BusinessContinuityManagement(BCM)ObjectiveTheobjectiveofbusinesscontinuitymanagementistocounteractinterruptionstobusinessactivitiesandtoprotectcriticalbusinessprocessesfromtheeffectsofmajorfailuresordisasters.Abusinesscontinuitymanagementprocessshouldbeimplemented-isactuallyrequiredtobeimplementedbyISO17799-toreducethedisruptioncausedbydisastersandsecurityfailures(whichmaybetheresultof,forexample,naturaldisasters,accidents,equipmentfailures,anddeliberateactions)toanacceptablelevelthroughacombinationofpreventativeandrecoverycontrols.Theconsequencesofdisasters,securityfailuresandlossofserviceshouldbeanalysed.Contingencyplansshouldbedevelopedandimplementedtoensurethatbusinessprocessescanberestoredwithintherequiredtime-scales.Suchplansshouldbemaintainedandpractisedtobecomeanintegralpartofallothermanagementprocesses.Businesscontinuitymanagementshouldincludecontrolstoidentifyandreducerisks,limittheconsequencesofdamagingincidents,andensurethetimelyresumptionofessentialoperations.ModelApproachFig1:BCIModelforBusinessContinuityManagementBusinessContinuityManagementcanbeacomplexprocess.ThishasbeenrecognisedbytheBusinessContinuityInstutitutewhohaveestablisheda10-pointmodel(seeFig.1)fordevelopingeffectivebusinesscontinuitymanagementstrategies:1.ProjectInitiationandManagementToestablishtheneedforabusinesscontinuityplan(BCP),includingobtainingmanagementsupportandorganisingandmanagingtheprojecttocompletion,withinagreedtimeandbudgetlimits.2.RiskEvaluationandControlTodeterminetheeventsandenvironmentalsurroundingsthatcanadverselyaffecttheorganisationanditsfacilitieswithdisruptionaswellasdisaster,thedamagesucheventscancause,andthecontrolsneededtopreventorminimisetheeffectsofpotentialloss.Providecost-benefitanalysistojustifyinvestmentincontrolstomitigaterisk.3.BusinessImpactAnalysisToidentifytheimpactsresultingfromdisruptionsanddisasterscenariosthatcaneffecttheorganisationandtechniquesthatcanbeusedtoquantifyandqualifysuchimpacts.Establishcriticalfunctions,theirrecoverypriorities,andinter-dependenciessothatrecoverytimeobjectivescanbeset.4.DevelopingBusinessContinuityStrategiesTodetermineandguidetheselectionofalternativebusinessrecoveryoperatingstrategiesforrecoveryofbusinessfunctionsandITwithintherecoverytimeobjectives,whilemaintainingtheorganisation'scriticalfunctions.5.EmergencyResponseandOperationsDevelopandimplementproceduresforrespondingtoandstabilisingthesituationfollowinganincidentorevent,includingestablishingandmanaginganEmergencyOperationsCentre,tobeusedasacommandcentreduringtheemergency.6.DevelopingandImplementingBusinessContinuityPlansTodesign,developandimplementtheBCPthatprovidesrecoverywithintherecoverytimeobjective.7.AwarenessandTrainingProgrammesToprepareaprogrammetocreatecorporateawarenessandenhancetheskillsrequiredtodevelop,implement,maintainandexecutetheBCP.8.MaintainingandExercisingBusinessContinuityPlansTopre-planandco-ordinateplanexercises,andevaluateanddocumentplanexerciseresults.Developprocessestomaintainthecurrencyofcontinuitycapabilitiesandtheplandocumentinaccordancewiththeorganisation'sstrategicdirection.Verifythattheplanwillproveeffectivebycomparisonwithasuitablestandard,andreportresultsinaclearandconcisemanner.9.PublicRelationsandCrisisCo-ordinationTodevelop,co-ordinate,evaluateandexerciseplanstohandlethemediaduringcrisissituations.Todevelop,co-ordinate,evaluatea...
