DocumentB

State of Oregon Business Continuity Training Academy

Desk Reference

Workshop #1

Prepared by:

DigitalCare, Inc.427 N. Weber St

Colorado Springs, CO 80903719-477-9477

Copyright 2006 – DigitalCare, Inc. – All Rights ReservedNo part of these materials may be reproduced, distributed or transmitted in any form without the prior written consent of DigitalCare, Inc. This document and the accompanying educational seminar are intended to provide guidance and direction. The information contained in this document is not intended as legal advice.

0

Table of Contents

Contents PageIntroduction/Welcome LetterChapter 1: Course Overview

Course Overview and ScheduleDetailed Workshop 1 Schedule

Chapter 2: The What and Why of BCPIntroduction to Disasters and EventsBusiness Continuity Planning: Preliminary Risk Assessment WorksheetBCP Mandates, Directives and LegislationBCP Overview – Additional Reading Material

Chapter 3: Planning for BCPBusiness Continuity Planning PhasesBusiness Continuity Planning ChecklistEstablishing and Defining BCP Goals WorksheetBCP Overview Quiz

Chapter 4: Planning and Managing a BCP ProjectA Planner’s RoleBudget ConsiderationsInitial Project Planning WorksheetPlanning Team’s ResponsibilitiesPlanning Team’s DocumentationPlanning Team’s ChecklistResponse Team’s ResponsibilitiesResponse Team’s Checklist

Chapter 5: Workshop 2 TopicsBusiness Function StatementAgency Critical Business Function (CBF) WorksheetRisk Information Checklist

Chapter 6: Glossary of Terms


1

Dear Course Attendee:

Welcome to the State of Oregon’s Business Continuity Training Academy. This course is designed to give you a working understanding of BCP, and how it applies to your various work functions. This course will cover topics including:

The What and Why of BCP Business Impact Analysis and Risk Assessments Business Continuity Planning and Strategies Continuation of Operation Plan (COOP), Emergency Response and Crisis

Communications Plan Maintenance and Training

At the end of this course, you will have a greater awareness of the importance of disaster mitigation and BC plans. You will have a developed understanding of the business continuity process and how it applies to your job functions. Ultimately, this course will enable you to write a complete plan for your own business processes and in turn, create a more secure government BCP infrastructure for the State of Oregon.

The State of Oregon’s Business Continuity Training Academy consists of five workshops. Each workshop will focus on one specific aspect of Business Continuity, and each workshop will contain two, one-day sessions. In total, the course contains ten one-day sessions over the course of a five month period.

Please feel free to contact us at anytime with questions, issues or concerns.

Thanks,Jennifer CollinsPartnerDigitalCare, Inc.Phone: 402-328-0058Email: [email protected]

Doug LandolfiPresidentDigitalCare, Inc.Phone: 719-477-9477Email: [email protected]


2

mailto:[email protected]

mailto:[email protected]

Chapter 1: Course Overview

Course Overview and Schedule

Workshop Session Date OutlineWorkshop #1: What and Why of BCP

Session #1 June 13 - Course Goals, Format and Outcomes

- Course Overview- Business Continuity Plan

Structure- The Oregon BCP Tool

Session #2 June 14 - Planning and Managing a BCP Project

Workshop #2: Business Impact Analysis and Risk Assessment

Session #3 July 12 - Business Impact Analysis

Session #4 July 13 - Risk Management and Risk Assessment

Workshop #3: Business Continuity Planning and Strategies

Session #5 August 15 - Mapping and Prioritizing Business Functions

- Mitigation and Recovery Strategies

Session #6 August 16 - Bringing a Plan TogetherWorkshop #4: Continuation of Operation Plan (COOP), Emergency Response and Crisis Communications

Session #7 September 19 - Continuation of Operation Plan

- Emergency Response

Session #8 September 20 - Crisis CommunicationsWorkshop #5:Plan Maintenance and Training

Session #9 October 10 - Final Work Product Reviews

- Maintenance- Testing Methodologies- Writing a Testing Plan

Session #10 October 11 - Training and Awareness- Writing a Training Plan


3

Detailed Workshop #1 ScheduleWorkshop #1: The What and Why of BCP

Session 1Time Topic Curriculum Detail

8:30am Course Goals, Format and Outcomes

This section will include a PowerPoint Presentation on the following topics:- Welcome- Course Overview- Course Schedule- Workshop Outline- Workshop Schedule and Topics- Expected Course Outcomes- Expected Workshop 1 Outcomes

Course Overview - Why You are Here (How this Course is directly relevant to you, your responsibilities and your agency)

1. The Why of BCP This section will include a PowerPoint Presentation on the following topics:- Directives, Legislation and Regulations- Disasters in Oregon- Event Likelihood- Vulnerability and Survivability

In addition, this section will include BCP Case Studies possibly presented via video clips.

Discussion and Questions - Designated time for students to ask questions.Approximately 10:15am – 10:30am

MORNING BREAK

Approximately 10:30am

2. Introduction to and General Principles of BCP

This section will include a PowerPoint Presentation on the following topics:- What is a Business Continuity Plan and why is it

important?- Motivation for Business Continuity Planning- BCP Approaches- All Disasters Approach- Business Continuity Planning Goals

3. Breakout Session/Group Exercise

- Establishing and Defining BCP Goals Worksheet

Discussion and Questions - Designated time for students to ask questions.4. Defining BCP Language This section will include a PowerPoint Presentation on the

following topics:- Explanation and Definition of key BCP terms and

language. Examples include: Disaster Recovery, Emergency Operations and Incident Management

12:00pm – LUNCH BREAK


4

1:00pm1:00pm 5. Business Continuity Plan

Structure6. Elements of a Plan7. BCP Phases

This section will include a PowerPoint Presentation on the following topics:- Business Continuity Planning Phases- Elements of the Business Continuity Plan- Best Practices and Case Studies in BCP

Approximately 3:00pm

AFTERNOON BREAK


Discussion and Questions - Designated time for students to ask questions.

The Oregon BCP Tool8. Vendor9. What the tool does and

doesn’t do10. How it fits into the

overall structure

- TBD based upon selected tool

Discussion and Questions - Designated time for students to ask questions.4:30PM Conclusion for the Day - Instructor(s) will be available for Follow-On discussion

and individual questions, as desired


5

Session 2Time

Topic Curriculum Detail

8:30am Planning and Managing a BCP Project

11. A Planner’s Role

This section will include a PowerPoint Presentation on the following topics:- Coordination and Project Management- Budget Planning- Project Schedule- Success Factors- Pitfalls- Best Practices and Case Studies

12. Breakout Session/Group Exercise

- Initial Project Planning

Discussion and Questions - Designated time for students to ask questions.Approximately 10:15am – 10:30am

MORNING BREAK

Approximately 10:30am

13. Establishing Teams and Roles and Responsibilities

This section will include a PowerPoint Presentation on the following topics:- Importance of teams- Types of Teamso Planning Teams

-BCP Steering Committee-BCP Development-Disaster Recovery-Crisis Management and/or Emergency

Responseo Response Teams

-Damage Assessment/ Salvage Team-Transportation Team-Physical Security Team-Public Information Team-Insurance Team-Telecommunication Team

- Who should participate?- Functions and Roles for each Team- Documenting Teams and their Roles and

Responsibilities14. Breakout Session/Group

Exercise- Project Team Documentation Worksheet

Discussion and Questions - Designated time for students to ask questions.12:00pm – 1:00pm

LUNCH BREAK

1:00pm 15. Executive Commitment This section will include a PowerPoint Presentation on the following topics:- The Politics of BCP


6

- Executive Responsibilities- Why Should Management Care?oLegal RequirementsoVulnerability

- Meeting with Senior ManagementoAgenda, Questions and IssuesoSelling BCP to ManagementoSuccess FactorsoFailure Factors

- A BCP Manager’s Desired ResultsoOverall Buy-in and CommitmentoFunding/Budget approvaloScope approvaloApproval of Draft Schedule

- Follow-up and Additional CommunicationDiscussion and Questions - Designated time for students to ask questions.Introduction to Workshop 2 Topics This section will include a PowerPoint

Presentation on the following topics:- What are “Business Functions”?o Identification of Business Functions

- Risk Assessment OverviewoData Gathering for Risk Assessment

- Business Impact AnalysisoData Gathering for Business Impact

AnalysisApproximately 3:00pm

AFTERNOON BREAK


Review, Discussion and Questions - Review of Workshop 1 information- Designated time for students to ask questions.

Working Time and Homework - Homework assignments will be given- Designated time for students to complete

course worksheets and other assigned homework.

Evaluations - Designated time for students to fill out evaluation forms

4:30PM Conclusion for the Day - Instructor(s) will be available for Follow-On discussion and individual questions, as desired


7

Chapter 2: The What and Why of BCP

Introduction to Disasters and Events

While bombs, fires and floods capture the headlines, almost 90% of crises are nowhere near as dramatic. It is these quiet catastrophes that have the potential to damage your organization’s most valuable assets and reputation. These can be destroyed very quickly unless strongly defended at times when the speed and scale of events can overwhelm normal operational and management systems.

Today, Business Continuity Plans (BCP) are no longer a luxury, but an essential element of the organization’s risk management program. For many organizations, the decision to invest in a business continuity plan is being forced upon them through change in accountability by legislation, third parties, a disaster or near disaster.

Recent research has suggested that on average 20% of all organizations will experience some form of unplanned event once every five years. While it is unlikely to be as catastrophic as 9/11, there is still the need to think about how you would cope with the more mundane events, such as power cuts or transport problems.

The fact that organizations are now so dependant on their IT systems has meant that during the last 20 years the IT department has led the way in planning how to recover from an unplanned event. But restoring data and system access is not enough when there is nowhere for employees to answer the phones or suppliers cannot deliver critical components. Incidents as simple and common as an extended power loss, telecoms failure or the loss of building heating may cause critical business functions to be disabled.

The reasons for creating an effective BCP are many. With the ever increasing dependency on technology in today’s workplace, companies must plan ahead in order to survive unexpected problems. When companies lose computer data in a disaster, 50% never regain it and 60-90% go out of business within two years. 90% of computer outages are the result of power failures, water-pipe leaks, loose cables, and user mistakes. 50% of businesses experiencing a computer outage will be forced to close within 5 years. Online systems fail on an average of nine times per year, with an average of four hours per failure. There are over 200 telecommunications cables cut every day in the U.S. Major systems downtime costs 15% of organizations over $50,000 per hour.

Although a clear organizational boundary exists between the two areas, data security and BC/DR strategies and tactics represent a shared concern because information security risks might well cause an organization to execute its BC/DR plan. Thus, even if a regulation does not specify the kind of business continuity plan (BCP) or how often it must be tested, an organization remains accountable for its systems and processes related to data. The bottom line is that laws and


8

regulations, as well as shareholders, expect organizations to exercise due care to ensure that necessary data is available.


9

Business Continuity Planning: Preliminary Risk Assessment Worksheet

Agency: _____________________________________________________

Individual Completing Survey: ___________________________________

Please describe any business continuity events experienced by your organization. (Please note: these could include both large and small events.)

Examples include: - Technology Issues such as equipment failure, disruption of power supply or

telecommunications equipment, application failure or corruption of database, malicious software (viruses, worms, Trojan horses), hacking or other Internet attacks.

- Human/Workforce issues such as strikes, sabotage or human error that resulted in system downtime.

- Physical/Building Issues such as pipes bursting.- Natural Disasters such as flood, earthquake and hurricanes.- Health/Illness Outbreaks.

Event Business Service Downtime (Yes / No) If yes, please explain

Data Loss (Yes / No) If yes, please explain

Financial Loss (Yes / No) If yes, please explain

Other Types of Loss (Yes / No) If yes, please explain


10

BCP Mandates, Directives and Legislation

Below you will find a list of laws, mandates and directives that directly or indirectly mandate the use of business continuity planning. This table includes specific examples from the healthcare, government, finance and utilities sectors.

Industry Sector

Significant Laws and Regulations

Impact on BCP Comments

Healthcare Health Insurance Portability and Accountability Act (HIPAA) of 1996

Requires data backup plan, DR plan and emergency mode operation plan.Requires reasonable and appropriate measures relative to the size, complexity and resources of the organization.

Requires increased budgets, new job descriptions, as well as additional staff and infrastructure.Typically an IT responsibility but may also be the province of the compliance officer or CFO.

Food and Drug Administration (FDA) Code of Federal Regulations (CFR), Title XXI, 1999

Establishes the requirements for electronic records and electronic signatures.

Acceptability of electronic records and signatures may require that some organizations update their BC measures to ensure the availability of information.

Government Federal Information Security Act (FISMA) of 2002, Title III of the E-Government Act of 2002 (PL 107-347, 17 December 2002)Executive Order on Critical Infrastructure Protection in the Information Age, 16 October 2001

Mostly emphasizes data security rather than BC and DR.An important need to be addressed is the requirement that government is open and running during a crisis.

By and large, state and local governments are free to make their own decisions on data security, BR and continuity of operations (COOP).

COOP and Continuity of Government (COG). Federal Preparedness Circular 69, 26 July 1999

Establishes minimum planning considerations for federal government operations.

BCP must be maintained at a high level of readiness.BCP must be capable of implementation with or without warning.BCP must be operational no more than 12 hours after activation.BCP must maintain


11

sustained operations for up to 30 days.BCP should take maximum advantage of existing agency field infrastructures.

National Institute of Standards and Technology (NIST) Special Publication (SP) 800-34, Contingency Planning Guide for Information Technology Systems, June 2002

Defines detailed recommendations from NIST, requiring contingency, DR and COOP plans.

Joins the NIST SP 800 series (Parts 3, 4, 12, 14, 16, 18 and now 34) in stating these requirements. Focuses on planning.

NIST 800-53, Recommended Security Controls for Federal Information Systems, February 2005

Mandatory security controls will become a federal standard by the end of 2005. NIST 800-53A will provide assessment guidelines that are closely aligned to the controls listed in NIST 800-53.

Gives specific requirements for:- Contingency planning policy and procedures- Contingency plan- Contingency training- Contingency plan testing- Contingency plan update

Finance Federal Financial Institutions Examination Council (FFIEC) Handbook, 2003-2004 (Chapter 10)

Specifies that directors and managers are accountable for organizationwide contingency planning and for "timely resumption of operations in the event of a disaster."

This chapter — on an operational level — supplants many other BCP guidelines. It covers examination requirements for all companies regulated by the Federal Deposit Insurance Corp. (FDIC), Federal Reserve Bank (FRB), Treasury Department, U.S. Office of the Comptroller of the Currency (OCC), Office of Thrift Supervision (OTS) and National Credit Union Administration (NCUA).

Basel II, Basel Committee on Banking Supervision, Sound Practices for Management and Supervision, 2003

Requires that banks put in place BC and DR plans to ensure continuous operation and to limit losses.

After 2007, influence of Basel II will be limited to about 30 U.S. banks but will spread as a best practice via "audit creep."

Interagency Paper on Sound Practices to

More focused on systemic risk than

Influences companies that are regulated by Securities


12

Strengthen the Resilience of the U.S. Financial System, 2003

individual enterprise recovery. Requires BCPs to be upgraded and tested to incorporate risks discovered as a result of the World Trade Center disaster.

and Exchange Commission (SEC), OCC and Board of Governors of the Federal Reserve System (FRS). Authorizes the OCC to take action against banks that fail to comply with requirements for DR by the U.S. financial system.

Expedited Funds Availability (EFA) Act, 1989

Requires federally chartered financial institutions to have a demonstrable BCP to ensure prompt availability of funds.

Utilities Governmental Accounting Standards Board (GASB) Statement No. 34, June 1999

Requires a BCP to ensure that agency mission continues in time of crisis.

Applies to all government entities that operate utilities.

North American Electric Reliability Council (NERC) 1200 (1216.1), 2003

Recovery plans currently voluntary.

Mandatory obligations pending in the energy bill.NERC 1200 due to be replaced by NERC 1300 by the end of 2005.

Federal Energy Regulatory Commission (FERC) RM01-12-00 (Appendix G), 2003

Mandates recovery plans.

Does not apply to Rural Utilities Service (RUS) borrowers and limited distribution cooperatives.

RUS 7 CFR Part 1730, 2005

Emergency restoration plan required as condition of continued borrowing.

Applies to all rural utilities borrowers.

Telecommunications Act of 1996, Section 256, Coordination for Interconnectivity

Requires the Federal Communications Commission (FCC) to establish procedures to oversee coordinated network planning by carriers and other providers.

While it recognizes the need for DR plans, it also acknowledges the existence of inadequate testing because of the rapid deployment of new technologies.

NERC Security Guidelines for the Electricity Sector, June 2001

Includes BC in information security standards for the industry-government partnership (guided by


13

Critical Infrastructure Protection Committee [CIPC]).

Source: Gartner (July 2005)


14

BCP Overview – Additional Reading Material

What Is Business Continuity Planning?By JOHN GLENN

John Glenn is a certified business continuity/disaster recovery planner. He has been involved with business continuity planning since 1994. http://www.drj.com/articles/win02/1501-14.html

There are many articles addressing how to create a business continuity plan, but few actually describe the purpose of business continuity planning. This then is my biased attempt to explain what business continuity is and what it is intended to accomplish; it is not intended to describe a business continuity plan or how a to create a business continuity plan.Business Continuity DefinedBusiness continuity – emphasis on “continuity” – is the ability of a business to continue operations in the face of a disaster condition.

This means a business with a viable business continuity plan will be better able to continue doing what it did before a disaster event while assets damaged by the disaster event are recovered – until “business as usual” is resumed.

Business continuity means: • identifying critical business functions• identifying risks to critical functions• identifying ways to avoid or mitigate the risks• having a plan to continue business in the event of a disaster condition• having a plan to quickly restore operations to “business as usual.”

Disaster recovery is an integral part of business continuity. Business continuity does not replace insurance. It is a form of insurance, and should include insurance for life, health, facilities, product and business interruption.

Disasters vs. Disaster ConditionsA disaster, according to this planner, is any event that results in death or serious injury, or a business going out of business as a result of an event.

A disaster condition is an inconvenience from which everyone and everything can be recovered – not necessarily exactly as before the event, but restored to an equal, or better footing.

“Inconvenience” may be too mild a term for some who experienced a disaster condition, but consider this scenario:

A tornado roars through and flattens the business. If the business has a continuity plan that includes an alternate site, plans to rapidly transfer operations to the site, and includes support services to relieve its employees of worry about their families and possessions, the business can


15

http://www.drj.com/articles/win02/1501-14.html

be doing business within an acceptable time, meeting its customers’ needs and fending off competitors while restoring the operation to “business as usual” condition.

There is an interruption. There most certainly is an inconvenience.There usually is added cost – overtime, rental facilities, expedited ordering and shipping, additional services such as catered meals – but, and this is the critical issue, business continues, income continues – perhaps at a slightly reduced level, but it continues nonetheless. Competitors won’t succeed in stealing the business’ customers due to missed commitments.Was the event – regardless of type: fire, flood, wind, etc. – a disaster? No.Was it a disaster condition? Yes.

Critical Business FunctionsCritical business functions are functions a business must perform in order to stay in business. That means different things to different organizations.

If the business’ primary function – the one that generates income – is to produce valves, then a disruption to valve production puts the business at risk. There may be IT concerns such as CAD/CAM, customer lists, accounts receivable and accounts payable, but the primary function of the business is to make valves. If the production line is down, if raw material cannot be accepted and finished goods cannot be shipped, the company shuts down.

For the valve company, the production line is the critical business and any risks associated with production – no matter how far removed from the actual production line – are legitimate concerns for the planner.

Non-profits and governments need business continuity to assure that they can perform their mandated functions. When an assistance payment fails to arrive, there is a ripple effect – the person can’t buy necessities, the business selling the necessities either loses business (and product stays in stock) or sells on credit, the wholesaler loses sales to the retailer (or sells on credit), the manufacturer loses an order from the wholesaler, and on and on.

Avoid, Mitigate, AbsorbOnce critical functions and risks to those functions are identified, planners have three options:• Avoid a risk, typically through redundancy.• Mitigate a risk by implementation of “work-arounds.”• Absorb the risk.

The decision to avoid, mitigate, or absorb is a management decision. The planner makes recommendations based on cost vs. effectiveness and efficiency.Is it really necessary to have a very expensive hot site for a valve manufacturing production line? Probably not.

Is it really necessary to have a very expensive hot site for a 24 hour-a-day data intensive operation (such as Web-based securities sales)? Most assuredly.


16

In some cases, the decision to avoid, mitigate, or absorb is made for the planner and management by regulatory bodies which demand certain performance levels.

In all cases, “fiduciary responsibility” plays a major role in management’s decision. Management is liable if it fails to take reasonable and prudent measures to protect investors and employees.Avoiding a risk is a fairly obvious option. It usually is the most expensive and requires the most readiness.

Mitigation options may be fairly obvious; if the business is located in a flood plain, move all critical operations to floors above the 100-year flood level.Absorbing a risk is another matter. Letting an event take its toll seems counter to business continuity’s purpose, but consider a company with obsolete equipment – from “AT” class computers to inefficient furnaces. If the obsolete equipment is insured, replacing it with modern equipment might improve the bottom line. Since insurance, an integral part of a business continuity plan, is footing at least part of the replacement cost, the business can buy replacement gear at a “discount.”

Business Continuity For The Small BusinessEveryone – small business, big business, non-profits, government, even the individual family – needs a business continuity plan, a way to continue their business or personal lives in face of a disaster condition.

Business continuity is as much – perhaps more – for the small business as it is for the giant corporation.

Unlike giant corporations, smaller enterprises typically are less able to survive a disaster (condition); they lack the financial clout and personnel resources of a Fortune 100. The small business does have some special financial assistance available from federal and state sources.

These sources normally look more favorably on an enterprise with a business plan that includes a business continuity plan. Some insurance companies may offer discounts to businesses which implemented planner recommendations.

Business Continuity For The CommunityThe Federal Emergency Management Agency (FEMA) under former director James Watt made a strategic change following Hurricane Andrew. FEMA went from a “disaster recovery” agency to a “disaster avoidance and mitigation” agency – in other words, FEMA got into business continuity.

FEMA created “Project IMPACT” to help municipalities expand their federally-mandated emergency preparedness operations to include protection of the commercial and residential tax base through what effectively amounts to business continuity planning.Project IMPACT makes a number of resources available to both the small business and to the community’s residents to identify risks (will a facility withstand high winds?) and to implement preventive measures.


17

The Differences In Business Continuity, Disaster Recovery & Contingency PlanningA person builds a house on an ocean beach. A storm washes away the beach. The house collapses.

Business continuity would suggest building a barrier reef or moving the house farther inland.Disaster recovery rebuilds the house in time for the next storm.

Contingency planning takes the same scenario and says: “A storm will come ashore and damage the house; make sure there is someplace to live while the house is rebuilt.”

What To Expect In A Business Continuity PlanBusiness Continuity planning typically is a multi-stage (deliverable) process.

Phase 1 – BIAThe minimum expectation from a business continuity plan is a business impact analysis, a “BIA.” The BIA:• identifies business functions critical to the business’ survival• identifies risks to those functions• rates (prioritizes) risks by probability of occurrence and impact on the business• identifies ways to avoid or mitigate identified risks• prioritizes recommended avoidance and mitigation options.

The plan may include suggested vendors, available financial resources, and other resources which may prove beneficial to implementation of avoidance and mitigation measures. The availability of this supplemental information is determined before planning commences and is in large measure dependent on how much time the planner has for research. (Resources constantly change and a planner should not be held to what was known “yesterday.”)

The business continuity process normally is suspended for a brief period while management reviews its options. The shorter the break the better since, as with most planning operations, momentum is a valuable asset.

Phase 2 – Disaster Recovery PlanThe disaster recovery plan includes:• reporting hierarchy, including executive management• identifying primary and alternate disaster recovery team members; these are the people responsible to sustain the business operations and to restore or replace physical assets• detailed description of each team member’s responsibilities during a disaster condition• a list of internal and external vendors and contact information• a list of regulatory agencies and contact information• a list of public service agencies and contact information• appendix of control forms (report forms, expenses, etc.)• minimum resources required to sustain the business operation while physical assets are restored or replaced.


18

Phase 3 – Disaster Recovery Team Training & TestingThis phase includes:• development of a test methodology and scenarios• training disaster recovery team personnel to respond to a disaster condition with confidence• revision of Business Continuity Plan as deficiencies are discovered during plan testing.

No plan is perfect the first time out; if it is, there is something wrong with the test.Phase 4 – Plan MaintenancePlan maintenance is in two parts:• develop a maintenance policy and procedure• maintain the plan.

Plan maintenance is by both calendar and by “trigger” events.Calendar events are regularly scheduled reviews to assure all minor changes to the business are incorporated into the revised plan. Review frequency depends upon the business’ dynamics.

Trigger events are events which “trigger” plan maintenance. Such events include equipment, personnel, policy, procedural, product, and vendor changes.

A Few Quick Words About VendorsAll businesses depend on vendors.

If a critical business function depends directly or indirectly on a vendor, make certain the vendor has a tested and maintained business continuity plan. The plan for your business is defective if the:

- vendor lacks a plan- vendor’s plan has never been tested- vendor’s plan was updated more than a year ago.

- The vendor’s client is responsible to assure the vendor has a viable (tested and maintained) plan.


19

Chapter 3: Planning for BCP

Business Continuity Planning Phases

1. Project Initiation- Define Business Continuity Objective and Scope of coverage.- Establish a Business Continuity Steering Committee.- Draw up Business Continuity Policies.

2. Business Analysis- Perform Risk Analysis and Business Impact Analysis.- Consider Alternative Business Continuity Strategies.- Carry out Cost-Benefit Analysis and select a Strategy.- Develop a Business Continuity Budget.

3. Design and Development (Designing the Plan)- Set up a Business Recovery Team and assign responsibility to the members.- Identify Plan Structure and major components- Develop Backup and Recovery Strategies.- Develop Scenario to Execute Plan.- Develop Escalation, Notification and Plan Activation Criteria.- Develop General Plan Administration Policy.

4. Implementation (Creating the Plan)- Prepare Emergency Response Procedures.- Prepare Command Center Activation Procedures.- Prepare Detailed Recovery Procedures.- Prepare Vendors Contracts and Purchase of Recovery Resources.- Ensure everything necessary is in place.- Ensure Recovery Team members know their Duties and Responsibilities.

5. Testing- Exercise Plan based on selected Scenario.- Produce Test Report and Evaluate the Result.- Provide Training and Awareness to all Personnel.

6. Maintenance (Updating the Plan)- Review the Plan periodically.- Update the Plan with any Changes or Improvement.- Distribute the Plan to Recovery Team members.


20

Business Continuity Planning Checklist

STEPS & ITEMS

(MODIFY, DELETE OR ADD AS NEEDED)Duration

(days or hrs)START (DATE)

Finish (date)

Step One: Initiation Prepare for meeting with Senior ManagementReview any existing policies & procedures. Research local events with negative effect.Prepare to discuss project funding. Research necessary training. Access to PCs for team leaders. BCP software? Draft the Project Schedule.Conduct Kickoff Meeting with Management Form the Project Team – delineate roles.Finalize the Detailed Project SchedulePrepare BIA questionnaireIS support for resumption of operations. Select BIA questionnaire recipientsDistribute BIA Questionnaire to RecipientsStep Two: Business Impact Analysis Gather & review BIA analysis dataConduct BIA interviewsIdentify time-sensitive processes. Step Three: Disaster Readiness Strategies Define & cost Business Continuity AlternativesRecommend DR Strategy - business needs.Prepare Management Report and PresentationObtain Disaster Readiness Strategy ApprovalObtain approval for funding components. Step Four: Develop and Implement the Plan Define the scope and number of BCPsDevelop alternate site RFPDefine the BCP teams, conduct meetingsOrganize plan dataResources lists: people, places & things.Schedule BCP team meetings.Identify team tasks and procedures


21

Emergency response Identify problem escalation Identify resumption & recovery operations Identify restoration of facilities and contents Conduct plan document reviewsStep Five: Maintenance and Testing Establish a Plan Exercise ProgramEstablish training requirementsPrepare and run sample exercisesUpdate and refine the plan regularlyDevelop plan maintenance procedures


22

Establishing and Defining BCP Goals Worksheet

Step Goal TimeframeStep One: Initiation Step Two: Business Impact Analysis Step Three: Disaster Readiness Strategies Step Four: Develop and Implement the Plan Step Five: Maintenance and Testing


23

BCP Overview Quiz

1. Disaster Probability describes:

A) How an event or disaster will affect the organization or agency, how much damage is likely to be caused

B) The chances of an event taking place, how likely it is to occurC) The cost of the damage after a disaster has taken placeD) How many people will be affected by a disaster

2. Disaster Vulnerability describes:

A) The amount of preparation made for a specific disasterB) The plan of action when a disaster occursC) The cost of the damage after a disaster takes placeD) How an event or disaster will affect the organization or agency, how much damage is

likely to be caused

3. BCP is:

A) High-level disaster mitigation and recovery planningB) Lower-level planning, process for returning business conditions to normal functionC) Low-level plan for what to do when a disaster is occurringD) A plan to respond to a specific systems failure or disruption of operations

4. Emergency Management is:


5. Disaster Recovery is:


6. Contingency Planning is:



24

7. Which describes a type of event or disaster?

A) NaturalB) Man MadeC) TechnologicalD) DiseaseE) All of the above

8. The most risk from a disaster occurs when there is:

A) Low Probability and High VulnerabilityB) High Probability and Low VulnerabilityC) Low Probability and Low VulnerabilityD) High Probability and High Vulnerability

9. Which is NOT one of the ‘Five R’s of Continuity’?

A) ResponseB) ResumeC) ReplaceD) RecoverE) Restore

10. How many organizations will suffer fire, flood or storm, power failures, terrorism, hardware or software disaster?

A) One in fiftyB) One in twentyC) One in tenD) One in five


25

Chapter 4: Planning and Managing a BCP Project

A Planner’s Role – Sample Job Description

1. The primary focus of the Business Continuity Planner is to maintain a viable and rehearsed recovery plan that demonstrates to management the organization's ability to continue business operations and computer related processes, following a disruption of agency services. Maintenance of the plan is ongoing to reflect both changes that occur within the computer center and changes to the company. A rehearsal is conducted regularly to ensure the viability of the plan. Training also occurs on a regular basis to assure an organization-wide awareness of the recovery function.

2. Identify and review the critical tasks which are essential during a recovery effort.

3. Establish a timetable for regular review and updating of all tasks, resources and procedures outlined in the plan.

4. Coordinate monthly, quarterly, semi-annual, and annual rehearsals of the plan as outlined in the project plan; report results to management and update the plan as required.

5. Establish an ongoing training program, which ensures employee awareness of the functioning of the plan.

6. Distribute plan materials as appropriate.

7. Establish a standards program, which ensures that changes to critical procedures, functions, and documentation are reflected in the plan.

8. Maintain contact with associates to assure that recovery support considerations are current.

9. Maintain contact with vendors to assure their support during a recovery effort.

10. Act as a liaison between divisions and support areas, including auditing, concerning recovery issues.

11. Meet regularly with recovery teams to review responsibilities required during a recovery effort.

12. Maintain contact with city, county, state, and federal emergency organizations that may be involved during a recovery effort.

13. Provide input and support, as required, to other departmental areas for projects that relate to


26

contingency planning (e.g., updating documentation, creating procedures, and evaluating security systems).

14. Research, evaluate, and recommend internal and external solutions to recovery problems.

15. Maintain contracts for alternate facilities and/or services.


27

Budget Considerations

The budget for a viable, regularly Rehearsed and maintained recovery program must be carefully allocated. Consideration should be given to the following areas concerning budget planning:

1. Alternate Site(s): The monthly subscription cost for contracts with alternate site(s)

2. Rehearsing: The costs for in-house rehearsing (e.g., associates, computer time, supplies, food, special materials, off-hour access to files stored off-site) and the costs for alternate site rehearsal (e.g., transportation of associates and supplies to the alternate site, food, lodging, computer time, employee overtime)

3. Off-site Storage of Data Files: The cost for maintaining off-site storage of critical files

4. Off-site Storage of Documentation and Supplies: The cost for duplicating and/or purchasing documentation and supplies and storing them off-site

5. Training: The cost for ongoing employee training (e.g., supplies, printing)

6. Recovery Plan Printing: The cost for printing updates to the plan

7. Declaration of a Disaster: The disaster declaration fee (this should be covered by extra expense insurance)

8. Recovery Coordinator: Compensation for the Recovery Coordinator and recovery staff members

9. Recovery and Contingency Planning Seminars/Conferences: Allotment for seminars and conferences pertaining to recovery and contingency planning


28

Initial Project Planning Worksheet

Task Name Duration Start Finish % Complete

Predecessor Resources

Project Approval Executive TeamProject Initiation

Appoint BCP Project Manager Executive TeamSelect BCP Project Team Project Manager,

ManagementProject Kick-off Meeting Project Manager,

Project TeamReview Existing BCP Project Manager

Project Team, Management

Business Risk & Impact Analysis Project Manager, Project Team, Management

Business Risk Assessment Project Manager, Project Team, Management

IT & Communications Project Manager, Project Team, IT Management

Other Existing Disaster Recovery Procedures Project Manager, Project Team, Management

Premises Issues Project Manager, Project Team, Facilities


29

ManagementPrepare Emergency Plan Project Manager,

Project Team, Management

Develop Back-up & Recovery Strategies Project Manager, Project Team, Management

Identify Key BCP Personnel & Supplies Project Manager, Project Team, Management, Staff

Identify Key Documents & Procedures Project Manager, Project Team, Management

Develop Disaster Recovery Plan Project Manager, Project Team, Management, Staff

Develop Plan for Handling Emergency SituationNotification & Reporting During the Disaster Recovery Phase

Develop Business Recovery Plan Project Manager Project Team, Management, Staff

Managing the Business Recovery Phase Project Manager Project Team

Develop Business Recovery Activities Project Manager Project Team, Management

Develop Plan for Testing the BCP Process Project Manager Project Team


30

Planning the Tests Project Manager Project Team

Conducting the Tests Project Manager Project Team, Management, Staff

Develop Plan for Training Staff in Business Recovery Process

Project Manager Project Team

Managing the Training Process Project Manager Project Team, Management

Assessing the Training Project Manager Project Team, Management

Approval of BCP Project Manager, Executive Team

Maintaining the Plan Project Manager Project Team


31

Planning Team Responsibilities

1. Analyze your business. Working with the full support of senior management, you need to understand your business and the way it works, including which functions are essential and where vulnerabilities lie.

2. Assess the risks. You need to understand what emergencies might affect your business and what impact they would have. By focusing on impacts rather than causes, you will make sure your plan allows you to deal effectively with an incident, no matter what the source.

3. Develop your strategy. You will need to agree with senior management the organization’s appetite for risk. You can then decide which risks can be accepted, which risks can be reduced and which risks should be managed using business continuity planning.

4. Develop your plan. You should then develop a business continuity plan covering the agreed areas. All plans look different, but they should be clear about roles and responsibilities, easy to understand and open for consultation and review around your organization.

5. Rehearse your plan. Rehearsal helps you to confirm that your plan will be connected and robust if ever you need it. Rehearsals are also a good way to train staff that have business continuity management responsibilities. Lessons from exercises can be used to refine your decisions in steps one to four.


32

Planning Teams Documentation

Team Name: BCP Steering CommitteeTeam Leader Name:Assistant Team Leader Name:

Team Members Agency Role Rationale1.

2.

3.

4.

5.

6.

7.

8.

9.

10.


33

Team Name: BCP Development TeamTeam Leader Name: Assistant Team Leader Name:


2.

3.

4.

5.

6.

7.

8.

9.

10.


34

Team Name: Disaster Recovery TeamTeam Leader Name: Assistant Team Leader Name:


2.

3.

4.

5.

6.

7.

8.

9.

10.


35

Team Name: Crisis Management/Emergency Response TeamTeam Leader Name: Assistant Team Leader Name:


12.

13.

14.

15.

16.

17.

18.

19.

20.


36

Planning Teams Checklist

Planning Team Checklist Yes No1 Have team members been selected to represent each area

of the agency?2 Have all needed personnel been assigned to project? Has

this been confirmed by management?3 Has a contact list been developed for the project team?4 Has a team organization chart been developed?5 Have individuals provided schedule constraints and other

input to help determine best fit of work to personnel?6 Have work requirements and personnel been reviewed to

determine the need for additional personnel or changes in the assignments?

7 Have support resources been identified? 8 Are the necessary planning documents available? (see

attached list)9 Have the task lists from the WBS, effort, and personnel

assignments all been input to a project planning tool?10 Have initial schedules been generated with the planning

tool and results been reviewed to see that they meets project goals?

11 Have adjustments been made to order of work, assignments, or WBS to meet project goals?

12 Have changes been negotiated as needed to modify project requirements to meet the project goals, given any resource constraints?

13 Have changes been negotiated to modify personnel commitments to meet the project goals, given any requirements constraints?

14 Has the complete initial schedule been reviewed with Senior Management and all effected parties?

15 Has the resulting schedule been documented in the project plan?

16 Has the project team completed a technical review of the plans?


37

Response Teams Responsibilities

1. The Damage Assessment/Salvage Team is responsible for the damage assessment of the company’s location and advising the Executive Management Team of the results. Works with the Facilities/Security Team to verify the building can be occupied after a disaster. After damage assessment is completed, this team will also be responsible for coordinating salvage operations as required.

2. The Transportation Team is responsible for making emergency arrangements for personnel transportation, lodging, and dining at the Alternate Site. Also is responsible for ordering and ensuring the delivery of offsite storage items and Supplies.

3. The Physical Security Team is responsible for the facility and its security. In a disaster, this team is also responsible for providing security to the Alternate Site if required.

4. The Public Information Team is responsible for all Public Relations (Public Relations and Crisis Communications) and other communications (e.g., Coordination with Public Authorities)

5. The Insurance Team is responsible for assuring that insurance policies are sufficient and also responsible for submitting insurance claims.

6. The Telecommunications Team is responsible for the restoration and maintenance of all Voice Communications and Data Communications. Also responsible for ensuring telephones are operational at the Alternate Site.


38

Response Teams Checklist

Response Teams Checklist Yes No1. Has a Response Plan been:

Developed? Updated within the last 6 months?

2. Has a Response Plan been: Documented? Maintained?

3. Does the Response Plan include the following sections: Identification? Incident Management? Responsible organization officer? Personnel responsible for updates? Response? Recovery? Restoration? Plan Exercise? Plan Maintenance? Business Recovery Teams and Contact Information?

4. Does the Response Plan identify hardware and software critical to recover the Business and/or Functions?

5. Does the Response Plan identify necessary support equipment (forms, spare parts, office equipment, etc.) to recover the Business and/or Functions?

6. Does the Response Plan require an alternate site for recovery? Does the Response Plan provide for mail service to be forwarded to the alternate facility? Does the Response Plan provide for other vital support functions?

7. Are all critical or important data required to support the business being backed up? Are they being stored in a protected location (offsite)?

8. Do you conduct a walk-through exercise of your Plan at least annually? (This should include a full walk-through as well as "elements" of your plan (i.e. accounts payable, receivable, shipping and receiving, etc).

9. Does the walk-through element exercises have a prepared plan which includes:

Description Scope Objective

10. Is a current copy of the Response Plan maintained off-site?


39

11. Do all users of the Response Plan have ready access to a current copy at all times?

12. Is there an audit trail of the changes made to the Response Plan? 13. Do all employees responsible for the execution of the Response

Plan received training in Disaster Recovery and Emergency Management?


40

Chapter 5: Workshop 2 Topics

Business Functions Statement

All Functions Supporting Critical Processes and Services

Essential Function?

Department of General Services; Procurement & Contracting

Emergency Procurement of Goods & Services for State Government

Yes

Automobile Registration and Titling

MVA Satellite Office Services No


41

Agency Critical Business Functions (CBF) Worksheet

Agency: __________________________ Division/Section:___________________________Date: ______________

Agency BCP Coordinator: ___________________________________________________

Critical Business Function/Service:Function Description:

Function must be restored within:

2 days 1 wk 2 wks 1 month

Priority Ranking: Priority 1 Priority 2 Priority 3 (1 = highest priority)

Who are the customers this function serves?How many customers does this function serve?Major Impact Type: Life, Health & Safety Impact Financial Impact

State Economic ImpactWhat are the impacts to customers if this function or service is unavailable for longer than the specified time? Are there fines or penalties due to missed deadlines of production? If yes, what?Is there Legal Liability, due to non-performance of this function? If yes, what?Would there be loss of good will, poor public image and embarrassment for non-performance of this function? Explain?Does this function depend on any statewide applications, outside services or products, or other state agencies for its successful completion (i.e. partners)?Do any external partners (i.e. other state agencies, local Copyright 2006 – DigitalCare, Inc. – All Rights ReservedNo part of these materials may be reproduced, distributed or transmitted in any form without the prior written consent of DigitalCare, Inc. This document and the accompanying educational seminar are intended to provide guidance and direction. The information contained in this document is not intended as legal advice.

42

government, private sector, business partners) depend on this function to provide their services? If yes, who and why?

Impact Categories:

Life, Health & Safety Impact – Impacts the life, health, safety and welfare of Oregonians

Financial Impact – Financial impact to the state of Oregon or its citizens

State Economic Impact – Impacts Oregon’s economy or commerce


43

Risk Information Checklist

Risks Likelihoodof Event

0 = No Event1 = Rare Event2 = Occasional

Event3 = Frequent

Event

Impact onStaff/Property0 = No Impact

1 = Limited Impact

2 = SubstantialImpact

3 = Major Impact

Impact onBusiness

0 = No Impact1 = Limited

Impact2 = Substantial

Impact3 = Major

Impact

Insurance Coverage

of Risk0 = No Coverage

1 = Limited Coverage

2 = SubstantialCoverage

3 = Full CoverageBomb

Civil Disorder

Prolonged IS Failure

Single-Points-of-Failure

Dam Failure

Drought

Earthquake

Electrical Failure (Building)

Electrical Storm

Fire

Flood/Flash Flood

HAZMAT – Fixed Facility

HAZMAT - Transportation

Human Error

Hurricane/Tropical StormLabor Dispute/Strike

Landslide

Power Failure (Area)

Radiological -- Fixed Facility

Radiological – Transp.


44

Telecommunication Failure

Tornado

Transp. - Air/Rail IncidentWater Leaks

Wildfire

Wind

Winter Storm (Severe)


45

Chapter 6: Glossary of Terms

A

ACTIVATION: The implementation of business continuity capabilities, procedures, activities, and plans in response to an emergency or disaster declaration; the execution of the recovery plan. Similar terms: Declaration, Invocation.

ALERT: Notification that a potential disaster situation exists or has occurred; direction for recipient to standby for possible activation of disaster recovery plan. A formal notification that an incident has occurred, which may develop into a disaster.

ALTERNATE SITE: An alternate operating location to be used by business functions when the primary facilities are inaccessible. 1) Another location, computer center or work area designated for recovery. 2) Location, other than the main facility, that can be used to conduct business functions. 3) A location, other than the normal facility, used to process data and/or conduct critical business functions in the event of a disaster. Related Terms: Cold Site, Hot Site, Interim Site, Internal Hot site, Recovery Site, Warm Site.

ALTERNATE WORK AREA: Office recovery environment complete with necessaryoffice infrastructure (desk, telephone, workstation, and associated hardware, communications, etc.); also referred to as Work Space or Alternative work site.

APPLICATION RECOVERY: The component of Disaster Recovery that deals specifically with the restoration of business system software and data after the processing platform has been restored or replaced. Similar terms: Business System Recovery.

ASSEMBLY AREA: The designated area at which employees, visitors, and contractors assemble when evacuated from their building/site.

ASSET: An item of property and/or component of a business activity/process owned by an organization. There are three types of assets: physical assets (e.g. buildings and equipment), financial assets (e.g. currency, bank deposits and shares) and non-tangible assets (e.g. goodwill, reputation)

AUDIT: The process by which procedures and/or documentation are measured against pre-agreed standards.

ASYNCHONOUS REPLICATION: Data replication or mirror in which the application is allowed to continue while the data is mirrored to another site. In this case, the application data can represent a prior state of the application. It is critical to use ordered asynchronous mirroring for real-time applications. This means that each write is applied in the same order at the second or backup site as it was written in the primary site, even if the network has re-ordered the arrival of the data. Associated term: synchronous replication.


46

ANNUAL LOSS EXPOSURE/EXPECTANCY (ALE): A risk management method of calculating loss based on a value and level of frequency.

B

BACKLOG: a) The amount of work that accumulates when a system or process is unavailable for a long period of time. This work needs to be processed once the system or process is available and may take a considerable amount of time to process.b) A situation whereby a backlog of work requires more time to action than is available through normal working patterns. In extreme circumstances, the backlog may become so marked that the backlog cannot be cleared.

BACKUP (Data): A process by which data, electronic or paper based, is copied in some form so as to be available and used if the original data from which it originated is lost, destroyed or corrupted.

BACKUP GENERATOR: An independent source of power, usually fueled by diesel or natural gas.

BUSINESS CONTINUITY: The ability of an organization to ensure continuity of service and support for its customers and to maintain its viability before after and during an event. (DRII and OR-DAS definitions are identical)

BUSINESS CONTINUITY COORDINATOR: Designated individual responsible for preparing and coordinating the business continuity process. Similar term: disaster recovery coordinator, business recovery coordinator.

BUSINESS CONTINUITY MANAGEMENT (BCM): A holistic management process that identifies potential impacts that threaten an Organization and provides a framework for building resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value creating activities. The management of recovery or continuity in the event of a disaster. Also the management of the overall program through training, rehearsals, and reviews, to ensure the plan stays current and up to date.

BUSINESS CONTINUITY PLAN ADMINISTRATOR: The designated individual responsible for plan documentation, maintenance, and distribution.

BUSINESS CONTINUITY MANAGEMENT PROCESS: The Business Continuity Institute’s BCM process (also known as the BC Life Cycle) combines 6 key elements: 1) Understanding Your Business 2) Continuity Strategies 3) Developing a BCM Response 4) Establishing a Continuity Culture 5) Exercising, Rehearsal & Testing 6) The BCM Management Process

BUSINESS CONTINUITY MANAGEMENT PROGRAM: An ongoing management and governance process supported by senior management and resourced to ensure that the necessary


47

steps are taken to identify the impact of potential losses, maintain viable recovery strategies and plans, and ensure continuity of products/services through exercising, rehearsal, testing, training, maintenance and assurance.

BUSINESS CONTINUITY MANAGEMENT TEAM: A group of individuals functionally responsible for directing the development and execution of the business continuity plan, as well as responsible for declaring a disaster and providing direction during the recovery process, both pre-disaster and post-disaster. Similar terms: disaster recovery management team, business recovery management team. Associated terms: crisis management team.

BUSINESS CONTINUITY PLAN (BCP): Advance arrangements and procedures that enable an organization to respond to an event in such a manner that critical business functions continue with planned levels of interruption or essential change. SIMILAR TERMS: Contingency Planning, Planning, Business Resumption Planning, Continuity Planning, Continuity of Operation Plans (COOP).

BUSINESS CONTINUITY PLANNING (BCP): Process of developing advance arrangements and procedures that enable an organization to respond to an event in such a manner that critical business functions continue with planned levels of interruption or essential change. SIMILAR TERMS: Contingency Planning, Disaster Recovery Planning, Business Resumption Planning, Continuity Planning,

BUSINESS CONTINUITY PROGRAM: An on-going program to ensure business continuity and recovery requirements are addressed, resources are allocated, and processes and procedures are completed and rehearsed. Most effective with management sponsorship and through regular rehearsals.

BUSINESS CONTINUITY STEERING COMMITTEE: A committee of decision makers, business owners, technology experts and continuity professionals, tasked with making strategic recovery and continuity planning decisions for the organization.

BUSINESS CONTINUITY STRATEGY: An approach by an organization that will ensure its recovery and continuity in the face of a disaster or other major outage. Plans and methodologies are determined by the organizations strategy. There may be more than one solution to fulfill an organization’s strategy. Examples: Internal or external hot-site, or cold-site, Alternate Work Area reciprocal agreement, Mobile Recovery, Quick Ship / Drop Ship, Consortium-based solutions, etc.

BUSINESS CONTINUITY TEAM: Designated individuals responsible for developing, execution, rehearsals, and maintenance of the business continuity plan, including the processes and procedures. Similar terms: disaster recovery team, business recovery team, and recovery team. Associated term: crisis response team.

BUSINESS IMPACT ANALYSIS (BIA)/ Risk Assessment: The Business Impact Analysis/ Risk Assessment is a process designed to identify critical business functions and workflow


48

determine the qualitative and quantitative impacts of a disruption, and to prioritize and establish recovery time objectives. SIMILAR TERMS: Business Exposure Assessment, Risk Analysis.

BUSINESS INTERRUPTION: Any event, whether anticipated (i.e., public service strike) or unanticipated (i.e., blackout) which disrupts the normal course of business operations at an organization’s location. Similar terms: outage, service interruption. Associated terms: business interruption costs, business interruption insurance.

BUSINESS INTERRUPTION COSTS: The impact to the business caused by different types of outages, normally measured by revenue lost. Associated terms: business interruption, business interruption insurance.

BUSINESS INTERRUPTION INSURANCE: Insurance coverage for disaster related expenses that may be incurred until operations are fully recovered after a disaster. Business interruption insurance generally provides reimbursement for necessary ongoing expenses during this shutdown, plus loss of net profits that would have been earned during the period of interruption, within the limits of the policy. Associated terms: business interruption, business interruption costs.

BUSINESS RECOVERY COORDINATOR: An individual or group designated to coordinate or control designated recovery processes or testing. SIMILAR TERMS: Disaster Recovery Coordinator

BUSINESS RECOVERY TIMELINE: The chronological sequence of recovery activities, or critical path, that must be followed to resume an acceptable level of operations following a business interruption. This timeline may range from minutes to weeks, depending upon the recovery requirements and methodology.

BUSINESS RESUMPTION PLANNING (BRP): TERM Currently Being Reworked - SIMILAR TERMS: Business Continuity Planning, Disaster Recovery Planning

BUSINESS RECOVERY TEAM: A group of individuals responsible for maintaining the business recovery procedures and coordinating the recovery of business functions and processes. SIMILAR TERMS: Disaster Recovery Team

BUSINESS UNIT RECOVERY: The component of Disaster Recovery which deals specifically with the relocation of a key function or department in the event of a disaster, including personnel, essential records, equipment supplies, work space, communication facilities, work station computer processing capability, fax, copy machines, mail services, etc. SIMILAR TERMS: Work Group Recovery.

C


49

CALL TREE: A document that graphically depicts the calling responsibilities and the calling order used to contact management, employees, customers, vendors, and other key contacts in the event of an emergency, disaster, or severe outage situation.

CERTIFIED BUSINESS CONTINUITY PROFESSIONAL (CBCP): The Disaster Recovery Institute International (DRI International), a not-for-profit corporation, certifies CBCP's and promotes credibility and professionalism in the business continuity industry. Also offers MBCP (Master Business Continuity Professional) and ABCP (Associate Business Continuity Professional).

CHECKLIST: a) Tool to remind and /or validate that tasks have been completed and resources are available, to report on the status of recovery. b) A list of items (names or tasks etc.) to be checked or consulted.

CHECKLIST EXERCISE: A method used to exercise a completed disaster recovery plan. This type of exercise is used to determine if the information such as phone numbers, manuals, equipment, etc. in the plan is accurate and current.

COLD SITE: An alternate facility that already has in place the environmental infrastructure required to recover critical business functions or information systems, but does not have any pre-installed computer hardware, telecommunications equipment, communication lines, etc. These must be provisioned at time of disaster. Related Terms: Alternate Site, Hot Site, Interim Site, Internal Hot Site, Recovery Site, And Warm Site

COMMAND CENTER: A physical or virtual facility located outside of the affected area used to gather, assess, and disseminate information and to make decisions to effect recovery.

COMMUNICATIONS RECOVERY: The component of Disaster Recovery which deals with the restoration or rerouting of an organization's telecommunication network, or its components, in the event of loss. SIMILAR TERMS: Telecommunications Recovery, Data Communications Recovery

COMPUTER RECOVERY TEAM: A group of individuals responsible for assessing damage to the original system, processing data in the interim, and setting up the new system.

CONSORTIUM AGREEMENT: An agreement made by a group of organizations to share processing facilities and/or office facilities, if one member of the group suffers a disaster. SIMILAR TERMS: Reciprocal Agreement.

CONTACT LIST: A list of team members and/or key players to be contacted including their backups. The list will include the necessary contact information (i.e. home phone, pager, cell, etc.) and in most cases be considered confidential.

CONTINGENCY PLAN: A plan used by an organization or business unit to respond to a specific systems failure or disruption of operations. A contingency plan may use any number of


50

resources including workaround procedures, an alternate work area, a reciprocal agreement, or replacement resources.

CONTINGENCY PLANNING: Process of developing advance arrangements and procedures that enable an organization to respond to an event that could occur by chance or unforeseen circumstances.

CONTINUITY OF OPERATIONS PLAN (COOP): A COOP provides guidance on the system restoration for emergencies, disasters, mobilization, and for maintaining a state of readiness to provide the necessary level of information processing support commensurate with the mission requirements/priorities identified by the respective functional proponent. The Federal Government and its supporting agencies traditionally use this term to describe activities otherwise known as Disaster Recovery, Business Continuity, Business Resumption, or Contingency Planning.

CRATE & SHIP: A strategy for providing alternate processing capability in a disaster, via contractual arrangements with an equipment supplier, to ship replacement hardware within a specified time period. SIMILAR TERMS: Guaranteed Replacement, Drop Ship, Quick Ship.

CRISIS: A critical event, which, if not handled in an appropriate manner, may dramatically impact an organization’s profitability, reputation, or ability to operate. Or, an occurrence and/or perception that threatens the operations, staff, shareholder value, stakeholders, brand, reputation, trust and/or strategic/business goals of an organization. See: Event and Incident

CRISIS MANAGEMENT: The overall coordination of an organization's response to a crisis, in an effective, timely manner, with the goal of avoiding or minimizing damage to the organization's profitability, reputation, or ability to operate.

CRISIS MANAGEMENT TEAM: A crisis management team will consist of key executives as well as key role players (i.e. media representative, legal counsel, facilities manager, disaster recovery coordinator, etc.) and the appropriate business owners of critical organization functions who are responsible for recovery operations during a crisis.

CRISIS SIMULATION: The process of testing an organization's ability to respond to a crisis in a coordinated, timely, and effective manner by simulating the occurrence of a specific crisis.

CRITICAL BUSINESS FUNCTIONS (CBF): Business functions or information that could not be interrupted or unavailable for one month or less without significantly jeopardizing the mission of the agency, and the health, welfare or safety of Oregonians.

CRITICAL FUNCTIONS: Business activities or information that could not be interrupted or unavailable for several business days without significantly jeopardizing operation of the organization.

CRITICAL INFRASTRUCTURE: Systems whose incapacity or destruction would have a debilitating impact on the economic security of an organization, community, nation, etc


51

CRITICAL RECORDS: Records or documents that, if damaged or destroyed, would cause considerable inconvenience and/or require replacement or recreation at considerable expense.

D

DAMAGE ASSESSMENT: The process of assessing damage, following a disaster, to computer hardware, vital records, office facilities, etc. and determining what can be salvaged or restored and what must be replaced.

DATA BACKUPS: The back up of system, application, program and/or production files to media that can be stored both on and/or offsite. Data backups can be used to restore corrupted or lost data or to recover entire systems and databases in the event of a disaster. Data backups should be considered confidential and should be kept secure from physical damage and theft.

DATA BACKUP STRATEGIES: Those actions and backup processes determined by an organization to be necessary to meet its data recovery and restoration objectives. Data backup strategies will determine the timeframes, technologies, media and offsite storage of the backups, and will ensure that recovery point and time objectives can be met.

DATA CENTER RECOVERY: The component of Disaster Recovery which deals with the restoration, at an alternate location, of data center services and computer processing capabilities. SIMILAR TERMS: Mainframe Recovery, Technology Recovery.

DATA RECOVERY: The restoration of computer files from backup media to restore programs and production data to the state that existed at the time of the last safe backup.

DATABASE REPLICATION: The partial or full duplication of data from a source database to one or more destination databases. Replication may use any of a number of methodologies including mirroring or shadowing, and may be performed synchronous, asynchronous, or point-in-time depending on the technologies used, recovery point requirements, distance and connectivity to the source database, etc. Replication can if performed remotely, function as a backup for disasters and other major outages. (Similar Terms: File Shadowing, Disk Mirroring)

DECLARATION: A formal announcement by pre-authorized personnel that a disaster or severe outage is predicted or has occurred and that triggers pre-arranged mitigating actions (e.g., a move to an alternate site.) Similar terms: Invocation.

DECLARATION FEE: A one-time fee, charged by an Alternate Facility provider, to a customer who declares a disaster. NOTE: Some recovery vendors apply the declaration fee against the first few days of recovery. 1) An initial fee or charge for implementing the terms of a recovery agreement or contract. SIMILAR TERMS: Notification Fee.

DEPENDENCY: The reliance, directly or indirectly, of one activity or process upon another.See: Mission Critical Activity


52

DESK CHECK: One method of testing a specific component of a plan. Typically, the owner or author of the component reviews it for accuracy and completeness and signs off.

DESKTOP EXERCISE: See: Table Top Exercise.

DISASTER: A sudden, unplanned calamitous event causing great damage or loss as defined or determined by a risk assessment and BIA; 1) Any event that creates an inability on an organizations part to provide critical business functions for some predetermined period of time. 2) In the business environment, any event that creates an inability on an organization’s part to provide the critical business functions for some predetermined period of time. 3) The period when agency management decides to divert from normal production responses and exercises its disaster recovery plan. Typically signifies the beginning of a move from a primary to an alternate location. SIMILAR TERMS: Business Interruption; Outage; Catastrophe (DRII and OR-DAS definitions are identical)

DISASTER RECOVERY: Activities and programs designed to return the entity to an acceptable condition. The ability to respond to an interruption in services by implementing a disaster recovery plan to restore an organization's critical business functions.

DISASTER RECOVERY: The technology and telecommunication aspect of a business continuity plan. The advance planning and preparations necessary IT infrastructure minimize loss and ensure continuity of the critical business functions of an organization in the event of a disaster or unplanned event.

DISASTER RECOVERY OR BUSINESS CONTINUITY COORDINATOR: A role of the BCM program that coordinates planning and implementation for overall recovery of an organization or unit(s). SIMILAR ROLES: Business Recovery Coordinator, Business Recovery Planner, Disaster Recovery Planner, and Disaster Recovery Administrator

DISASTER RECOVERY INSTITUTE INTERNATIONAL (DRI INTERNATIONAL): A not-for-profit organization that offers certification and educational offerings for business continuity professionals.

DISASTER RECOVERY PLAN: The management-approved document that defines the resources, actions, tasks and data required to manage the recovery effort. Usually refers to the technology recovery effort. This is a component of the BCM Program. See: BCM Plan, Recovery Plan.

DISASTER RECOVERY PLANNING: The technological aspect of business continuity planning. The advance planning and preparation that is necessary to minimize loss and ensure continuity of the critical business functions of an organization in the event of disaster. SIMILAR TERMS: Contingency Planning; Business Resumption Planning; Corporate Contingency Planning; Business Interruption Planning; Disaster Preparedness.


53

DISASTER RECOVERY SOFTWARE: An application program developed to assist an organization in writing a comprehensive disaster recovery plan.

DISASTER RECOVERY TEAMS (Business Recovery Teams): A structured group of teams ready to take control of the recovery operations if a disaster should occur.

DISK MIRRORING: Disk mirroring is the duplication of data on separate disks in real time to ensure its continuous availability, currency and accuracy. Disk mirroring can function as a disaster recovery solution by performing the mirroring remotely. True mirroring will enable a zero recovery point objective. Depending on the technologies used, mirroring can be performed synchronously, asynchronously, semi-synchronously, or point-in-time. Similar terms: data mirroring, data replication, file shadowing, and journaling

DROP SHIP: A strategy for a) Delivering equipment, supplies, and materials at the time of a business continuity event or exercise. b) Providing replacement hardware within a specified time period via prearranged contractual arrangements with an equipment supplier at the time of a business continuity event. Similar term: quick ship.

E

ELECTRONIC VAULTING: Electronically forwarding backup data to an offsite server or storage facility. Vaulting eliminates the need for tape shipment and therefore significantly shortens the time required to move the data offsite. Similar terms: vaulting, electronic backup. Associated terms: electronic journaling.

EMERGENCY: An unexpected or impending situation that may cause injury, loss of life, destruction of property, or cause the interference, loss, or disruption of an organization’s normal business operations to such an extent that it poses a threat.

EMERGENCY COORDINATOR: The person assigned the role of coordinating the activities of the evacuation of a site and/or building with the statutory and/or emergency services.

EMERGENCY OPERATIONS CENTER (EOC): A site from which response teams/officials (municipal, county, state and federal) exercise direction and control in an emergency or disaster. Associated term: command center.

EMERGENCY PREPAREDNESS: The discipline that ensures an organization or community's readiness to respond to an emergency in a coordinated, timely, and effective manner to prevent the loss of life and minimize injury and property damage.

EMERGENCY PROCEDURES: A plan of action to commence immediately to prevent the loss of life and minimize injury and property damage.

EMERGENCY RESPONSE PROCEDURES: The initial response to any event and is focused upon protecting human life and the organization’s assets.


54

EMERGENCY RESPONSE TEAM (ERT): Teams of individuals who have been trained to provide rapid response to all type of emergencies and to provide assistance and act as a contact to responding outside agencies. Associated term: medical emergency response team (MERT).

ENVIRONMENT RESTORATION: Recreation of the critical business operations in an alternate location, including people, equipment and communications capability.

ESCALATION: The process by which event related information is communicated upwards through an organization’s Business Continuity and/or risk management reporting process.

ESSENTIAL SERVICE: A service without which a building would be ‘disabled’. Often applied to the utilities (water, gas, electricity, etc.) it may also include standby power systems, environmental control systems or communication networks.

EVACUATION: The movement of employees, visitors and contractors from a site and/or building to a safe place (assembly area) in a controlled and monitored manner at time of an event.

EVENT: Any occurrence that may lead to a business continuity incident. See: Crisis and Incident

EXECUTIVE / MANAGEMENT SUCCESSION: A predetermined plan for ensuring the continuity of authority, decision-making, and communication in the event that key members of senior management suddenly become incapacitated, or in the event that a crisis occurs while key members of senior management are unavailable.

EXERCISE: A people focused activity designed to execute business continuity plans and evaluate the individual and/or organization performance against approved standards or objectives. Exercises can be announced or unannounced, and are performed for the purpose of training and conditioning team members, and validating the business continuity plan.Exercise results identify plan gaps and limitations and are used to improve and revise the Business Continuity Plans.Types of exercises include: Table Top Exercise, Simulation Exercise, Operational Exercise, Mock Disaster, Desktop Exercise, Full Rehearsal.

EXERCISE AUDITOR: An appointed role that is assigned to assess whether the exercise aims / objectives are being met and to measure whether activities are occurring at the right time and involve the correct people to facilitate their achievement. The exercise auditor is not responsible for the mechanics of the exercise. This independent role is crucial in the subsequent debriefing.

EXERCISE CONTROLLER: See Exercise Owner

EXERCISE COORDINATOR: They are responsible for the mechanics of running the exercise. The Coordinator must lead the exercise and keep it focused within the predefined scope and


55

objectives of the exercise as well as on the disaster scenario. The Coordinator must be objective and not influence the outcome. They perform the coordination to make sure appropriate exercise participants have been identified and that exercise scripts have been prepared before, utilized during, and updated after the exercise. Similar terms: Exercise Facilitator, Exercise Director.

EXERCISE OBSERVER: An exercise observer has no active role within the exercise but is present for awareness and training purposes. An exercise observer might make recommendations for procedural improvements.

EXERCISE OWNER: An appointed role that has total management oversight and control of the exercise and has the authority to alter the exercise plan. This includes early termination of the exercise for reasons of safety or the aims / objectives of the exercise cannot be met due to an unforeseen or other internal or external influence.

EXERCISE PLAN: A plan designed to periodically evaluate tasks, teams, and procedures that are documented in business continuity plans to ensure the plan’s viability. This can include all or part of the BC plan, but should include mission critical components.

F

FILE SHADOWING: The asynchronous duplication of the production database on separate media to ensure data availability, currency and accuracy. File shadowing can be used as a disaster recovery solution if performed remotely, to improve both the recovery time and recovery point objectives. SIMILAR TERMS: Data Replication, Journaling, Disk Mirroring.

FLOOR WARDEN: Person responsible for ensuring that all employees, visitors and contractors evacuate a floor within a specific site. The Floor Warden reports to the Fire Marshall when the designated floor is clear. SIMILAR TERM: Fire Marshal

FORWARD RECOVERY: The process of recovering a database to the point of failure by applying active journal or log data to the current backup files of the database.

FULL REHEARSAL: An exercise that simulates a Business Continuity event where the organization or some of its component parts are suspended until the exercise is completed.See: Exercise

G

GAP ANALYSIS: A survey whose aim is to identify the differences between BCM/Crisis Management requirements (what the business says it needs at time of an event and what is in place and/or available.

H


56

HAZARD OR THREAT IDENTIFICATION: The process of identifying situations or conditions that has the potential to cause injury to people, damage to property, or damage to the environment.

HEALTH AND SAFETY: The process by which the well being of all employees, contractors, visitors and the public is safeguarded. All business continuity plans and planning must be cognizant of H&S statutory and regulatory requirements and legislation. Health and Safety considerations should be reviewed during the Risk assessment.

HIGH AVAILABILITY: Systems or applications requiring a very high level of reliability and availability. High availability systems typically operate 24x7 and usually require built-in redundancy to minimize the risk of downtime due to hardware and/or telecommunication failures.

HIGH-RISK AREAS: Areas identified during the risk assessment that are highly susceptible to a disaster situation or might be the cause of a significant disaster.

HOTSITE: An alternate facility that already has in place the computer, telecommunications, and environmental infrastructure required to recover critical business functions or information systems. Related Terms: Alternate Site, Cold Site, And Warm Site

HUMAN THREATS: Possible disruptions in operations resulting from human actions. (i.e., disgruntled employee, terrorism, blackmail, job actions, riots, etc.)

I

IMPACT: The effect, acceptable or unacceptable, of an event on an organization. The types of business impact are usually described as financial and non-financial and are further divided into specific types of impact.See: Business Impact Analysis

INCIDENT: An event which is not part of a standard operating business, which may impact or interrupt services, and in some cases, may lead to disaster. See: Crisis and Event

INCIDENT COMMAND SYSTEM (ICS): Combination of facilities, equipment, personnel, procedures, and communications operating within a common organizational structure with responsibility for management of assigned resources to effectively direct and control the response to an incident. Intended to expand, as situation requires larger resources, without requiring new, reorganized command structure. (FEMA Term)

INCIDENT MANAGEMENT: The process by which an organization responds to and controls an incident using Emergency Response Procedures.See: Emergency Response Procedures


57

INCIDENT MANAGER: Commands the local EOC reporting up to senior management on the recovery progress. Has the authority to invoke the local recovery plan.

INCIDENT RESPONSE: The response of an organization to a disaster or other significant event that may significantly impact the organization, its people, or its ability to function productively. An incident response may include evacuation of a facility, initiating a disaster recovery plan, performing damage assessment, and any other measures necessary to bring an organization to a more stable status.

INFORMATION SECURITY: The securing or safeguarding of all sensitive information, electronic or otherwise, which is owned by an organization.See: BS 7799 and ISO 17799

INFRASTRUCTURE: The underlying foundation, basic framework, or interconnecting structural elements that support an organization.

INTEGRATED EXERCISE: An exercise conducted on multiple interrelated components of a Business Continuity Plan, typically under simulated operating conditions. Examples of interrelated components may include interdependent departments or interfaced systems.

INTERIM SITE: A temporary location used to continue performing business functions after vacating a recovery site and before the original or new home site can be occupied. Move to an interim site may be necessary if ongoing stay at the recovery site is not feasible for the period of time needed or if the recovery site is located far from the normal business site that was impacted by the disaster. An interim site move is planned and scheduled in advance to minimize disruption of business processes; equal care must be given to transferring critical functions from the interim site back to the normal business site. See Alternate Site, Cold Site, Hot site, Internal Hot Site, Recovery Site, Warm site

INTERNAL HOTSITE: A fully equipped alternate processing site owned and operated by the organization.

INVOCATION: The act by which a Business Continuity Management or Crisis Management process is formally started. The term is often used to refer to the act of using a service such as work area recovery as offered by a commercial or third party provider.See: Activation and Declaration

J

JOURNALING: The process of logging changes or updates to a database since the last full backup. Journals can be used to recover previous versions of a file before updates were made, or to facilitate disaster recovery, if performed remotely, by applying changes to the last safe backup. SIMILAR TERMS: File Shadowing, Data Replication, Disk Mirroring


58

K

KEY TASKS: Priority procedures and actions in a Business Continuity Plan that must be executed within the first few minutes/hours of the plan invocation.

L

LEAD TIME: The time it takes for a supplier to make equipment, services, or supplies available after receiving an order. Business continuity plans should try to minimize lead time by creating service level agreements (SLA) with suppliers or alternate suppliers in advance of a Business Continuity event rather than relying on the suppliers’ best efforts. See: Service Level Agreement.

LOGISTICS/TRANSPORTATION TEAM: A team comprised of various members representing departments associated with supply acquisition and material transportation, responsible for ensuring the most effective acquisition and mobilization of hardware, supplies, and support materials. This team is also responsible for transporting and supporting staff.

LOSS: Unrecoverable resources that are redirected or removed as a result of a Business Continuity event. Such losses may be loss of life, revenue, market share, competitive stature, public image, facilities, or operational capability.

LOSS ADJUSTER: Designated position activated at the time of a Business Continuity event to assist in managing the financial implications of the event and should be involved as part of the management team where possible

LOSS REDUCTION: The technique of instituting mechanisms to lessen the exposure to a particular risk. Loss reduction involves planning for, and reacting to, an event to limit its impact. Examples of loss reduction include sprinkler systems, insurance policies, and evacuation procedures.

LOST TRANSACTION RECOVERY: Recovery of data (paper within the work area and/or system entries) destroyed or lost at the time of the disaster or interruption. Paper documents may need to be requested or re-acquired from original sources. Data for system entries may need to be recreated or reentered

M

MANUAL PROCEDURES: An alternative method of working following a loss of IT systems. As working practices rely more and more on computerized activities, the ability of an organization to fallback to manual alternatives lessens. However, temporary measures and methods of working can help mitigate the impact of a business continuity event and give staff a feeling of doing something.


59

MISSION-CRITICAL APPLICATION: An application that is essential to the organization’s ability to perform necessary business functions. Loss of the mission-critical application would have a negative impact on the business, as well as legal or regulatory impacts.

MOBILE RECOVERY: A mobilized resource purchased or contracted for the purpose of business recovery. The mobile recovery center might include: computers, workstations, telephone, electrical power, etc.

MOCK DISASTER: One method of exercising teams in which participants are challenged to determine the actions they would take in the event of a specific disaster scenario. Mock disasters usually involve all, or most, of the applicable teams. Under the guidance of exercise coordinators, the teams walk through the actions they would take per their plans, or simulate performance of these actions. Teams may be at a single exercise location, or at multiple locations, with communication between teams simulating actual ‘disaster mode’ communications. A mock disaster will typically operate on a compressed timeframe representing many hours, or even days.

N

N + 1: A fault tolerant strategy that includes multiple systems or components protected by one backup system or component. (Many-to-one relationship)

NETWORK OUTAGE: An interruption of voice, data, or IP network communications.

O

OFF-SITE STORAGE: Any place physically located a significant distance away from the primary site, where duplicated and vital records (hard copy or electronic and/or equipment) may be stored for use during recovery.

OPERATIONAL EXERCISE: See: Exercise

OPERATIONAL RISK: The risk of loss resulting from inadequate or failed procedures and controls. This includes loss from events related to technology and infrastructure, failure, business interruptions, staff related problems, and from external events such as regulatory changes

OUTAGE: The interruption of automated processing systems, infrastructure, support services, or essential business operations, which may result, in the organizations inability to provide services for some period of time.


60

P

PEER REVIEW: One method of testing a specific component of a plan. Typically, personnel (other than the owner or author) with appropriate technical or business knowledge review the component for accuracy and completeness.

PLAN ADMINISTRATOR: The individual responsible for documenting recovery activities and tracking recovery progress.

PLAN MAINTENANCE: The management process of keeping an organization’s Business continuity management plans up to date and effective. Maintenance procedures are a part of this process for the review and update of the BC plans on a defined schedule. Maintenance procedures are a part of this process.

PREVENTATIVE MEASURES: Controls aimed at deterring or Mitigating undesirable events form taking place.

PRIORITIZATION: The ordering of critical activities and their dependencies are established during the BIA and Strategic-planning phase. The business continuity plans will be implemented in the order necessary at the time of the event.

Q

QUALITATIVE ASSESSMENT: The process for evaluating a business function based on observations and does not involve measures or numbers. Instead, it uses descriptive categories such as customer service, regulatory requirements, etc to allow for refinement of the quantitative assessment. This is normally done during the BIA phase of planning.

QUANTITATIVE ASSESSMENT: The process for placing value on a business function for risk purposes. It is a systematic method that evaluates possible financial impact for losing the ability to perform a business function. It uses numeric values to allow for prioritizations. This is normally done during the BIA phase of planning.

QUICK SHIP: See Drop Ship.

R

RECIPROCAL AGREEMENT: Agreement between two organizations (or two internal business groups) with similar equipment/environment that allows each one to recover at the other’s location.

RECOVERABLE LOSS: Financial losses due to an event that may be reclaimed in the future, e.g. through insurance or litigation. This is normally identified in the Risk Assessment or BIA.


61

RECOVERY: Implementing the prioritized actions required to return the processes and support functions to operational stability following an interruption or disaster.

RECOVERY MANAGEMENT TEAM: See: Business Continuity Management (BCM) Team.

RECOVERY PERIOD: The time period between a disaster and a return to normal functions, during which the disaster recovery plan is employed.

RECOVERY POINT OBJECTIVE (RPO): From a business perspective RPO is the maximum amount of data loss the business can incur in an event. The targeted point in time to which systems and data must be recovered after an outage as determined by the business unit.

RECOVERY SERVICES AGREEMENT \ CONTRACT: A contract with an external organization guaranteeing the provision of specified equipment, facilities, or services, usually within a specified time period, in the event of a business interruption. A typical contract will specify a monthly subscription fee, a declaration fee, usage costs, method of performance, amount of test time, termination options, penalties and liabilities, etc.

RECOVERY SITE: A designated site for the recovery of business unit, technology, or other operations, which are critical to the enterprise. Related Terms: Alternate Site, Cold Site, Hot Site, Interim Site, Internal Hot Site, And Warm Site

RECOVERY STRATEGY: See business continuity strategy

RECOVERY TEAM: See: Business Continuity Team

RECOVERY TIME OBJECTIVE (RTO): The period of time within which systems, applications, or functions must be recovered after an outage (e.g. one business day). RTO’s are often used as the basis for the development of recovery strategies, and as a determinant as to whether or not to implement the recovery strategies during a disaster situation. Similar Terms: Maximum Allowable Downtime

RECOVERY TIMELINE: The sequence of recovery activities, or critical path, which must be followed to resume an acceptable level of operation following a business interruption. The timeline may range from minutes to weeks, depending upon the recovery requirements and methodology.

RESILIENCE: The ability of an organization to absorb the impact of a business interruption, and continue to provide a minimum acceptable level of service.

RESPONSE: The reaction to an incident or emergency to assess the damage or impact and to ascertain the level of containment and control activity required. In addition to addressing matters of life safety and evacuation, Response also addresses the policies, procedures and actions to be followed in the event of an emergency. . SIMILAR TERMS: Emergency Response, Disaster Response, Immediate Response, and Damage Assessment.


62

RESTORATION: Process of planning for and/or implementing procedures for the repair of hardware, relocation of the primary site and its contents, and returning to normal operations at the permanent operational location.

RESUMPTION: The process of planning for and/or implementing the restarting of defined business processes and operations following a disaster. This process commonly addresses the most critical business functions within BIA specified timeframes.

RISK: Potential for exposure to loss. Risks, either man-made or natural, are constant. The potential is usually measured by its probability in years.

RISK ASSESSMENT / ANALYSIS: Process of identifying the risks to an organization, assessing the critical functions necessary for an organization to continue business operations, defining the controls in place to reduce organization exposure and evaluating the cost for such controls. Risk analysis often involves an evaluation of the probabilities of a particular event.

RISK CATEGORIES: Risks of similar types are grouped together under key headings, otherwise known as ‘risk categories’. These categories include reputation, strategy, financial, investments, operational infrastructure, business, regulatory compliance, Outsourcing, people, technology and knowledge.

RISK MITIGATION: Implementation of measures to deter specific threats to the continuity of business operations, and/or respond to any occurrence of such threats in a timely and appropriate manner.

S

SALVAGE & RESTORATION: The act of performing a coordinated assessment to determine the appropriate actions to be performed on impacted assets. The assessment can be coordinated with Insurance adjusters, facilities personnel, or other involved parties. Appropriate actions may include: disposal, replacement, reclamation, refurbishment, recovery or receiving compensation for unrecoverable organizational assets.

SCENARIO: A pre-defined set of Business Continuity events and conditions that describe, for planning purposes, an interruption, disruption, or loss related to some aspect(s) of an organization’s business operations to support conducting a BIA, developing a continuity strategy, and developing continuity and exercise plans. Note: Scenarios are neither predictions nor forecasts.

SECURITY REVIEW: A periodic review of policies, procedures, and operational practices maintained by an organization to ensure that they are followed and effective.

SELF INSURANCE: The pre-planned assumption of risk in which a decision is made to bear loses that could result from a Business Continuity event rather than purchasing insurance to cover those potential losses.


63

SERVICE LEVEL AGREEMENT (SLA): A formal agreement between a service provider (whether internal or external) and their client (whether internal or external), which covers the nature, quality, availability, scope and response of the service provider. The SLA should cover day-to-day situations and disaster situations, as the need for the service may vary in a disaster.

SERVICE LEVEL MANAGEMENT (SLM): The process of defining, agreeing, documenting and managing the levels of any type of services provided by service providers whether internal or external that are required and cost justified.

SIMULATION EXERCISE: One method of exercising teams in which participants perform some or all of the actions they would take in the event of plan activation. Simulation exercises, which may involve one or more teams, are performed under conditions that at least partially simulate ‘disaster mode’. They may or may not be performed at the designated alternate location, and typically use only a partial recovery configuration.

SINGLE POINT OF FAILURE: (SPOF) A unique pathway or source of a service, activity, and/or process. Typically, there is no alternative and a loss of that element could lead to a failure of a critical function.

STAND DOWN: Formal notification that the response to a Business Continuity event is no longer required or has been concluded.

STANDALONE TEST: A test conducted on a specific component of a plan, in isolation from other components, typically under simulated operating conditions.

STRUCTURED WALKTHROUGH: Types of exercise in which team members physically implement the business continuity plans and verbally review each step to assess its effectiveness, identify enhancements, constraints and deficiencies.See: Exercise.SUBSCRIPTION: See: Recovery Services Agreement \ Contract

SUPPLY CHAIN: All suppliers, manufacturing facilities, distribution centers, warehouses, customers, raw materials, work-in-process inventory, finished goods, and all related information and resources involved in meeting customer and organizational requirements.

SYSTEM: Set of related technology components that work together to support a business process or provide a service.

SYSTEM RECOVERY: The procedures for rebuilding a computer system and network to the condition where it is ready to accept data and applications, and facilitate network communications.

SYSTEM RESTORE: The procedures necessary to return a system to an operable state using all available data including data captured by alternate means during the outage. System restore depends upon having a live, recovered system available.


64

T

TABLE TOP EXERCISE: One method of exercising teams in which participants review and discuss the actions they would take per their plans, but do not perform any of these actions. The exercise can be conducted with a single team, or multiple teams, typically under the guidance of exercise facilitators.

TASK LIST: Defined mandatory and discretionary tasks allocated to teams and/or individual roles within a Business Continuity Plan

TEST: A pass/fail evaluation of infrastructure (example-computers, cabling, devices, hardware) and\or physical plant infrastructure (example-building systems, generators, utilities) to demonstrate the anticipated operation of the components and system. Tests are often performed as part of normal operations and maintenance. Tests are often included within exercises. (See Exercise).

TEST PLAN: See Exercise Plan

THREAT: A combination of the risk, the consequence of that risk, and the likelihood that the negative event will take place. Associated term: risk. Example Threats: Natural, Man-made, Technological, and Political disasters.)

TRAUMA COUNSELING: The provisioning of counseling assistance by trained individuals to employees, customers and others who have suffered mental or physical injury as the result of an event.

TRAUMA MANAGEMENT: The process of helping employees deal with trauma in a systematic way following an event by proving trained counselors, support systems, and coping strategies with the objective of restoring employees psychological well being.

U

UNEXPECTED LOSS: The worst-case financial loss or impact that a business could incur due to a particular loss event or risk. The unexpected loss is calculated as the expected loss plus the potential adverse volatility in this value. It can be thought of as the worst financial loss that could occur in a year over the next 20 years.

UNINTERTUPTIBLE POWER SUPPLY (UPS): A backup supply that provides continuous power to critical equipment in the event that commercial power is lost.

V


65

VALIDATION SCRIPT: A set of procedures within the Business Continuity Plan to validate the proper function of a system or process before returning it to production operation.

VITAL RECORD: A record that must be preserved and available for retrieval if needed.

W

WARM SITE: An alternate processing site which is equipped with some hardware, and communications interfaces, electrical and environmental conditioning which is only capable of providing backup after additional provisioning, software or customization is performed.

WORKAROUND PROCEDURES: Interim procedures that may be used by a business unit to enable it to continue to perform its critical functions during temporary unavailability of specific application systems, electronic or hard copy data, voice or data communication systems, specialized equipment, office facilities, personnel, or external services. SIMILAR TERMS: Interim Contingencies.


66