Dyson College of Arts and Sciences
Issue link: http://dysoncollege.uberflip.com/i/128987
business continuity program we designed earlier. This program should be presented to the business continuity staff and tested by them. This testing activity will identify operational faults, which will be re-examined by the business continuity team and corrected. Any inconsistencies or violations of the business continuity policy, security policy, and other organizational regulations and policies should be resolved. Documentation of Business Continuity The business continuity program is now tested and validated. It is then documented and used to generate the business continuity plan. The final business continuity plan is then submitted to management for approval. The Institute of Professional Business Continuity Managers, also known as the Business Continuity Institute (BCI), defines a business continuity plan as follows (Business Continuity Institute): "A clearly defined and documented plan for use at the time of a Business Continuity Emergency, Event, Incident and/or Crisis (E/ I/C). Typically a plan will cover all the key personnel, resources, services and actions required to manage the business continuity management process." At this point, we achieved the objective of producing the intended business continuity plan which is a document presenting, in easy terms, the plan to be followed to resume business if an incident occurs. However, in order to achieve full competency, effective training methods have to be adopted. Diversified training tools have to be used, including videos, lectures, case studies and workshops, and discussion seminars. Training without test measures may not be effective, as we cannot know for sure that the training objectives we had in mind have been achieved. Diversified testing techniques have to be used, including case studies and workshops. Moreover, exercising business continuity with live scenarios is the best way to develop an effective response. Diversified scenarios for business disruptions have to be selected. The parts of the business continuity plan that concern the selected scenarios have to be acted out as if we were in a real business disruption situation. Throughout the exercises and at the end of every exercise, all deficiencies of any type have to be documented. The accumulated reports have to be studied and necessary corrections have to be recommended. All findings obtained from earlier testing and exercising activities are used as inputs to the business continuity plan review step. Additionally, many other types of reviews may be performed to make sure the business continuity plan is effective. It is also recommended that independent internal or external auditors may be called in to audit or review the business continuity plan. The auditors and reviewers submit their reports to the business continuity team. While minor modifications, additions, or deletions may be effected immediately, all major revisions have to be approved by upper management. Maintenance of the Business Continuity Plan The maintenance of the business continuity plan aims at the continual improvement of the business continuity plan. While the business continuity team may employ any activities or techniques to enhance the effectiveness of the business continuity plan any time they deem necessary, there are circumstances when minor or major revisions 64