Dyson College of Arts and Sciences
Issue link: http://dysoncollege.uberflip.com/i/128987
Business Continuity Design The business continuity scheme is only a framework used to integrate the design of all business components required to devise a business continuity program. This step is needed to define the business continuity management requirements that will describe the business continuity activities that have to be completed when a business disruption takes place. These activities should be described in sufficient details in the business continuity plan. The following activities are an example of such activities: 1) Incident analysis requirements; 2) Requirements for isolating incidents; 3) Disrupted business assessment requirements; 4) Requirements for protecting facilities; 5) Requirements for withdrawal to safety; 6) Requirements for defining relocations; and 7) Business resumption requirements. Incident analysis is the first step, even though it is the one that may take longer than any other step of the business continuity plan. It is not easy to know right away what really happened unless it is an attack for which we know the signature. Most often, if this is an incident that we recognize then it is very likely that a response will be automatically planned and corrective actions will be straightforward. If, however, it is not an incident that we recognize, then we need to investigate and collect more information about the incident. This should take as long as is needed. The incident isolation step is also among the initial business continuity plan activities that are started as soon as the disruptive incident is detected. Isolating the incident is consequential in delimiting the affected resources and areas. If the incident cannot be isolated, then it will be very difficult to protect the organization and its infrastructure. Before we initiate any corrective actions, we need to know the extent of the damage. We have to identify the affected resources and areas, assess their operations, and provide enough information to management to determine the corrective actions that may mitigate business risks, determine whether or not and how resource withdrawal to safety may be planned, and determine whether or not and how relocations are planned. Of course, the business assessment step should not wait until the incident analysis step is completed, as this may never happen. Even though any information obtained from the incident analysis step will be very helpful in studying the business impact, business assessment may, in fact, be conducted fully independently of the incident analysis step. While the other business continuity plan activities, like disrupted business assessment and incident analysis, continue, corrective actions are performed to save the infrastructure of the organization. Telecommunication networks, buildings, and many other resources have to be protected and restored when feasible. Minimal configurations of business functions may start as soon as the necessary components needed for those business functions are restored. The restoration process may be sequential, as business will be recovered sequentially starting from smaller configurations to larger configurations. The business continuity process may bring back the organization to the initial configuration or even to a better one. Once we have obtained enough information from the incident analysis step, disrupted business assessment step, infrastructure protection step, and incident isolation step, we can then start the step concerned with withdrawal to safety. This step involves identifying the most valuable resources, including people, so that we can evacuate them rapidly. Evacuation maps, for people or other resources, may be needed. This will facilitate the withdrawal of information resources to safer areas and the evacuation of employees (Businessballs, 2012). 62