A Guide to Business Continuity Planning

A GUIDE TO BUSINESS CONTINUITY PLANNING
by James C. Barnes

- - - - - - - -
-
EXPERIENCE LEVEL: Intermediate to Experienced Practitioner
FOCUS: Enterprise Continuity
PERSPECTIVE/APPROACH: Consultant (internal or external); project
orientation
- - - - - - - -
-

FROM THE INTRODUCTION:

“The interest in business continuity has gained significant momentum in the last
several
years, especially with the Y2K non-event. There are several reasons for this
heightened
interest, but probably the most significant reason is the increasing levels of
devastation
associated with recent disasters.

“In recent years we have witnessed a series of headline-grabbing,
thought-provoking
disasters: hurricanes, power outages, floods, tornadoes, earthquakes, and ice and
snow
storms.

“Because these disasters occupy prominent coverage by the news media, the
senior
management meetings of virtually every company and governmental entity
eventually get
around to discussing the prospect of a disaster interrupting their operations.

“The magnitude of the natural disasters is not without precedent. Throughout time,
Mother
Nature has been delivering fierce hurricanes, horrific earthquakes, and devastating
floods.
Man-made disasters such as the burning of Rome, San Francisco, and Chicago
have also
been with mankind since the beginning of recorded history. What makes them
different today
is the density of our population and production centers.

“The difference between yesterday's natural disasters and today's natural disasters
is
population density. What we have seen in alt recent disasters is the impact of our
dense
population centers coping poorly with their environments or with the malevolent
intentions of
a
disgruntled group of individuals.

“The prognosis for an increasing toll from these forces is not good. We will
continue to see
an
ever-increasing swath of destruction from the forces of nature and man.

“While the above-mentioned disasters are spectacular, they are not the major
causes of a
disaster condition. Power outages have accounted for nearly one-third of all
disaster
conditions since 1982. Fire accounts for 5%. This is equal to the damage caused
by storms,
floods, hurricanes, and earthquakes. The major cause of the disaster condition is a
localized
occurrence that does not receive the attention of the awesome forces of nature.
However, it
can have just as great an impact on your company or organization.

“The causes of a disaster condition are varied and numerous. There are at least 75
known
causes for a disaster condition, from air conditioning failure to volcanoes, including
such
items as burst pipes, insect infestation, programmer error, toilet overflow, and
chemical
spills.

“It is these more common occurrences - those that happen to an individual
company as
opposed to an entire area - that get the senior management of a company to take
discussions beyond the point of ‘what if' to questions of "how can we prepare for
this type of
thing happening again?" Companies that are the most motivated to do something
about
disaster recovery are those that have recently had a disaster within their
organization. This is
a rather sad commentary, but most organizations are still reactive rather than
proactive.

“The focus of this book is the building of a successful BCP. It is designed to
provide you with
proven tools and a sequential methodology that will allow you to succeed. It begins
at the
point where an organization has exhibited an interest in having a plan as a form of
protection
against a disaster and have asked you to develop a BCP.

“This book has been written from the point of view of an outside consultant
assisting a client
to implement a plan. However, the intent was to give those inside an organization
whoa have
been tasked with developing a BCP insights on completing the project. Regardless
of
whether you are an external consultant or an internal project manager, the project
methodology presented here will contribute significantly to your success.”

= = = = = = = =
= =

THE STRUCTURE OF THE BOOK

“The book follows the five phases of Business Continuity Planning:
- Project Foundation
- Business Assessment
- Strategy Selection
- Plan Development and
- Testing and Maintenance”

= = = = = = = =
= =

FROM THE FOREWORD:

“Since the late 1990s, the business continuity industry has evolved at a far more
rapid pace
than at any time since its birth in the 1970s. The industry focus has expanded far
beyond
early "glass-house" data center disaster recovery to the multinational, 24 X 7
enterprise
dependent on pervasive computing and networking. The unforgiving nature of
continuous
availability of business and internet-based processes goes far beyond the technical
complexities of recovering disrupted computing platforms or networks. "Traditional"
disruption scenarios - such as hurricanes, fires, power outages or flooding have
been
supplanted with terrorism, denial-of-service attacks, workplace violence, and a host
of other
threats unimaginable two decades ago.
“For any contingency planner to succeed requires a great deal of foresight and
imagination -
just consider what your organization's list of threats and vulnerabilities might look
like in
another twenty years - but it also requires some practical, day-today tools,
structures and
processes. In this book Jim Barnes has succeeded in providing us a much-needed
tool, with
which we can confidently face many of the day-to-day challenges of business
contingency
planning.

“Pity the poor contingency planner - whether starting a consulting engagement, or
delegated
the daunting task of equipping an enterprise to survive and function in the face of
disruption.
How are they to tackle business continuity management? Where are they to
begin? How do
they anticipate and deal with project pitfalls along the way?

“Whether volunteering or volunteered for the challenges of business continuity, they
certainly
should not have to reinvent the wheel. Yet, despite the wealth of books, software
packages,
periodicals, web-sites, conferences and seminars available, sometimes the
success of a
business continuity project can be more a result of utilizing a single, focused
resource than
bits and pieces from too many, disparate and often contradictory - sources.

“I have been actively involved with writing, editing and reviewing books and software
tools in
the business continuity industry for over seventeen years. During that time I have
seen
hundreds of strategies, methodologies, tools and tactics intended to make that
contingency
planner's job easy - or, as likely, miserable. From the most down-to-earth
approach to the
most elegant, I have observed that there is little consistency - and many
contradictions. In
addition, many of these approaches, while theoretically stand, have little bearing
on the heal
world.

“I have also found that the authors of too many books make naive assumptions
about the
business continuity process. They assume that business continuity starts with all
parties in
agreement and, somehow, the laws of corporate nature do not apply to business
continuity.
Often, they treat the business continuity project as if it were something almost
mystical - a
process that somehow is exempt from the realities, constraints, processes,
psychology and
personalities of corporate or organizational life.

“Jim Barnes, however, shares with us practical processes and tools that, as
obvious as it
may sound, treat the business continuity process just like any other enterprise
implementation
process. He addresses these processes to the individual or team who are going to
have to
deal with corporate rules, practices and realities, whether they are external
consultants or
internal staff.

“Some books tell the reader to perform tasks and assume that the reader can
figure out how
to accomplish those tasks in the all-too-often, mercilessly unforgiving corporate
environment.
Instead, Jinn Barnes has provided a practical framework including checklists,
specific steps
necessary for these tasks to take place at all, even examples of effective
correspondence.
For example, what is the point in teaching a contingency planner how to conduct a
data-gathering interview until the interviewee agrees to participate willingly? With
this book,
Jim Barnes has taken an important step in removing much of the guesswork and
frustration
froze the business continuity implementation project.”

- Philip Jan Rothstein, FBCI
President, Rothstein Associates Inc.

= = = = = = = =
= =

CONTENTS

FOREWORD

1 INTRODUCTION
The. Structure of the Book
Phases

2 PROJECT FOUNDATION
BCP Evaluation Questionnaire
Pre-Engagement Questionnaire
Work Plan
The Proposal
Kick-off Meeting
Policy Statement
Data Requests

3 BUSINESS ASSESSMENT
Risk Assessment
Business Impact Analysis (BIA)
Conclusions

4 STRATEGY SELECTION
Computer Center Recovery
No Strategy
Relocate, Rebuild, Restore
Cold Site
Hot-Site
Hot-Site with Electronic Vaulting
Active Recovery Site (Mirrored)
Reciprocal Agreements
Other Component Recovery
Communications Recovery
Voice Communications
Data Communication
Facilities Recovery
Structure
Power
Insurance
Business Income Insurance
Additional Coverages
Staff Recovery
Vendor Selection
Customer Relations
Plan Strategies

5 PLAN DEVELOPMENT
Teams
Emergency Management Team (EMT)
Recovery Teams
Documentation Rules

6 TESTING AND MAINTENANCE
Testing
Maintenance

INDEX

= = = = = = = =
= =

ABOUT THE AUTHOR

“JAMES C. BARNES, Manager of Deloitte & Touche, has over 13 years of
extensive
experience in Business Continuity Planning. Most recently, he assisted in the
design of a
Business Continuity Company Certification course, which he taught in Europe,
South
America, and the United States. He has written over 300 Business Continuity
Plans of which
12 have been successfully exercised, and specializes in the areas of continuity
risk
management, vulnerability and risk assessment, business continuity planning,
BCP policies
and standards, strategic planning for financial institutions, and economic
forecasting.

“Mr. Barnes has held several positions in these areas, such as Director of
Business
Continuity Planning for Citibank, Florida, where seven of his plans were exercised
during
Hurricane Andrew. He has also conducted numerous seminars on business
continuity
planning throughout the United States, working with clients such as Johnson &
Johnson, the
Chicago Stock Exchange, the First American Financial Corporation, MONY, and
Conseco.”

= = = = = = = =
= =
2001, 174 pages. Order #DR529.
= = = = = = = =
= =

The Disaster Center Bookstore

Business Continuity, Disaster Recovery

Disaster Center Bookstore-a service of Rothstein Associates