Speaking of Business Continuity: A Cheat Sheet
Michael Croy , Director, Business Continuity Solutions, Forsythe
Solutions Group, Inc.
One of the challenges organizations often face as they initiate business continuity or disaster recovery planning is to reach consensus on precisely what they are trying to do. This requires identifying and closing any gap that may exist between the actual availability/recoverability of the organization's information systems and the ability/recoverability expected by the business units and executive management.
The only way to close such a gap is for the business and IT management to engage in a comprehensive discussion of current capabilities, needs, procedures, and expectations. What follows is a "cheat sheet" designed to ensure that both sides are on the same page as they begin their discussion. These definitions are not meant to be all-encompassing, but rather, a starting point for a conversation.
Business Continuity Gap
The difference between the actual availability of an organization's information systems and the level of availability expected by its business units.
Business Continuity Planning (BCP)
A process to safeguard the entire enterprise from the effects of a business interruption and ensure business operations continue. Disaster Recovery is considered to be a subset which deals with the restoration of the IT infrastructure and supporting applications.
Business Continuity Program
An ongoing project sponsored by senior management to ensure that business continuity requirements are maintained, expanded, tested, and rehearsed to meet the changing needs of the organization, as well as ensuring that the organization is compliant with all applicable regulations.
Business Impact Analysis (BIA)
The process of analyzing individual business functions and the effect that a specific disaster or crisis may have upon them. The BIA should quantify the expected financial losses and other business impacts, based upon duration, for each threat and vulnerability faced. A BIA is used to help determine Recovery Point and Time Objectives.
Business Interruption
Any event that disrupts the normal course of business operations at a particular location. A disruption becomes a disaster if the duration exceeds a predetermined period of time.
Command Center
Facility separate from the main facility, equipped with adequate communications equipment from which initial recovery efforts are coordinated. The management team uses this facility to coordinate the recovery process; its use continues until the disaster (crisis) is contained.
Contact List
A list of team members and/or key players to be contacted during a disaster (crisis). This list should include the alternates for each primary team member (a.k.a. notification list).
Contingency Planning
The process of developing plans and procedures that enable an organization to respond to events that could evolve into a prolonged outage.
Critical Functions
Business activities that can neither be interrupted nor unavailable for a period of time without significantly jeopardizing the operation of the organization.
Critical Records
Records or documents that are essential for the organization to maintain and that cannot be recreated conveniently.
Data Backup Strategies
Those processes determined by an organization to be necessary to meet its data backup and recovery objectives. Elements of the strategy determine the timeframes, technologies, media, and handling of the backups as determined by policy as well as Recovery Point Objective and Recovery Time Objective requirements.
Data Backups
The backup of any computer file to media that can be removed offsite either physically or electronically. Data backups can be used to restore corrupted or lost data on a file or media basis or to recover entire systems in the event of a disaster.
Data Recovery
The restoration of computer files from backup media to a state that existed at the time of the last available backup. Also, the recovery of data from failed media in the event that backups do not exist.
Disaster (Crisis)
Any event that disrupts an organization's ability to provide critical business functions for a duration greater than the length of time predetermined to be acceptable (see Recovery Time Objective).
Disaster Notification
Communication methods, processes, and timeframes used to notify business units and customers of a disaster.
Disaster Recovery
The reaction to the interruption of a specific business process, according to a plan that ensures its orderly and timely restoration.
Disaster Recovery Plan (DRP)
The document that defines the resources, actions, tasks, and information required to execute the recovery process in the event of a disruption. The plan should be designed to provide a complete framework for restoring support for critical business processes within the stated recovery objectives.
Disaster Tolerance
The measure of the ability to withstand threats and overcome disruptions. Disaster tolerance identifies the redundancies built into critical processes and facility infrastructure, and the application of other methods to reduce Single Points of Failure.
Downtime
A planned or unplanned interruption in availability. Downtime can be a result of any of a number of interruptions or events. While often measured differently by information technology and business management, the net impact of downtime is that end-user(s) cannot access required resources.
Enterprise Backup and Recovery (EBR )
An integrated set of procedures for regular, sometimes continual, Data Backup and Data Recovery that meet an organization's availability/Business Continuity requirements.
Event
A polite term for a disaster or crisis.
Exercise
An announced or unannounced test performed for the purpose of educating and training team members and validating the Disaster Recovery Plan.
Financial Impact
Revenue loss or operating expense that continues following an interruption or disaster, as a result of the event, and that cannot be offset by insurance and directly affects the financial position.
|
