Topics in this domain
- IT Service Management
- Hardware Components and Architecture
- Operating Systems
- OSI Model
- TCP/IP and Common Protocols
- Network Devices: Switches, Routers, Gateways
- LAN/WAN Topologies
- Database Models and DBMS
- Database Controls and Normalization
- Asset Management
- Configuration Management
- Job Scheduling and Batch Processing
- Incident Management
- Problem Management
- Change Management
- Release and Patch Management
- Service Level Management
- Capacity and Performance Monitoring
- End-User Computing
- BCP Lifecycle
- Business Impact Analysis
- RTO, RPO, MTD, SDO
- Recovery Strategies
- Alternate Sites: Hot, Warm, Cold
- Backup Types: Full, Incremental, Differential
- Backup Storage and Rotation
- DRP Contents
- Testing BCP/DRP
- High Availability, RAID, Insurance
- Auditing BCP
BCP Lifecycle
When the building is gone
Imagine your office floods overnight. Where do staff go in the morning? Which customers do you call first? Which systems must be back by lunchtime, and which can wait a week? Who’s allowed to make those calls?
Business continuity planning (BCP) answers those questions before the flood, while there’s time to think clearly.
BCP vs DRP
- Business continuity planning keeps the organisation’s critical processes running, or gets them back quickly, after a disruption. It covers people, premises, processes, suppliers and technology.
- Disaster recovery planning (DRP) is the IT part: restoring systems, data, networks and IT facilities so they can support the business recovery. DRP is a subset of BCP and must follow its priorities.
Related plans include incident response, crisis management and communication, and emergency response and evacuation.
The life cycle
| Step | Activities | Output |
|---|---|---|
| 1. Policy and scope | Management commitment, objectives, scope, roles, budget | Approved BCP policy |
| 2. Business impact analysis | Critical processes; impact over time; RTO, RPO, MTD; dependencies | Prioritised processes and recovery objectives |
| 3. Risk assessment | Threats and weaknesses that could cause disruption | Risks to reduce |
| 4. Strategy | Recovery options that meet the objectives at acceptable cost | Approved strategies (sites, backups, contracts) |
| 5. Plan development | Procedures, teams, contact lists, resources | Business continuity and disaster recovery plans |
| 6. Training and awareness | Staff learn their roles | Trained teams |
| 7. Testing | Exercises from desk checks to full interruption | Test reports and improvements |
| 8. Maintenance | Updates for organisational, system and staff changes | A current plan |
What comes first? After management commitment and policy, the business impact analysis. It identifies what matters and how fast it must come back, and everything after it depends on that. Choosing a recovery site before the BIA is putting the cart before the horse.
Who owns what
- Senior management is responsible for business continuity: it approves the policy and plans and provides the resources.
- Business process owners decide which processes are critical and set recovery requirements through the BIA. IT doesn’t decide this.
- A BCP coordinator or committee runs the programme.
- IT builds and maintains the DRP to meet the business’s requirements.
- Internal audit reviews it all independently.
What the plan contains
- scope, objectives and assumptions
- when the plan is activated, and who can declare a disaster
- teams, roles and responsibilities, with deputies
- contact lists: staff, suppliers, customers, authorities
- recovery procedures for critical processes, in priority order
- resources needed: sites, equipment, records, staff
- internal and external communication
- how to return to normal operations
Copies must be kept offsite and with key staff. A plan stored only on the server that just failed is useless.
Plans go stale fast
Update the plan after changes to the organisation, staff and contact details, systems and infrastructure, suppliers and premises, and after every test and real incident. An untested, out-of-date plan gives very little assurance.
Example. A company’s BCP was written three years ago. Since then, payroll has moved to a SaaS provider, head office has relocated, and half the people on the contact list have left. The plan is approved and nicely formatted, but would fail in a real event. The finding is about maintenance, not content.
Standards
ISO 22301 sets out requirements for a business continuity management system (BCMS) and can be certified against. ISO/IEC 27031 covers ICT readiness for business continuity.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| First step in developing a BCP (after management commitment) | Business impact analysis |
| Who determines the criticality of business processes | Business process owners / senior management |
| Who is ultimately responsible for business continuity | Senior management / board |
| Difference between BCP and DRP | BCP covers the business; DRP covers IT recovery |
| Most important factor keeping a plan effective | Regular testing and maintenance |
| Where plan copies should be kept | Offsite and accessible to key staff |
In short
- Business continuity planning (BCP) makes sure critical business processes can continue or resume after a disruption; disaster recovery planning (DRP) covers recovery of IT.
- The BCP life cycle: policy and scope, business impact analysis, risk assessment, strategy selection, plan development, training and awareness, testing, and maintenance.
- The business impact analysis is the key early step: it identifies critical processes and sets recovery priorities and objectives.
- Senior management is responsible for BCP; business process owners own recovery requirements; IT supports with DRP.
- A plan must be tested, kept current with organisational and system changes, and distributed with copies stored offsite.
- ISO 22301 is the standard for business continuity management systems.
Exam traps
- The FIRST step after getting management commitment is the business impact analysis, not choosing a recovery site.
- IT doesn't decide which business processes are critical; the business does, through the BIA.
- BCP covers people, facilities, processes and suppliers, not just IT.
- An untested plan gives little assurance; the most important ongoing activity is testing and maintenance.
- Plan copies must be available offsite; a plan stored only on the affected server is useless.
Slides
Click the slide and use the arrow keys. F toggles full screen.
BCP vs DRP
The life cycle
Who owns what