Information Technology Reference
In-Depth Information
downtime. The other end of the strategy spectrum contains disaster recovery ser-
vices (e.g., quick ship). Although it is less complex to ship replacement equipment
than maintain duplicates for failover, there are inherent delays in ordering, ship-
ping, and installing. Budget constraints apply as well, with high-availability solu-
tions typically more expensive than recovery solutions.
The results of a BIA include:
n
Identify key business functions and their dependencies on information, key
personnel, and key infrastructure, where infrastructure includes physical and
information technology.
Identify single points of failure for key business functions and their
dependencies.
Discern and explain the impact of disruption to key business functions.
Determine organizational risk tolerance and express in terms of downtime
tolerance, uptime objectives, and recovery time objectives.
Document and report on expected organizational outcomes as a result of key
business functions, e.g., services, products.
Determine dependencies on key business functions.
Key customers, vendors, or partners
Document who is accountable for key business functions (management
and operations) in terms of decision makers and adjudicators for continuity
decisions.
n
n
n
n
n
−
n
A useful by-product of the BIA is greater awareness of the purpose behind the
organization. Such an objective awareness is useful in continuity and recovery, as
well as in making everyday business decisions.
8.14
Business Continuity Management
Business continuity planning (BCP) determines cost-effective means to keep opera-
tions going in the event of adverse conditions with an initial goal of no or very low
interruption to the business workflow (high availability); that failing, BC evolves
to disaster recovery options involving perhaps some delay, but still with the same
focus of maintaining operations.
Planning a response, not reaction, mitigates risk! The objective of a business
continuity program is to minimize organizational loss due to business interrup-
tion. A threat probability assessment (see chapter 5) provides insight into potential
business interruption causes. For most organizations, the probability of business
interruption is low. Therefore, justification for business continuity comes from the
level of potential loss in the event of interruption. Business continuity planning
provides business value by minimizing uncertainty during the stress of business
interruption. Armies may train for years without the threat of war; however, such
