• Basic DR Concepts and Technology
• DR Roles and Responsibilities
• DR and Projects
• Documenting DR Risks
• Preparing a DR Business Case
• Undertake a DR Project
• The Change Process
• Get DR Going Live
• What Does Business Recovery Involve?
• Understand Resilient Functions
• Understand Recoverable Functions
• Employ Manual Workarounds
• Size Your Solution
• Business Recovery Options
• Remediation: Identify Gaps in the Plan
• Prepare a Business Continuity Business Case

Ensuring Continuity and Governance in Disaster Recovery

• Have a Plan in Place
• Assessing Third-Party Risk
• Business Continuity and Contracts
• Selecting Business Continuity Suppliers
• Demand Good Service
• The Point of Education
• Education and Awareness Program
• What Are Your Needs?
• Measuring Education and Awareness
• Create a Policy
• Set Standards and Create Processes
• Assign Steering and Management Accountability
• Assess Maturity Annually
• Manage Information
• Audit Plans and Actions Regularly

Testing Strategies for IT and Business Continuity

• Why Test?
• You Must Be a Realist
• What Testing Proves
• Types of Testing
• Testing Scenarios
• Conduct Desktop Walkthrough Exercises
• Leveraging Scenarios
• Apply Basic Project Management Tools to Disaster Recovery Tests
• Assign Disaster Recovery Testing Roles and Responsibilities
• Use Scenario-Based Disaster Recovery Testing
• Plan DR Tests Well
• Engage Management in the Disaster Recovery Test
• Provide the Right Resources
• Manage Test Risk
• Report Results Quickly
• Apply Basic Project Management Tools to Work Area Recovery Tests
• Assign Work Area Recovery Testing Roles and Responsibilities
• Observation Roles and Responsibilities for Work Area Recovery Tests
• Use Scenario-Based Testing for Work Area Recovery
• Engage Management in Work Area Recovery Tests
• Engage Users in Work Area Recovery Testing
• Provide the Right Resources
• Manage Test Risks
• Report Results Quickly
• Closing a Work Area Recovery Test

Crisis Preparedness and Plan Sustainability

• Key Elements in Crisis Management Exercises
• Choose a Meaningful Crisis Scenario
• People Need a Successful Outcome
• Developing the Crisis Management Team
• Improving the Crisis Management Process
• Make Sure Exercise Materials Are Appropriate
• Employ Quality Inputs to the Exercise
• Use Timeouts
• Engage Management
• Rotate Participants
• Conduct Crisis Exercises Frequently
• Report Frequently and Accurately
• Exercise Roles and Responsibilities
• Closing a Crisis Exercise
• Never Forget: Disaster Recovery Is an Essential Function
• Review Change Management Processes and Controls
• Identify Events that Trigger Business Continuity Management Reviews
• Maintain Your Business Continuity Plan
• Business Recovery Solution Maintenance
• Maintain Your Information Technology Disaster Recovery Solution
• Maintain Your Crisis Management Plan
• Maintain Your Policies

Disaster Response and Management

• Identification and Notification
• Triage
• Command and Control
• Records
• Postmortem
• Responding to Different Scenarios

Post-Event Recovery and Normalization

• Understanding the Different Planning Scenarios
• Consider the Ongoing Risks
• Planning the Return to Normal
• Maintaining Command and Control

Appendix A: Criticality Levels

Appendix B:​ Roles and Responsibility Matrix

• Key to Activity
• Key to Roles

Appendix C: Suggested Business Continuity Management Timetable

Appendix D: Useful Resources and Contacts

• Business Continuity Organizations
• Business Continuity Standards
• National, Regional, Government, and Law
• Financial Services and Insurance
• Emergency Planning
• Fire and Flood
• Publications, Websites, White Papers, and Guidance

Appendix E: Continuity Assessment Questionnaire

Appendix F: Crisis Management Team Roles and Responsibilities

Appendix G: Call Cascade

Appendix H: Basic Business Continuity Plan Template

• Key Contacts
• Useful Numbers
• Escalation Process
• Initial Response Checklist
• Day 0 Action Plan
• Critical Activities List
• Critical Systems List
• Work Transfer List
• Recovery Profile
• Additional Equipment List
• Call Cascade
• Contingency Site Details
• Assembly Point Details

Appendix I: Business Impact Analysis Questionnaire

• General Information: Function name:
• Critical Activities
• Internal Dependencies
• External Dependencies
• Systems Dependencies
• Manual Workarounds
• Work Transfer
• Desktop Profile
• Staff Recovery Profile
• Recovery Strategy
• Additional Requirements

Appendix J: Business Continuity Management Standards

Appendix K: Severity Levels

Appendix L: Mapping Severity Levels to Criticalities