Security Mgt, BCP

business continuity planning
1. provides reassurance to the organization tha tin the vent of a major disaster such as flood, fire or power outage, the organization would be able to counteract these disruptions in a timely manner
2. helps minimize the impact which such disruptions would have on identified critical assets and allow for a timely resumption of such assets
3. testing needed
4. process for an organization continued operatino despite events that would otherwise disrupt or halt operations,, maintain minimum business continuity objectives (MBCO) whilst restoring full operations - recovery time objectives (RTO) as fast as possible
5. concerned with ensuring the continuity of business operations in the event of a catastrophic failure tha could cause not only the inability of operations, but damage to share value, reputation, brand, customer confidence..
6. avoid creep
  1. where incidents create an avalanche effect
7. focuses on availability of systems
8. includes disaster recovery planning, crisis management, emergency response, damage limitation...
9. takes into consideration stakeholders impacted
  1. business processes
  2. people
  3. premises
  4. customers
  5. local community
  6. competitors
  7. shareholders
considerations
1. identify core information assets and perform risk assessment
2. assets should be prioritzied in terms of criticality
3. Resources needed to address incidents must be assured to be available.
4. safety of staff must be kept in mind
5. planning should be done with impacted people
6. should be documented
7. assess worse case scenario
examples
1. email server down
  1. impact
    1. no email with clients
    2. loss of business deals
    3. reputation is damaage
  2. likelihood = low
  3. plan
    1. have offsite server that replicates onsite system
2. electricity goes out
  1. impact
    1. staff can't work
    2. servers could be impacted
    3. plan
      1. alternative power supply
threats
1. technical
  1. hardware and software failures including power and telecom
2. social
  1. human inflicted event
3. environmentsl
  1. natural variables such as floods, storms, earthquakes, fire...
legislation
1. Basel II
2. FISMA (federal information security management act)
  1. US law intended to prevent governmental information, operations, assets against natural and manmade threats
3. Turnbull
standards
1. ISO 22301
2. ISO 27031
3. ISO27001 control objective A.14
disaster recovery plan
1. process by which you resume business after a disruptive event
2. based on a solid business continuity plan
3. focussed on IT systems and the recovery of those systems in the event of a systems failure that leads the organization to not be able to function normally
4. reacive process triggered by disruptive impacts to the organisations's critical technology infrastructure

Next up

Security Mgt, BCP

Description

Resource summary

Similar

	Created by jjanesko over 11 years ago