...Audit of Business Continuity Planning (BCP) Final Audit Report Audit and Evaluation Branch June 2006 Tabled and approved by DAEC on January 9, 2007 Audit of Business Continuity Planning (BCP) Industry Canada (IC) TABLE OF CONTENTS 1.0 EXECUTIVE SUMMARY .............................................................................................. 2 1.1 INTRODUCTION ................................................................................................................ 2 1.2 OVERALL ASSESSMENT.................................................................................................... 2 1.3 MAIN FINDINGS, CONCLUSIONS AND RECOMMENDATIONS ............................................. 2 1.3.1 Business Continuity Plan Governance (See Section 3.1 of the BCP Standard) ......... 2 1.3.2 Business Impact Analysis (See Section 3.2 of the BCP Standard).............................. 3 1.3.3 Business Continuity Action Plans and Arrangements (See Section 3.3) .................... 4 1.3.4 BCP Program Readiness (See Section 3.4 of the BCP Standard) .............................. 5 1.3.5 BCP Training and Awareness (See Section 3.4 of the BCP Standard) ...................... 5 2.0 INTRODUCTION............................................................................................................. 7 2.1 BACKGROUND .................................................................................................................. 7 2...
Words: 5659 - Pages: 23
...can harm operational revenue, services, supply-chain, and reputation. Any of the preceding effects from a disruption could possibly be severe enough to mean the end of business as a going concern. To avoid severe or long term damaging disruption, a comprehensive contingency plan can provide a guide for how resources and personnel will be allocated in the event of a crisis. Keywords: Business Continuity Plan (BCP), Information Technology, contingency plan Table of Contents Business Continuity Plans 4 Planning Steps 5 Business Impact Analysis 6 Recovery Strategies 8 Data Backup 10 IT Personnel Training 10 Alternate Site 11 Contingency Plan Development 12 Training and Testing 13 Recommended Training and Testing 14 Test Schedule 15 Summation 17 References 18 Business Continuity Plans Greater numbers of businesses now must consider the protection of their computer information systems as a vital aspect of their operations. Even as organizations became ever more reliant on computer systems over the past several decades, information technology (IT) contingency planning was not a high priority. In recent years that has changed as the need to protect systems, networks, and information has become a necessity (Neal, 2013). The importance of protecting a business’s IT has become a critical part of shaping the plans and policies at most companies; or at least should be for companies that have not considered the ramifications of not prioritizing the protection of their IT...
Words: 4274 - Pages: 18
...continuity plan (BCP) is a practice adopted by the university to ensure continuity in their services and business unit processes in cases of disruptions preventing normal procedures from taking place (Latha, 2003). These disruptions may be in the form of threats such as earthquakes, fires or pandemics like the Ebola crisis. The main objectives of the BCP are to maintain, resume and recover all of the activities of the university as a whole unit implementing both the human operational factors (Ken, 2000). All the university departments are involved in the development of the BCP and as a team conduct a risk assessment and business continuity plan (Latha, 2003). In case the university cannot handle an emergency situation using routine measures, the president implements an emergency plan. The university’s incident command section comprises of the safety officer and emergency operations executive who oversee the emergency operations. The planning section coordinates responsibilities of planning and intelligence while the finance section keeps a record of all purchases and report making. The university business impact analysis (BIA) analyzes the critical functions that affect the health and safety of university staff and students. It also analyzes the critical functions that influence the continuity of the university. The functions of the BIA are prioritized and respective downtime estimated. Prioritization is done according to severity of threat or pandemic which varies as the BCP is revised...
Words: 483 - Pages: 2
...Risk Management JIT 2 Task 1b American International Insurance BCP William Gardner May 9, 2015 Task B. Create a business contingency plan (BCP) that the company would follow if faced with a major business disruption (e.g., hurricane, tornado, terrorist attack, loss of a data center, the sudden loss of a call center in a foreign country, the collapse of a financial market or other catastrophic event) in which you include the following: 1. Analyze strategic pre-incident changes the company would follow to ensure the well-being of the enterprise. 2. Analyze the ethical use and protection of sensitive data. 3. Analyze the ethical use and protection of customer records. 4. Discuss the communication plan to be used during and following the disruption. 5. Discuss restoring operations after the disruption has occurred (post-incident). Since 1919, A.I.I. has been in the business of insuring businesses and people from losses incurred through disasters. For 95 years (A.I.I.) has stood by its clients as they faced many challenges from the financial collapse of 1929 to the drought of the dust bowl years and even the ravages of World War Two. Assisting our clients in the face of hurricanes, tornados and even terrorist attacks is an everyday occurrence at A.I.I... However, who is planning and preparing for A.I.I.? A BCP is a plan to do exactly that, during the financial collapse of 2008 several flaws in the existing plans were exposed; flaws that not even the...
Words: 3242 - Pages: 13
...T e c h n i c a l n o T e s a n d M a n u a l s Operational Risk Management and Business Continuity Planning for Modern State Treasuries Ian Storkey Fiscal Affairs Department I N T e r N A T I o N A l M o N e T A r y F U N D INTerNATIoNAl MoNeTAry FUND Fiscal Affairs Department Operational Risk Management and Business Continuity Planning for Modern State Treasuries Prepared by Ian Storkey Authorized for distribution by Sanjeev Gupta November 2011 DISCLAIMER: This Technical Guidance Note should not be reported as representing the views of the IMF. The views expressed in this Note are those of the authors and do not necessarily represent those of the IMF or IMF policy. JEL Classification Numbers: Keywords: H12, H60, H63, H83 business continuity, disaster recovery, business continuity and disaster recovery plan, operational risk, operational risk management, treasury operations ian@storkeyandco.com Author’s E-Mail Address: TECHNICAL NoTEs ANd MANUALs Operational Risk Management and Business Continuity Planning for Modern State Treasuries Prepared by Ian Storkey This technical note and manual (TNM)1 addresses the following main issues: • What is operational risk management and how this should be applied to treasury operations. • What is business continuity and disaster recovery planning and why it is important for treasury operations. • How to develop and implement a business continuity and disaster recovery plan using a six practical-step...
Words: 10882 - Pages: 44
...and specific actions necessary to prudently protect criticial busin precesses from the effects of major system and network disruptions and to ensure the timely restoration of business ops if significant disruptions occur BCP and DRP BIA stands for Business Impact Analysis MTD stands for Maximum Tolerable Downtime first step in building BC program Project initiation and management activites of project initiation and mgmt 1) obtain senior mgmt support 2) define a project scope, the objectives, to be achieved and planning assumptions 3) estimate the project resources needed (human and financial) 4) Define a timeline and major deliverables Senior leadership's two major goals 1) Grow the business 2) Protect the brand What are the risk to a corporation for not having BC/DRP? 1) Financial 2) Reputational 3) Regulatory Formula for calculating financial risk P * M = C P: Probability of harm M: Magnitude of harm C: Cost of prevention Prudent man rule exercise the same care in managing the company affairs as in managing one's own affairs 1. Which of the following is considered the most important component of the enterprisewide continuity planning program? c. Executive management support 2. During the threat analysis phase of the continuity planning methodology, which of the following threats should be addressed? a. Physical security b. Environmental security c. Information security d. All of the above d. All of the above 3. The major objective of the business impact...
Words: 2067 - Pages: 9
...1.The creation of a strategy through the recognition of threats and risks facing a company, with an eye to ensure that personnel and assets are protected and able to function in the event of a disaster. Business continuity planning (BCP) involves defining potential risks, determining how those risks will affect operations, implementing safeguards and procedures designed to mitigate those risks, testing those procedures to ensure that they work, and periodically reviewing the process to make sure that it is up to date. 2.When a business continuity plan is correctly used it can help reduce operational risks. Operational risk is the risk of loss experienced from internal processes as a result of external events. These internal processes could have failed completely or simply been inadequate. This does include calculating the legal risk as well but does not take into account business risk that is based in strategy or reputation. Some examples of operational risk are losses arising because of internal or external frauds, natural disaster, failed transaction processing or inability to meet the commitment of service, and the disruption of business or system failures. 3.There are many different approaches to BCP and DRP. Some companies address these processes separately, whereas others focus on a continuous process that interweaves the plans. The National Institute of Standards and Technology 4.The degree of spread of Ebola in the months ahead is uncertain. In the unlikely...
Words: 1432 - Pages: 6
...name] | 5/16/2013 | | Part 1 I. Initiation of the BCP The initiation of a BCP is an effort by the company to ensure that mission-critical functions of the organization have the ability to continue operations in the event of a disruption. II. Business Impact Analysis The BIA is the part of the BCP that prioritizes mission-critical functions and processes and accesses the impact of various types of disruptions. This includes but is not limited by intruders, injections, server crashes and more. III. Business Continuity / Disaster Readiness / Recovery Business continuity is described as the ability of a business to continue to operate during and after a disaster. Disaster Readiness is how well an organization is prepared to handle a disaster. Recovery is what must be done in the event of a disaster to bring the organization back to normal functionality. IV. Develop & Implement the Plan This is the process of creating a plan that details how the organization will react in the event of a disaster, and the implementation of the plan is informing management, employees, and customers of the new policies. V. Test & Update the Plan The testing of the plan consists of either simulations or full-blown test of the plan. This will help to identify anything that was missed in the development phase and allow for the plan to be properly updated. Part 2 Lab 8 Questions 1. A BCP can help to mitigate risk because it highlights the mission-critical...
Words: 456 - Pages: 2
...Commercial Management and Risks Job brief Commercial management is the identification and development of business opportunities and profitable management of a project from inception to completion. A commercial manager has to understand how to make profit and how the profit is reflected in its operations. In a construction site, commercial management deals with outlining the beginning of a project i.e. the negotiations and analyzing of the cost of the whole construction project and the long term profit to be yielded by the project. It is said that every construction is unique, and the unique aspect demands a high level of commercial and technical expertise. As a commercial manager, I will provide a management system that ensures proper documentation. This entails that all the documents of the contract follow a full legal procedure that is the land on which the construction is taking place and is acquired legally. The tender details are all available and the contract details of the contractor and his team are all available and ensure clarity to reduce future conflicts between the client and the contractor as Lowe and Leiringer (2006) argue. System devised Programme The system will also define a well defined target. When referring to target we can consider two cases that is the time the construction will take from inception to completion and the financial target. When dealing with the time target we ensure that the construction program is available to all team members to...
Words: 1247 - Pages: 5
...ISS 310 Mr. Behboodi CCSD Business continuity Plan Assignment 2 03/22/2016 The business continuity planning (BCP) is the creation of a strategy through the recognition of threats and risks facing a company, with an eye to ensure that personnel and assets are protected and able to function in the event of a disaster. When business is disrupted, it can cost money. Lost revenues plus extra expenses means reduced profits. Insurance does not cover all costs and cannot replace customers that defect to the competition. This strategy can be comprised of a basic 4 part setup with an array of sub categories within these guidelines. The type of business that I will be making a mock example for would be an IT business. This paper will also explain the composition of the 4 parts of a BCP. The battle plan. Consisting of 4 parts, Business impact analysis, plan development and testing and Exercises. Part 1 the business continuity impact analysis picks up on the problems resulting from negative effects of a normal business function and processes. This makes it easier to fix and rectify the problem down the road. Also conducting a workshop to instruct business function and process mangers how to complete the business impact analysis. Once finishing a basic training for management level employees, conduct follow up...
Words: 527 - Pages: 3
...Chapter 3 Planning for Contingencies Chapter Overview The third chapter of the book will articulate the need for contingency planning and explore the major components of contingency planning. In this chapter, the reader will learn how to create a simple set of contingency plans using business impact analysis and prepare and execute a test of contingency plans. Chapter Objectives When you complete this chapter, you will be able to: • Understand the need for contingency planning • Know the major components of contingency planning • Create a simple set of contingency plans, using business impact analysis • Prepare and execute a test of contingency plans • Understand the unified contingency plan approach Introduction This chapter focuses on planning for the unexpected event, when the use of technology is disrupted and business operations come close to a standstill. “Procedures are required that will permit the organization to continue essential functions if information technology support is interrupted.” On average, over 40% of businesses that don't have a disaster plan go out of business after a major loss. What Is Contingency Planning? The overall planning for unexpected events is called contingency planning (CP). CP is the process by which organizational planners position their organizations to prepare for, detect, react to, and recover from events that threaten the security of information resources and assets, both human and...
Words: 3573 - Pages: 15
...Risk Management Plan Project Name: IS305 Project Manager: Paul Bettinger Date: October 1, 2013 RISK management PLAN INTRODUCTION 2 PURPOSE AND SCOPE 2 RISK MANAGEMENT PLANNING 3 RISK MANAGEMENT ASSIGNMENTS 6 RISK MANAGEMENT TIMELINE 7 MITIGATION PLAN Introduction 8 Cosiderations 8 Prioritizing 9 Cost benefit analysis 10 Implementation 11 Follow-up 11 Buisness impact analysis Introduction 12 Scope 12 PURPOSE AND objectives 13 Steps of bia 13 final review 15 BUSINESS CONTINUITY PLAN Introduction 16 oBJECTIVES 16 BCP PLANNING 17 PLAN UPDATES AND TRAINING 21 computer incident response team Introduction 22 Purpose 22 elements of the plan 23 incident handling process 23 cirt members 23 detection 24 containment 24 recovery and review 24 cirt policies 25 FINAL THOUGHT RISK MANAGEMENT PLAN INTRODUCTION A risk management plan is a process for identifying, assessing, and prioritizing risks that could cause the company a loss. Identifying these risks, threats and vulnerabilities and taking action to prevent or control them now and in the future. Creating a risk management consists of measuring and prioritizing risks involved and taking actions to reduce any loss the company may encounter. Being that indirectly we work with the Department of Defense, which as you knows is a department of the United States Government dealing with national security, a well-developed risk management plan is of the upmost importance. Without updating...
Words: 5009 - Pages: 21
...Although a disaster has not yet occurred, not having a BCP plan is a weakness because it allows businesses to quickly recover and restore data should a disaster occur, which minimizes losses and allows the business to continue operations. Failing to test backups is a weakness since tests ensures the data to be used is accurate and complete, and software will function properly. Retaining backups offsite is a strength since it allows for duplication of the data and applications and quick recovery. Environmental controls such as fire extinguishers, raised floors, back-up generators and temperature controls are onsite preventative measures are a strength since they ensure minimal disruptions in business operations and destruction of physical assets and data. The concluded risk assessment for Business Continuity Planning is high since creating a BCP plan and going through it is essential to know what actions work well and what modifications are needed to continue operations during a disaster before one...
Words: 1061 - Pages: 5
...Rusty Rims IT Strategic Plan, Part 2 Before you begin this assignment, be sure you have read the “Rusty Rims Case Study” and the feedback you received on your IT Strategic Plan Part 1 assignment. Also, be sure you have read the chapters in the textbook that have been assigned to this point. Purpose of this Assignment This assignment gives you the opportunity to apply the course concepts to complete the development of an Information Technology Strategic Plan (ITSP) to support the strategic direction of Rusty Rims Distribution Company (RR). This assignment specifically addresses the following course outcomes to enable you to: identify, define, and explain the concepts of information technology governance and management apply best practices in information technology management and governance to make, defend, and justify an IT decision IT Strategic Plan for Rusty Rims Distribution Company For the previous assignment, you developed Part 1 of an IT Strategic Plan for RR. For this assignment, you will incorporate any needed changes resulting from the feedback you received on your Part 1 assignment and you will add Part 2. Part 2 will include an IT project that you are proposing that RR undertake. This new project will be included in the IT Portfolio section of Part 2, and will be further described in a future assignment, the “IT Decision Paper.” The entire ITSP will be submitted as a single document for this assignment. Assignment First, you should make...
Words: 2928 - Pages: 12
...Business Continuity Plan Under Development (May 2006) California State University, Stanislaus CALIFORNIA STATE UNIVERSITY, STANISLAUS BUSINESS CONTINUITY PLAN May 2006 Table of Contents INTRODUCTION I. II. III. IV. V. Incident Command System Business Impact Analysis Risk Assessment Business Plan for Localized Business Disruption Business Plan for Pandemics Page 3 Pages 4-7 Pages 8-11 Pages 12-13 Pages 14-15 Pages 16-17 Pages 18-19 Pages 20-36 Appendix IV-A: Power Outage Business Continuity Plan Appendix V-A: Pandemic Flu Business Continuity Plan 2 Final CP 5-30-06 CALIFORNIA STATE UNIVERSITY, STANISLAUS BUSINESS CONTINUITY PLAN May 2006 INTRODUCTION A Business Continuity Plan (BCP) is developed by an institution to plan for and describe how it will respond to and recover from disruptions. These disruptions can be localized threats (e.g., earthquakes, fires, floods, bombs, etc.) or global threats (e.g., Flu Pandemic). As part of the overall Emergency Operations Plan, California State University, Stanislaus has developed, and continues to refine and enhance, a Business Continuity Plan (BCP) for the University. This plan is about maintaining, resuming, and recovering the University’s activities as an educational institution. It considers human factors along with operational issues. The BCP was developed by a team of the University’s senior administrators and department managers representing all University divisions: Business & Finance, Academic Affairs...
Words: 10523 - Pages: 43
