BCP Lifecycle

When the building is gone

Business continuity planning (BCP) answers those questions before the flood, while there’s time to think clearly.

BCP vs DRP

• Business continuity planning keeps the organisation’s critical processes running, or gets them back quickly, after a disruption. It covers people, premises, processes, suppliers and technology.
• Disaster recovery planning (DRP) is the IT part: restoring systems, data, networks and IT facilities so they can support the business recovery. DRP is a subset of BCP and must follow its priorities.

Related plans include incident response, crisis management and communication, and emergency response and evacuation.

The life cycle

What comes first? After management commitment and policy, the business impact analysis. It identifies what matters and how fast it must come back, and everything after it depends on that. Choosing a recovery site before the BIA is putting the cart before the horse.

Who owns what

• Senior management is responsible for business continuity: it approves the policy and plans and provides the resources.
• Business process owners decide which processes are critical and set recovery requirements through the BIA. IT doesn’t decide this.
• A BCP coordinator or committee runs the programme.
• IT builds and maintains the DRP to meet the business’s requirements.
• Internal audit reviews it all independently.

What the plan contains

• scope, objectives and assumptions
• when the plan is activated, and who can declare a disaster
• teams, roles and responsibilities, with deputies
• contact lists: staff, suppliers, customers, authorities
• recovery procedures for critical processes, in priority order
• resources needed: sites, equipment, records, staff
• internal and external communication
• how to return to normal operations

Copies must be kept offsite and with key staff. A plan stored only on the server that just failed is useless.

Plans go stale fast

Update the plan after changes to the organisation, staff and contact details, systems and infrastructure, suppliers and premises, and after every test and real incident. An untested, out-of-date plan gives very little assurance.

Example. A company’s BCP was written three years ago. Since then, payroll has moved to a SaaS provider, head office has relocated, and half the people on the contact list have left. The plan is approved and nicely formatted, but would fail in a real event. The finding is about maintenance, not content.

Standards

ISO 22301 sets out requirements for a business continuity management system (BCMS) and can be certified against. ISO/IEC 27031 covers ICT readiness for business continuity.

How the exam asks about it

In short

• Business continuity planning (BCP) makes sure critical business processes can continue or resume after a disruption; disaster recovery planning (DRP) covers recovery of IT.
• The BCP life cycle: policy and scope, business impact analysis, risk assessment, strategy selection, plan development, training and awareness, testing, and maintenance.
• The business impact analysis is the key early step: it identifies critical processes and sets recovery priorities and objectives.
• Senior management is responsible for BCP; business process owners own recovery requirements; IT supports with DRP.
• A plan must be tested, kept current with organisational and system changes, and distributed with copies stored offsite.
• ISO 22301 is the standard for business continuity management systems.

Exam traps

• The FIRST step after getting management commitment is the business impact analysis, not choosing a recovery site.
• IT doesn't decide which business processes are critical; the business does, through the BIA.
• BCP covers people, facilities, processes and suppliers, not just IT.
• An untested plan gives little assurance; the most important ongoing activity is testing and maintenance.
• Plan copies must be available offsite; a plan stored only on the affected server is useless.

Slides

Click the slide and use the arrow keys. F toggles full screen.