Our most recent blog post dealt with The three golden rules of business continuity planning. This time, we continue in the world of business continuity planning and take a closer look at scenarios and strategies.
Let's start with establishing the terminology:
A business continuity scenario is a defined situation to which we may be exposed and which the continuity plan addresses.
A business continuity strategy is the manner in which we choose to handle a given scenario in the business continuity plan.
Many of us find it difficult to fully grasp these concepts, as we often associate the word "strategy" with a more general document describing the company's visions and future plans. In this case, however, it’s about strategies for dealing with fires, system crashes, virus attacks etc. So... the word strategy is correct, but only in the context of a specific scenario.
Where do I begin?
How do we choose the scenarios to be addressed by our business continuity plans?
The secret is not making the scenarios too specific, but at the same time making them specific enough to make them useful. If we believe we are able to come up with a complete list of detailed scenarios we may find ourselves experiencing a scenario that we had not anticipated.
So instead of a list of scenarios that looks like this:
Fire at the data centre
Rainstorm affecting the data centre
Lengthy power outage at the data centre
Data centre vandalism
- we have one scenario called: Data centre out of service.
We need to be able to handle a situation in which we cannot use our data centre - regardless of the reason. When doing this, we avoid a great deal of unnecessary text in our business continuity plan (see The three golden rules of business continuity planning) and we indicate that our business continuity plan is able to handle several different situations.
In order to establish which scenarios are to be covered by our continuity plan, a workshop can be held involving selected employees from the organisation.
As mentioned above, one scenario could be: Data centre out of service. Other examples of scenarios may include:
- Critical systems out of service
- Critical virtual server out of service
- SQL server out of service
- Extensive virus outbreak
- Hacker attack
- Key supplier goes out of business
- Leak of information
As you can see, these scenarios differ in level of detail and the task is now to find the correct level.
StrategiesOnce we have established what scenarios our business continuity plan should cover, it is time to figure out what to do when the scenarios occur. In other words - defining the continuity strategies.
We need to describe our strategies before these scenarios occur. Otherwise we will have to come up with solutions on the fly. Be careful not to rely on "action team" based business continuity. In a crisis situation there is simply too much stress involved for us to be expected to come up with - and carry out - the right solution.
A good approach to describing the strategies is defining the steps to be taken in order to address the given situations. One way of doing this is by holding a workshop like the one mentioned above.
Furthermore, it is important to think through the entire situation:
- Should a consultant/supplier be involved?
- Can we define a subset of data in advance that is especially critical and that must be recovered first?
- Remember communication!
- Remember testing!
- What are the prerequisites for this strategy?
- In what order must the systems be started?
Neither should a continuity strategy be too detailed. We need to describe the various activities and the order in which they are to be performed, but we should not describe it right down to the level of every single nut and bolt.
If it is necessary to provide a precise description, for example, of how to restart an application, then this should be found in the disaster recovery procedures or the system documentation.
Once scenarios and strategies are in place, the backbone of our business continuity plan is established. We are now well on our way to writing a sound business continuity plan.
Please share your experience in creating effective, pragmatic and operational business continuity plans in the comments below.
About the Author: Jacob Holm Hansen is a Senior Security Advisor at Neupart and advises companies on ISO 27001, IT risk assessments and business continuity planning.
With Neupart's SecureAware BCP TNG you can improve your business continuity planning and make sure that your plans are always up to date. Read more here
Find our other webinars and classes here: http://www.neupart.com/events