Business Continuity and Disaster Recovery Software Modules

Simple explanation of the decomposition of the software, a more detailed explanation can be found here:

Know Your Business

Determining the current Organisational Environment

To ensure that Business Continuity plans are developed and maintained effectively, it is essential that they are aligned with the strategic business objectives of the organisation. A good understanding of the business as it relates to Business Continuity is therefore essential.

Business Continuity affects the entire breadth and width of an organisation, whilst IT is a major process of most organisations IT is not the be-all-and-end-all of an organisation. Therefore, we need a means of gathering a true insight into what the organisation actually does, how it does it and when it needs to do it.

The below diagram shows the 'Know Your Business' Stage, which comprises the following Modules:

• Continuity Management
• Business Processes
• Facilities
• Insurance
• Risk Assessment
• Business Impact Analysis
• Interviews
• Developing Strategies

Click to Enlarge

The modules will guide you into compiling this information in a structured manner. Once we have ascertained this very important information, we can decide on how to protect it via the 'Develop Your Plan' Stage.

The output (deliverables) of the 'Know Your Business' stage becomes the input (requirements) of the 'Develop Your Plan' stage.

Develop Your Plan

Developing the Plan to recover your current Organisational Environment

This Stage should address:

• The initial recovery and/or continuity of business operations
• Those activities necessary to maintain operations in crisis-mode
• The return of the business operations to the original locations / state

Design, Develop, Document and Implement the Recovery Tasks to provide recovery within the recovery time objective (RTO) of your critical Business Processes listed in the Business Processes Module.

There are four sets of information required by every organization to ensure they can effectively recover from any event. 'Develop Your Plan' enables you to define and assign these four critical sets of information. You can create groups of tasks, resources, contacts and assets. Individual tasks, resources, contacts and assets can be grouped together as a single unit. For example, you can group related tasks into a task group to make it easier to manage your plan and you can group contacts receiving the same message or instructions.

The below diagram shows the 'Develop Your Plan' Stage, which comprises the following Modules:

• Recovery Tasks
• Task Groups
• Resources
• Resource Teams
• Contacts
• Contact Groups
• Assets
• Asset Groups

Click to Enlarge

Key Output:

• What tasks must be performed to support the recovery effort?
• Exactly how to perform each of the tasks?
• The approximate time frame and sequence when tasks are to be completed?
• Who in the organization is responsible for each task and who is assigned to do the work?
• Which external organizations and people will be involved and how to reach them?
• What facilities, services, equipment and other assets we will require and where to get them?

Note: The recovery tasks incorporated into the Business Continuity Plan should reflect your organization's operating procedures.

Implement Your Plan

Implementing the Recovery of your current Organisational Environment

Essentially, we are talking about the responding to, escalating and managing a disaster or crisis. How you respond to an event is one of the most critical components of the recovery process. It is critical to understand that you need to act upon a disaster or crisis quickly so that you can meet their Recovery Time Objective (RTO) of your critical Business Processes.

The below diagram shows the 'Implement Your Plan' Stage, which comprises the following Modules:

• Declaring Disasters
• Notify
• Media Relations
• Event Log
• Schedule
• Timeline

Click to Enlarge

You can schedule and monitor the performance of your Business Continuity Plan for a planned test or in an actual disaster situation. Once you have scheduled the tasks you have selected, you can monitor and report on the overall status of the test or actual recovery results.

How you handle the media can be a make or break situation. This needs careful preparation. Develop, coordinate, evaluate, and exercise plans to handle media during crisis situations.

Maintain Your Plan

Maintaining the ability to Recover your current Organisational Environment

A Business Continuity Plan is only as valid as the information it contains. To ensure that the plan can be used effectively in an emergency, it must be accurate, up-to-date and complete. It is a living document. It is imperative, therefore, that the plan be reviewed often and updated as necessary.

To ensure that the information in your Business Continuity Plan is as current as possible, you need to schedule regular maintenance updates. We suggest that you prepare an annual schedule, indicating a scheduled review of all resource, contact and asset information.

The below diagram shows the 'Implement Your Plan' Stage, which comprises the following Modules:

• Plan History
• Plan Status
• Plan Verification
• Resource Training
• Exercise Plan

Click to Enlarge

The actual frequency of maintenance will depend on your organization and the volume of information in your recovery plan. We suggest the following guidelines when scheduling maintenance:

Given the critical nature of resource information, we suggest that you review all resource details at least every two to three months.

At a minimum, you should review contact data on a quarterly basis.

You should verify asset information (which is most likely to be in a constant state of change) on a monthly or bimonthly basis.

The combination of recovery plan testing and a regular data maintenance program will go a long way to ensuring a successful recovery.

The Business Continuity Plan is only as good as the effort applied to keep the information current. This is why we schedule and perform tests of the BC Plan, to make sure that changes in the organization (i.e. - people, functions, suppliers, assets, computer systems) are reflected in the plan. Testing of the procedures also ensures that the assigned resources remain familiar with what they are assigned to do in a real crisis.