# Chapter 3 – Business Continuity Planning

BC = Business Continuity (strategic, high level focus on business processes)
DR = Disaster Recovery (more tactical, focus on technical activities)

Business Continuity Planning is an ongoing organisational process. The **goal of BCP planning** is to implement and maintain policies, procedures and processes to mitigate the impact of disruptive events.

Domain I, sheet 62:
• DR planning can be seen as a subset of BC planning
• The BC Plan is carried out when critical business processes are (threatened to be) interrupted
• The DR Plan is carried out after a disaster has actually happened and the organization is in 'emergency' mode

1. Project initiation 
2. Developing a plan


The **deliverables** are a set of approved and implemented policies, procedures and processes to:
* Continue mission-critical operations with reduced capabilities or resources
* Enhance a company’s ability to recover from disaster promptly

**The BCP process has three phases:**
* BCP Development (developing a set of approved policies, ... )
* BCP Testing, Training and Maintenance
* BCP Implementation (having resources availability for when disaster strikes) 

**BCP development has four stages:**
* Project Scope and Planning
* Business Impact Assessment
* Continuity Planning
* Approval and Implementation (of the policies, ... )

The result of the BCP development (or design) phase is the BCP document, a set of approved policies, procedures and processes, including an Implementation Plan.

## Project Scope and Planning
This stage is the preparation for creating the BCP, it involves four steps:
* Business organization analysis (BOA)
* BCP team selection
* Determining resource requirements
* Identifying legal and regulatory requirements

### Business organization analysis (BOA)

Identify:
* stakeholders (departments and individuals)
* core business processes
* critical support services (e.g. IT, facilities mgt, maintenance)
* Physical security teams (often first responders)
* Senior executives

One of the first tasks of the BCP Team should be reviewing the BOA.


### BCP team selection

At minimum:
* Representatives of all departments involved in core business processes
* Representatives of critical support services
* IT subject matter experts
* Cybersecurity team members
* Physical security team members
* Facility mgt team members
* Attorneys (for legal and regulatory requirements)
* Public relations team members
* Senior mgt representatives

### Determining resource requirements

Resources are needed in three BCP phases:
* BCP Development – involves project scope, Business Impact Assessment, Continuity Planning and Approval and Implementation (of the policies, ... )
* BCP Testing, Training and Maintenance – requires hardware, software and people
* BCP Implementation – having resources availability for when disaster strikes

### Identifying legal and regulatory requirements

Some organizations are required to operate, by law: police, healthcare, banks, etc., or by contractual obligation (as in SLA’s).
 
## Business Impact Assessment
After the stage of Project scope and planning has been conducted, it’s time to start with the core stage of BCP development: Business Impact Assessment.
BIA identifies the critical resources and the threats imposed on them.

BIA involves:
1. Priority identification
2. Risk identification
3. Likelihood assessment
4. Impact assessment
5. Resource prioritization

**Priority identification:** rank business processes in order of importance (qualitative, ask each department to rank it’s functions and then combine). Then combine a list of Assets, assign an Asset Value for each, and set the Maximum Tolerable Downtime (quantitative).
Third, define the Recovery Time Objective for each business function.
Now you can design and plan the procedures necessary for recovery.

The goal of the BCP process is to make your RTO’s less than your MTD’s, so no business function is unavailable for longer than is acceptable.

**Risk identification:** purely qualitative. Identify natural and man-made risks. Include risks and impact on service providers and cloud vendors; verify that they have the controls in place to deliver on their contractual commitments (e.g. SOC-2 or SOC-3).

**Likelihood assessment:** expressed in Annualized Rate of Occurrence (ARO). That is the number of times you expect a certain risk to materialize each year. Based on corporate history, professional experience, expert advice, public and proprietary sources (e.g. government organizations and insurance firms).

**Impact assessment:** what impact could occur on assets through risks materializing. Calculate the Single Loss Expectancy by multiplying the Exposure Factor and the Asset Value: SLE = AV x EF.
The Exposure Factor is the potential loss of value the risk poses to the asset, expressed as a percentage.
Then multiply the Single Loss Expectancy with the Anual Rate of Occurence to get the Anualized Loss Expectancy: ALE = SLE x ARO.
Also consider qualitative impact like reputation damage and social/ethical responsibilities.

**Resource prioritization:** sort the identified risks by Anualized Loss Expectancy and work down the list until “you’ve run out of available resources” [that will actually happen in the Continuity Planning stage].

## Continuity Planning
This stage focuses on developing a strategy to minimize the *impact* of risks once they materialize.

Sub tasks of Continuity Planning are:
* Strategy development
* Provisions and processes
* Plan approval
* Plan implementation
* Training and education

During **Strategy development** you determine which risks will be mitigated and which risks will be accepted, considering Maximum Tolerable Downtime and likelihood.

In the **Provisions and processes** phase the BCP team designs the measures that will mitigate the impact on three categories of assets: people, buildings and facilities, and infrastructure.
People should be able to conduct both their BCP and operational tasks as normal as possible. 
Buildings and facilities should be ‘hardened’ by protective measures and if that’s not feasible, alternative sites should be identified.
The same goes for Infrastructure, like IT backbone, transport systems and power supply: systems should be *physically* hardened, or redundancy should be introduced.

## Approval and Implementation
The BCP document needs endorsement by top-level management. After that, the actual implementation starts. This means developing an implementation schedule to achieve the designed processes and provisions.

The implementation includes:
* Training of people directly involved in the BCP activities (incl backups) and education of all personnel. 
* Documenting the BCP methodology, including continuity planning goals, risk assessments and risk treatment
* Publishing and distributing a Statement of Importance, Statement of Priorities, Statement of Organizational Responsibility, Statement of Urgency and Timing
* A Vital Records program
* Emergency-Response guidelines, with immediate response procedures, people to be notified, secondary response procedures (i.e. procedures that first responders should take while waiting for the BCP team to assemble)
* Maintenance procedures for the Business Continuity Plan
* Test and Exercise program (see also Chapter 18)