Information Security Journal: A Global Perspective

ISSN: 1939-3555 (Print) 1939-3547 (Online) Journal homepage: https://www.tandfonline.com/loi/uiss20

Business Continuity Management: A Standards-

Based Approach

Rama Lingeswara Tammineedi

To cite this article: Rama Lingeswara Tammineedi (2010) Business Continuity Management: A
Standards-Based Approach, Information Security Journal: A Global Perspective, 19:1, 36-50, DOI:
10.1080/19393550903551843

To link to this article: https://doi.org/10.1080/19393550903551843

View supplementary material

Published online: 19 Mar 2010.

Submit your article to this journal

Article views: 1547

View related articles

Citing articles: 16 View citing articles

Full Terms & Conditions of access and use can be found at

https://www.tandfonline.com/action/journalInformation?journalCode=uiss20
Information Security Journal: A Global Perspective, 19:36–50, 2010
Copyright © Taylor & Francis Group, LLC
ISSN: 1939-3555 print / 1939-3547 online
DOI: 10.1080/19393550903551843

Business Continuity Management:

1939-3547 Security Journal: A Global Perspective
1939-3555
UISS
Information Perspective, Vol. 19, No. 1, Feb 2009: pp. 0–0

A Standards-Based Approach
Rama Lingeswara
Business
R. L. Tammineedi
Continuity Management

Tammineedi ABSTRACT Business enterprises are increasingly realizing the importance of

TCS Limited, Hyderabad, India business continuity management (BCM). Availability BS 25999 Standard has
facilitated a consistent methodology that organizations can follow in design-
ing their BCM System. This paper intends to provide a conceptual under-
standing of BCM right from BCM Policy to BCM maturity by describing the
steps involved in the implementation of BCM Standard – BS 25999 – to
ensure business continuity in the event of an outage. The key BCM tasks have
been categorized into three phases of business continuity – Pre-event Prepara-
tion, Event Management, and Post-event Continuity. This paper also high-
lights some of the challenges experienced by the author in carrying out Risk
Assessment and Business Impact Analysis. The Business Continuity Maturity
Model® of Virtual Corporation is provided (with their permission) as a tool to
strengthen business continuity maturity or organizations.

KEYWORDS contingency, crisis, disaster, event, incident, outage, Business Continuity

Management, BCMS, BS 25999, BCM maturity, Business Continuity Maturity Model, BCM
Policy, Business Impact Analysis, BIA, Business Process Risk Assessment, BPRA, Crisis
Management Team, CMT, Emergency Management Team, EMT, Failure Modes and Effects
Analysis, FMEA, Risk Priority Number, RPN, Risk Assessment

INTRODUCTION
Business enterprises increasingly realize the importance of business
continuity management (BCM). The objective of BCM is to ensure the
uninterrupted availability of all key business resources required to support
critical business activities in the event of business disruption and to
expedite a return to “business as usual.” BCM adopts a holistic view and
focuses on the concept of continuity of all key processes, whether manual
or information technology enabled. According to the BCM Survey con-
ducted in 2009 by the Chartered Management Institute, UK, in conjunc-
tion with the Civil Contingencies Secretariat in the Cabinet Office, the
following are the five important drivers pushing the BCM initiatives in
Address correspondence to Rama organizations:
Lingeswara Tammineedi, Information
Risk Management Advisory, TCS
Limited, 16-2-752/21/13, Triveni Nagar, • Corporate governance
Gaddi Annaram, Dilsukhnagar,
• Central government
Hyderabad–500060, India.
E-mail: [email protected] • Existing and potential customers

36
• Legislation • Disaster: Disaster is an unplanned event usually
• Regulators causing denial of access to premises and resulting in
human casualties and great damage to property. Typ-
In the absence of an acceptable BCM standard, dif- ical examples are flood and fire. A catastrophic failure
ferent organizations used to follow different BCM of information technology services can also repre-
approaches to ensure their business continuity. This sent a disaster. In the words of Brian V. Cummings,
has often resulted in unreliable and ineffective busi- an expert in the area of business continuity plan-
ness continuity plans. The recent publication of BCM ning, “emergency is event relevant while disaster is
Standard – BS 25999 – by the British Standards Insti- event agnostic.”
tute greatly helps organizations adopt a holistic BCM • Crisis: Crisis is an occurrence which threatens the
approach. BCM must be fully integrated into the orga- integrity, reputation, or survival of an individual or
nization as an embedded management process. organization. Typical examples are product recall or
This paper intends to provide a conceptual under- secret tapes (e.g., Watergate).
standing of BCM, from BCM policy to BCM matu- • Outage: Outage is an event which causes a signifi-
rity, by describing the steps involved in the cant disruption to, or loss of, key business processes.
implementation of BCM Standard – BS 25999 – to The concept of an outage has both time dimension
ensure business continuity in the event of an outage. and business process dimension. An outage is differ-
ent from other business interruptions such as the
one arising from a service or technology failure (e.g.,
systems downtime, communications link failure)
KEY TERMS
which needs to be restored with the help of a service
A clear conceptual understanding of the following provider.
key terms will be useful for people involved in busi-
ness continuity management.
THE BCM STANDARD
• Event: An event is a planned occasion with The British Standard 25999 establishes the process,
unplanned consequences. Typical examples are principles and terminology of business continuity
meetings of the World Trade Organization (WTO), management. The purpose of this Standard is to
the World Bank, International Monetary Fund provide a basis for understanding, developing, and
(IMF), SAARC, and Olympic Games. implementing business continuity within an organiza-
• Incident: Incident is an occurrence (event) resulting tion and to provide confidence in the organization’s
in loss. Typical examples are violent protests, kid- dealings with customers and other organizations.
nap, and hostage. BS 25999-2:2007 defines incident BS 25999 is written in two parts:
as “situation that might be, or could lead to, a busi- Part 1, the Code of Practice, outlines the standard’s
ness disruption, loss, emergency or crisis.” overall objectives, guidance, and recommendations. It
• Contingency: Contingency is a specific system’s is this part that replaced PAS56.
failure or disruption of operations. Typical examples Part 2, the Specifications, details the requirements
are ATM system failure or on-line banking system for a BCM System (BCMS) and will be auditable,
failure. These are typically short-term failures gov- enabling organizations to demonstrate compliance to
erned by problem and event management proce- the standard. It is this part against which third party
dures. certification will be available.
• Emergency: Emergency is an incident requiring an BS 25999-1 is organized into the following
immediate and significant response. An office fire sections:
or bomb threat is a typical example of an emer-
gency. In some cases, a planned local event may • Scope and applicability
require advance preparation and elevated vigilance • Terms and definitions
to avoid an incident. For example, a major sporting • Overview of business continuity management
or championship event is typically followed by fan (BCM)
violence. • The business continuity management policy

37 Business Continuity Management

 • BCM Program management culture by providing the framework for supporting the
• Understanding the organization need and requirement for cultural change. The BCM
• Determining business continuity strategy policy and the strategy to implement it must be
• Developing and implementing a BCM response approved by executive management. The policy
• Exercising, maintaining, and reviewing BCM should be subjected to annual review along with other
arrangements BCM documentation.
• Embedding BCM in the organization’s culture

BS 25999-2 is organized into the following sections: BCM ORGANIZATION

BCM should be business owned and business
• Scope driven. A dedicated business continuity management
• Normative references team is required to facilitate the continuation of busi-
• Definitions/terms ness operations efficiently in the event of business dis-
• Planning a BCMS ruption. The team should consist of people who
• Implementing and operating the BCMS understand the organization — its business, technology,
• Monitoring and reviewing the BCMS processes, and business risks. The team collectively
• Maintaining and improving the BCMS provides the expertise within the organization. Critical
business functions should collaborate with their IT
The balance of the paper describes the steps involved
application support teams to prepare a comprehensive
in the implementation of the BCM Standard.
and cohesive business continuity plan. The business
continuity management team should be hierarchical
in nature. It should be composed of people with
BCM POLICY relevant experience and skills. Figure 1 describes a typ-
The stage for implementation of BCM Standard ical BCM organization for small and medium-size
can be set by defining an organizational BCM policy. enterprises.
The objective of a BCM policy is to provide a frame- The roles and responsibilities of the constituents of
work for establishing and maintaining the business the BCM organization are as follows.
continuity capability of an organization. A BCM pol-
icy is a high level statement of management intent
that describes the scope, objectives, and governance of Crisis Management Team (CMT)
BCM in the organization, roles and responsibilities, The protection of personnel and assets and contin-
and the activities that are required to achieve the uation of critical functions of the organization are the
objectives. responsibility of senior management. Their support
The following is a sample BCM policy: and involvement are essential and critical for the suc-
The BCM program of <Company Name> covering the cess of the business continuity management. Senior
entire organization shall be handled by a dedicated BCM team management will act as the crisis management team
which will develop, implement and maintain appropriate BC (CMT), also known as the emergency management
Plan, procedures and arrangements to protect the organiza-
team (EMT). The role of a CMT in any disaster sce-
tion’s people, processes, information and supporting technol-
ogy duly adhering to the applicable standards and regulations. nario is to provide leadership in deciding and imple-
All business and technology entities, including their critical menting the business continuity plans, to ensure
third-party vendors are required to support the BCM program damage control/containment due to the disaster
and develop and fund relevant business continuity plans and
capabilities.
event, and to facilitate continuity for critical opera-
tions. Further, it has to coordinate effective recovery
The BCM policy should be appropriate to the so that the “normal” state of business can be restored
nature, scale, complexity, geography, and criticality of at the earliest.
the business and must reflect the organizational cul- The idea of a CMT transcends the BCM organiza-
ture, mission, vision, and operating environment. The tion and addresses business crises beyond business
BCM policy embeds BCM into the organizational continuity. Business continuity leverages the CMT for

R. L. Tammineedi 38
 FIGURE 1 Typical BCM organization structure.

executive leadership and facilitation. As an example of An organizations should designate a suitably qualified
a non-BCM crisis, consider a major security breach at senior employee as its BC manager and another senior
a banking/financial company that compromises a person as backup BC manager.
large number of customer records. The business is still
operating but faces a major crisis in terms of technol-
ogy, public relations, legal, and financial impact. Media/PR Manager
CMT comprises the heads of departments of business, Public relations function is critical during a disaster
marketing, and support functions (e.g., service deliv- event. The media can make or break even the best
ery, marketing, IT, risk and compliance, HR, adminis- efforts by an organization. Only a person with media/
tration/security, finance). journalistic experience should be allowed to act as an
official spokesperson. All other employees should be
instructed not to speak to the media or any other peo-
Business Continuity Manager ple in the case of a disaster event. However, employees
with technical expertise can assist the official spokes-
The primary responsibility of the business continu- person in dealing with the media. Media responsibili-
ity (BC) manager is to oversee the development and ties include the release of announcements to
test of viable business continuity plans. The other employees on the status of the recovery effort and the
major responsibilities of a BC manager include: expectations of the enterprise in regard to employee
status reporting and assistance.
• Ensure that the recovery team members are trained
adequately to handle their responsibilities in a disas-
ter scenario.
Damage Assessment and
• Obtain and maintain contact lists of key employees, Salvage Team
BCM organization, vendors, partners, and public The damage assessment and salvage team is respon-
authorities. sible for determining the state of the original site, or
• Maintain copies of all appropriate vendor agree- trying to salvage any equipment or data that might be
ments. Liaison with hardware vendors as per agree- salvageable, and mitigating damage at the primary site.
ments in force. This depends on prompt realization of what is salvage-
• Coordinate DR activities in the event of a disaster able and what is not. Repair and replacement orders
and ensure high level adherence to the DR proce- will be filled for what is not in operational condition.
dures documented in the BC plan. The duties of this team include:
39 Business Continuity Management
• assisting in the immediate damage assessment/sal- • Travel arrangement for the personnel/food and
vage operation accommodation facility for relocated personnel
• preparing inventory of damaged and undamaged • Telephone forwarding /mail and delivery service
items rerouting
• salvaging equipment and supplies
• helping in settling property/insurance claims Ideally, teams would be staffed with the personnel
responsible for the same or similar operations under
This team is the first to arrive at the primary (disaster) normal conditions.
site. Team members provide preliminary damage
assessment information to the BC manager and CMT
to enable them to make a decision regarding invoca- APPROACH AND METHODOLOGY
tion of the BC plan. This team then conducts a Guided by the BCM policy, the BCM organization
detailed damage assessment and salvage operation and strives to establish and maintain the business continu-
documents the findings. ity capability of an enterprise. The entire gamut of
BCM activities can be discussed in terms of three
phases. Figure 2 describes the three phases of business
IT Recovery Team continuity and the important activities of each phase.
The IT recovery team plays a major role in restoring The important activities of the above three phases
the network and IT services and possibly telephony. are as follows.
All technical and logistical activities associated with
the restoration of needed network and IT service are Pre-event Preparation
carried out by this team. This team ensures the avail-
ability and functionality of critical software and other The following are the pre-event preparation activities.
utilities in the restored system environment. At a min-
imum, IT has a fiduciary responsibility to restore all IT Site Risk Assessment
services as soon as possible to a state of business as Site risk assessment focuses on risks to the physical
usual. Beyond that, IT has a responsibility to support locations (premises). Physical location is one of the
the incremental continuity requirements of critical critical resources that facilitate execution of business
business processes. critical activities. There is a fiduciary responsibility to
assess and mitigate site physical and environmental
risks. However, risk assessments should not be per-
Communications Recovery Team
formed across all business processes but only for those
This team is responsible for restoring the voice that have high criticality. As such, the BIA becomes a
communications services, including telephone, focusing lens to prioritize and invest in business pro-
mobile, fax, and so forth. This team also works closely cess risk assessment in addition to higher availability
with the IT recovery team to bring up data network business continuity strategies and solutions.
service at the DR site. The important areas that should be covered during
site risk assessment include:
Support Team • Building protection measures (e.g., perimeter, secu-
The support team is responsible for ensuring the rity guards, CCTV, intruder detection system, build-
availability of the support functions in a disaster sce- ing construction code, fire-rating of walls, running
nario. These functions include: water pipes, overhead water tank)
• Fire detection and suppression measures (e.g.,
• Building management and facility support at the smoke and fire detection systems, fire suppression
DR site and repair and restoration of primary site systems)
• Finance, funding, and procurement • Neighborhood (e.g., neighboring industries, military
• Human resources and personnel tracking areas, hotels, bus station, railway station, air port,

R. L. Tammineedi 40
 FIGURE 2 The three phases of business continuity.

likelihood, and nondetectability — that are given equal

weight. If RPN alone is used to denote risk acceptance
criteria, it may result in a scenario of making unneces-
sary investment for low severity risks. To avoid this,
another parameter called “criticality,” a product of
severity and likelihood, is suggested. Table 1 illustrates
three risk scenarios with same RPN number.
Risk #2 in Table 1 is more critical than the other
two risks. When risks are prioritized for treatment, this
risk should be given higher priority than the other
two risks that have equal RPN values. Therefore, the
effective way of establishing risk acceptance criteria is
to use both RPN and criticality.
FIGURE 3 Key elements in a risk assessment.
Carrying out building-wise risk assessment may not
be sustainable in the long run in some cases. For exam-
ple, some organizations may not have a single owner for
dams, lakes, reservoirs, public access, highways, a building (such as a data center), where each team
overhead high power transmission lines) takes care of its own systems; there will be common

Figure 3 describes the key elements in a risk assessment. TABLE 1 Illustration of three risk scenarios.
There are different methodologies to carry out risk
Risk # Severity x Likelihood x Nondetectability = RPN
assessment. When failure modes and effects analysis
(FMEA) methodology is used for doing risk assessment, a 1 1 5 5 = 25
parameter called risk priority number (RPN) is com- 2 5 5 1 = 25
3 5 1 5 = 25
puted. It is a product of three attributes of risk — severity,

41 Business Continuity Management

units/agencies providing facilities management (e.g., In order to gain proper perspective on the relative
physical security, cleaning, cooling, heating). In such importance of individual business functions and pro-
cases, adopting a service/product based approach for cesses, the BIA should be conducted assuming a “worst
risk assessment is more effective and sustainable. This case scenario” that affects most or all of the business
will be in line with BS 25999 requirement of evaluat- functions at a critical business location. An approach
ing threats to critical activities. Activities support the that focuses discretely on each business unit will likely
delivery of products/services within an organization. result in the identification of criticalities skewed to
Each team will carry out risk assessment for resources high-availability, and high-cost, to the detriment of
such as people, premises, information technology, sup- the program and the organization. BIA is consequence
plies, and stakeholders. A central team such as business independent. It refocuses on the effect rather than the
continuity management organization can coordinate event that caused the effect. The following are the
the risk assessments, consolidate and analyze the important activities in a BIA:
results, and facilitate selection, approval, and deploy-
ment of risk mitigation measures at organizational level.
• The BIA should be performed at each enterprise
locations.
Business Impact Analysis • Evaluate functional areas of the business or pro-
Business impact analysis (BIA) is the foundation of cesses to determine and measure potential implica-
business continuity planning. The four key objectives tions/impacts arising from their unavailability.
of BIA are as follows: • Identify the business processes performed by each
business unit, and rate the level of importance of
i. Determine the potential impact to the organiza- each business process based upon the impact of its
tion in the event of an outage. unavailability and its priority for recovery.
ii. Identify critical services/processes and their maxi- • Carry out a business process analysis to obtain a
mum tolerable period of disruption (MTPoD), detailed understanding of the workflow, interdepen-
recovery time objectives (RTOs), and recovery dencies, day-to-day processing requirements, and
point objectives (RPOs). dependencies on external entities so that appropri-
iii. Determine the sequence of recovering business ate recovery strategies could be developed. Another
functions and data in the event of an outage. key consideration is identification of the time sensi-
iv. Identify recovery strategies, minimum resources, tivity of the business processes/applications by con-
and vital records that are necessary for business ducting a business cycle analysis in order to gain an
continuity. understanding of the worst time for a disaster, best
time to make major business changes, and best time
The definition of MTPoD by BS 25999 is incomplete to test and update plans.
and open to a variety of interpretations. In June 2009, • Identify the MTPoD for services/products and
the BSI committee responsible for BS 25999 has determine the costs associated with downtime.
approved a “corrigendum” that clarifies the intended • Identify the MTPoD for critical processes and deter-
meaning of this term by revising the definition of mine the costs associated with downtime.
MTPoD as follows: • Define recovery time objectives (RTO) and recovery
point objectives (RPO) of all business processes. BS
Duration after which an organization’s viability will be irre-
vocably threatened because of the adverse impacts that would
25999-2:2007 defines RTO as “target time set for
arise as a result of not providing a product/service or perform- resumption of product, service or activity delivery
ing an activity. after an incident.” The RTO has to be less than the
MTPoD. Otherwise, data recovery would not occur
However, this definition does not seem to be rele- in sufficient time to support the RTO. An RPO
vant for utility companies such as power generation/ specifies the point in time to which a system’s data
distribution companies and organizations that control must be restored after an outage. In other words, an
all or most of the market for a product or service (e.g., RPO specifies in time (minutes, hours, days) how
monopoly, duopoly). much data loss can be tolerated. Generally, data loss

R. L. Tammineedi 42
 tolerance and recovery time decrease with the need delivery of the services/products. Part 2 of the BIA
for higher availability. That is, the higher the data has to be conducted in a more detailed way with
availability, the lower the RTO and RPO. operational management at the department level to
• Analyze the business continuity strategies of busi- identify department specific MTPoD values and
ness units, their strategy implementation, and RTOs. The department specific MTPoD values
requirements of each key business process. given by senior management should be treated as
• Identify the resource requirements for those busi- preliminary values and need to be validated by
ness processes that are to be conducted at a business operational management of the respective depart-
recovery/alternate site. ments. Any difference in MTPoD values of senior
• Identify the vital records/critical files needed for management and operational management need to
recovery by each business unit. be resolved by achieving consensus of opinion.
• Validate the BIA results and information with
respective process owners. The challenge relating to RPOs and data recovery
• Obtain management approval for BIA results. is that most organizations overlook important
aspects that can lead to recovery delays. Issues
The traditional approach of interviewing business include backup process, backups managed by differ-
managers of all functions is tedious and time consum- ent business units, availability of data backup, reli-
ing. A faster alternative would be to consult key ser- ability of backup media, data serialization, and
vice delivery heads and business process owners and application processing capacity limitations. Failure to
develop a process matrix to identify the criticality of address these can lead to critical failures in data
the services and processes and their corresponding recovery and meeting RTOs. To give an example, in
MTPoD values. These MTPoD values will be used to one of the organizations I worked for, the backup
derive RTOs of the business processes. administrator could not notice on one day the
The two challenges one may encounter in conduct- backup tool’s failure to back up critical data. When
ing BIA are as follows: the backup data was restored later (before the next
backup), the data of a few thousands subscribers
1. Each business function is approached as a discrete added during the period were lost.
entity rather than as part of an enterprise. Everyone
will overstate the importance of their work. Man-
agement of individual business functions will give Business Process Risk Assessment
an entirely different answer about their relative Business process risk assessment (BPRA) cannot
importance in the context of a broader disaster be economically performed across the enterprise.
impact. This kind of approach will ultimately skew Driving from the BIA, the BPRA is performed for
all BIA findings to higher availability and higher critical and important business functions identified
cost of strategies and solutions; and lead to a signif- during BIA. These business functions/processes that
icant and consistent failure of BIA efforts. BIA has support the products and services of an organization
to be approached in the context of a sitewide disas- are executed by or with the help of resources such as
ter that affects all business functions at the site. people, premises, technology, information, supplies,
2. BS 25999 expects senior management to be actively and stakeholders. While the site risk assessment
involved in BIA. In some organizations, senior focuses on risks to premises, the BPRA evaluates the
management may prefer to understand the ground risks to the other resources (e.g., people, technology,
realities before committing any values for MTPoD/ information, supplies, stakeholders) and their impact
RTO, as they are aware of the financial implications on the business functions/processes, identifying single
of their decisions. In such cases, it makes sense to points of failure (SPOF) that could lead to a disrup-
break BIA into two parts, Part 1 and Part 2. Part 1 of tion of service. After identifying risks, appropriate
the BIA has to be conducted with senior manage- countermeasures should be identified, evaluated,
ment to obtain MTPoD values for all services/ and implemented to lower the risks to acceptable
products and respective functions supporting the levels.

43 Business Continuity Management

Business Continuity Plan • risk profile of the facilities and business processes,
The business continuity plan (BCP) document is • adequacy of existing risk mitigating mechanisms,
intended to serve as the centralized repository for the • ability to meet the RTOs, and
business continuity information, roles and responsibil- • disaster recovery procedures.
ities, tasks, and procedures tht will facilitate timely
It is important to conduct testing in a way that exer-
response to a disaster interfering with the critical busi-
cises the defined business continuity plan. Avoid the ten-
ness processes. The collection of BC plans should be
dency to develop a separate and unique “testing” plan.
owned by the business continuity manager. Its copies
Exercises improve organizational disaster readiness by:
should be stored off site and at the residences of the
business continuity manager, emergency response • providing a way to evaluate operations and plans,
team, and business continuity teams. The contents of • clarifying roles and responsibilities,
a typical BCP are provided in Appendix A. • developing individual performance, and reinforcing
teamwork, and
Vendor Agreements • improving inter-departmental coordination.
It is essential to prepare and maintain a list of major
There are two types of exercises:
vendors of equipment and services that support the
organization. All the vendors in the list are considered
i. Discussion based: Discussion-based exercises
critical. The organization has to enter into arrange-
(e.g., tabletop exercise, workshop) are discussion
ments with its vendors based on RTOs and RPOs.
oriented and include simulations (e.g., games),
Appropriate service level agreements should be
which focus on analysis of “what-if” scenarios.
entered into with these vendors. Organizations can
ii. Operations based: Operations-based exercises
also incorporate in the SLAs their right to audit BCM
(e.g., drill, functional exercise, full-scale exercise)
readiness of vendors to address supply chain risks. For
are action-oriented requiring deployment of
example, a leading supplier of networking equipment
resources and personnel.
periodically conducts BCM audits to assess the disas-
ter preparedness of its suppliers.
Exercises should be conducted in a phased manner
starting with simple exercises and progressively adding
Awareness and Training complexity. Exercises should be conducted at least
once a year. The exercise results should be docu-
The content and the timing of BCM awareness and mented and communicated to executive management.
training requirements vary depending upon the roles
different categories of employees play. An indicative
list of roles is as follows: Review and Maintenance
BCM arrangements should be reviewed by executive
• Executive management and BCP steering committee management and internal or external auditors. The
• Crisis management team BCM review process should be defined and docu-
• Functional managers mented in the BC plan. The purpose of the review is to
• BCM implementation teams verify the organization’s BCM capability and to ensure
• Internal auditors its continuing suitability, adequacy, and effectiveness.
• General employees The BCM maintenance process should be defined
and documented in the BC plan. The purpose of the
BCM maintenance process is to ensure that the orga-
Testing and Exercising nization’s BCM competence and capability remains
Testing and exercising is a way to evaluate and con- effective, reliable, and up to date. The maintenance
firm the soundness of policies and procedures through process should cover training and skills of the BCM
in-depth discussions, training, and drills. Exercises are organization, risk management, and update of the BC
conducted with the objective of reviewing the plan with organizational changes.

R. L. Tammineedi 44
 Event Management the first phase, preliminary damage assessment is done
to determine what recovery options need to be acti-
When disaster strikes, the following activities are
vated and to facilitate the CMT decision with regard
carried out to manage the disaster event:
to invocation of the BC plan. In the second phase, the
damage assessment activity is a comprehensive evalua-
Emergency Response tion of damage to equipment, facilities, and records.
The main objectives of emergency response are The damage assessment activity is handled by the
twofold: damage assessment and salvage team. This team
should be multidisciplinary in nature and composed
i. to ensure safety of people and protection of assets of a mechanic, electrician, plumber, medical assistant,
and and infrastructure/information technology personnel.
ii. to monitor and coordinate emergency response
efforts.
Salvage Operations at Primary Site
Emergency response activities include notification The insurance companies with which the organiza-
and evacuation of building occupants, notifying pub- tion has policies must be notified of disaster and given
lic safety authorities (e.g., police, fire), medical treat- an opportunity to investigate the facilities before
ment, and damage mitigation. These emergency beginning salvage operations at primary site. The sal-
response activities are carried out with the help of a vage operations deal with salvaging hardware, facili-
Command Post and Emergency Operations Center ties, and documentation and require specialized skills.
(EOC). A command post is set up at the disaster site Different equipments require different salvage treat-
to provide overall direction and unify all emergency ments. Therefore, the salvage procedures should pro-
response efforts at the disaster site. EOC is set up (in vide general guidelines. The damage assessment and
case of major disasters) away from the disaster site to salvage team should have the contact information of
monitor and coordinate emergency response efforts and access to salvage experts. Proper documentation
at organizational level. EOC should be represented of salvage operations should be maintained to comply
by top management with the authority and experi- with insurance and legal requirements, if any.
ence necessary to facilitate flexible and innovative
decision making required in disaster scenarios. Emer- Operations from Secondary Site
gency response procedures/guidelines should be a
separate document that is maintained and readily While salvage operations at primary site are going
available on site in the case of an emergency. Business on, critical business operations should be resumed at
continuity plans, on the other hand, are maintained the secondary site by following the predefined disaster
off site. recovery procedures. The following are the different
types of alternate secondary sites:

Coordination with Public Authorities i. Cold site: Alternate site devoid of any resources,
After initiating emergency response, public safety but is equipped with air-conditioning, electrical
authorities (e.g., police, fire, Emergency Management wiring, uninterruptible power supply (UPS), and
Services) should be notified of the disaster. These communication facilities.
agencies take control of the command post once they ii. Warm site: Partially equipped alternate site.
arrive at the disaster scene. A senior employee should iii. Hot site: Alternate site with equipment and
be tasked with the responsibility of coordinating with resources to recover the critical business functions
the public authorities. in case of a disaster.

Alternate secondary sites are available as a sub-

Damage Assessment scribed service. An often overlooked continuity
Damage assessment involves assessment of extent requirement is the need to network the backup IT site
of damage. It is typically carried out in two phases. In to a backup business site. Assure that your business

45 Business Continuity Management

continuity plan assumes that all functions at a loca- disaster to stand down until further information is
tion are displaced. If corporate functions and IT oper- communicated by management via the media, or until
ate normally from the same location, then IT must designated recovery team members are activated.
network to the corporate recovery location. Reliance
on work area recovery locations may prove insuffi- Review
cient to meet the needs of the enterprise.
The business continuity plan should be reviewed peri-
odically to ensure it remains current, effective, reliable,
Public Relations and consistent with management expectations. Reviews
Public relations during disaster should be handled can be internal audits or management reviews. The
from the disaster site by trained/experienced official review should take place whenever there are changes in
spokesperson in accordance with a predefined plan. business, business strategy, contact lists, or IT environ-
The official spokesperson should perform appropri- ment. The sources of such changes include exercise
ately for the media to prevent any media crisis. results, strategic business meetings, takeover/merger, and
change management meetings. Since senior management
Insurance Cost Tracking has the insight into various organizational issues and can
correlate with operations and plans in the pipeline, it
Due care should be exercised by the damage assess-
should devote a few hours every quarter to review BCM
ment and salvage team to comply with the insurance
program and provide appropriate strategic direction.
companies’ requirements. The team should take pic-
tures of the disaster site and damaged equipment, facil-
ities, and documentation. The team should estimate Plan Update
the repair costs. The team should be aware of what the The business continuity plan should be updated as
insurance policy requires in the event of loss, and what a result of changes identified during the review. The
types of records and documentation are required by areas typically updated include contact lists, employee
the insurance company. Otherwise, the organization contact details in call trees/automated solutions, per-
will not be able to adequately support its insurance sonnel and assigned recovery tasks, backup, and recov-
claims, which can result in delayed or smaller settle- ery procedures. The typical triggers for BCP update are
ments. If an enterprise is insured by an independent either calendar or event based.
insurance carrier, care should be taken to prepare a
thorough accounting of losses and salvaged assets. Calendar Triggers
BCP should be reviewed and updated once a year or as
Postevent Continuity defined in the business continuity management policy.
The following are the activities that are carried out
after the disaster event. Event Triggers
BCP requires updating when certain events occur.
Restoration of Operations at Primary Site These events include but are not limited to:
After the disaster, and when the primary site stabi-
lizes, a return to normal notification (called stand • Organizational restructuring
down) should be issued to all employees. Restoration • Business plan changes
of operations at the primary site should start with the • Policy/standard changes
least critical business functions in order to avoid any • Legal/regulatory changes
impact on the critical business functions. The disaster • Equipment and system changes
should be treated as over only when all business func- • Location or facilities changes
tions are restored at the primary site. The stand down • Product changes
can be prepositioned with employees to relieve the • Procedure changes
requirement for specific notification. In this approach, • Vendor changes
employees are advised in advance of a catastrophic • Audit observations

R. L. Tammineedi 46
Insurance Settlement depending on their line of business, complexity of
The records and documentation that are generated processes, and regulatory requirements. Organizations
during the insurance cost tracking task of the event need to weigh the pros and cons of alternative recov-
management phase should be used to submit insur- ery strategies and the costs involved before selecting a
ance claims. The best time to do such a review is pre- recovery option for implementation.
ceding a peak business period.

BUSINESS CONTINUITY PLAN

DISASTER RECOVERY STRATEGIES CONTENTS
The recovery time objectives (RTO) of the business A business continuity plan should be designed
functions/processes identified during BIA should and developed based on an organization’s unique
guide the selection of alternative disaster recovery requirements. However, any BCP should address cer-
strategies for recovering the business processes and tain key elements, including:
information technology within the stipulated RTOs
and continuing the organization’s critical business • Scope, objectives, and limitations of the plan
functions. Disasters cannot be averted. However, orga- • BCM organization, roles, and responsibilities
nizations can adopt the following two-pronged busi- • Escalation, notification, and plan activation
ness continuity strategy approach to enhance their • Business functions and their MTPoDs, RTOs, and
resilience and ensure business continuity: RPOs
• Detailed recovery, resumption, and restoration
i. Treat the risks identified in risk assessment to
procedures
reduce the likelihood of a threat causing an inter-
• Vital records and off-site storage program
ruption and mitigate the severity of an interrup-
• Vendor contact lists
tion should the threat materialize.
• Review and update of the plan
ii. Develop response processes including emergency
response and incident management to enable
management to react swiftly to an event, protect- The above key elements should provide detailed infor-
ing people and resources. mation on who owns the BCM program; who exe-
cutes recovery actions; what is needed to recover,
Table 2 describes the various alternative disaster recov- resume, continue, or restore the business functions;
ery options. where are the alternate sites to resume the business
One or more of a combination of the above disaster functions;, and how are the business functions recov-
recovery options can be used by organizations ered, resumed, continued, and restored.

TABLE 2 Disaster recovery options.

Recovery options*

• Do nothing • Provide offsite storage

• Degrade services or defer actions • Telecommute or work from home
• Process manually • Structure reciprocal agreements
• Provide alternative source of products • Maintain buffer stock
• Build a fortress • Provide replacement only
• Provide continuous processing • Provide additional capacity
• Provide multiple processing site • Design and develop resilience
• Provide alternate site, which may be cold, warm, • Implement skill backup or cross training program
hot, mobile, mirrored or a combination of these
• Draw up quick re-supply contracts • Transfer risk via insurance arrangement or
contractual agreement

*Source: Developing Recovery Strategy for Your Business Continuity Plan by Dr. Goh Moh Heng. 2005 (with permission)

47 Business Continuity Management

 Call tree is a traditional emergency notification levels and corresponding characteristic corporate
mechanism and may not be effective when the BCM competencies.
call tree is large. Newer, more effective alternatives Legend:
include Web-based systems that can reach multi-
ple employees simultaneously by phone and • VL—Very low
SMS and that enable employees to log in and • L—Low
declare their status and availability to support BCP • M—Mediums
activities. • H—High
Appendix A provides an outline of a typical busi-
ness continuity plan. A brief description of the six Business Continuity
Management Maturity levels follows:
Level 1: Self-governed — BCM has not yet been
recognized as strategically important by senior manage-
BUSINESS CONTINUITY
ment. Individual business units manage business conti-
MANAGEMENT MATURITY nuity of their critical functions on an ad-hoc basis.
Implementing BS 25999 Standard enables organiza- Level 2: Supported Self-governed — At least one
tions achieve an effective BCM program. The thought business unit or corporate function has recognized the
here is that a company is expected to execute normal strategic importance of business continuity and has
operations without failure; it is how the enterprise begun efforts to increase executive and enterprise-wide
responds to the unusual event that achieves differenti- BCM awareness with the support of an internal/exter-
ation. However, organizations desirous of achieving a nal BCM professional. The state of preparedness may
competitive edge will be interested in objectively be moderate for participants but remains relatively
benchmarking their BCM program against other orga- low across the enterprise.
nizations in their industry. This can be achieved using Level 3: Centrally governed — Several business
a BCM measurement tool called the Business Conti- units constituting a majority of the enterprise have
nuity Maturity Model®. Figure 4 (used with permis- established a BCM program with tacit support from
sion from Virtual Corporation) describes six levels of the senior management. They have achieved a high
increasing business continuity competency maturity state of disaster preparedness. A business case for

FIGURE 4 Business Continuity Maturity Model®.

R. L. Tammineedi 48
enterprise-wide BCM program has been initiated for basics (covering senior management commitment,
senior management consideration. professional support, and governance) needed to
Level 4: Enterprise awakening — Senior manage- launch sustainable enterprise BCM program. Levels
ment understands the strategic importance of enter- four through six represent the evolutionary path of the
prise-wide BCM program and is committed to it. maturing enterprise BCM program. Organizations
BCM policy, practices, and processes are being stan- need to maintain momentum of the BCM program to
dardized across the enterprise. All critical business ensure that they do not fall back from higher maturity
functions have been identified, and continuity plans level to a lower maturity level.
for their protection have been developed, tested, and Embedding BCM in the organization’s culture is a
maintained. key requirement of BS 25999. This enables BCM to
Level 5: Planned growth — All business functions become part of the organization’s core values and
have been identified, and continuity plans for their instills confidence in all stakeholders in the ability of
protection have been developed, tested, and main- the organization to cope with disruptions. Achieving
tained. Senior management has actively participated higher BCM maturity levels will result in enhanced
in crisis management exercises. Regular communica- BCM culture.
tion and training programs exist to sustain a high level
of business continuity awareness. A multiyear plan has
been adopted to ensure organizational resilience and ACKNOWLEDGEMENTS
mature BCM program across the enterprise. The author wishes to thank Brian V. Cummings
Level 6: Synergistic — Sophisticated business and P V S Murthy for comments and feedback on ear-
protection strategies are formulated and tested success- lier draft of this paper.
fully by all business units. Cross-functional coordina-
tion has enabled the business units to develop and
successfully test upstream and downstream integration REFERENCES
of their business continuity plans. Scrupulous adher- Chartered Management Institute. UK’s 2009 business continuity
ence to company’s change control mechanisms and management survey. Available from: http://www.managers.org.uk/
download_1.aspx?id=10:2224&fid=10:2615&file=client_files/user_
continuous process improvements enable high state of
files/Woodman_31/Research files/BCM09 Final Report 09
disaster preparedness, even though the business envi- March.pdf
ronment continues to change radically and rapidly. Heng, G.-M. (2005). Developing recovery strategy for your business
continuity plan.
Levels one through three represent organizations Business Continuity Maturity Model of Virtual Corporation. (2003).
that have not yet completed the necessary program Available from: http://www.virtual-corp.net/

49 Business Continuity Management

 APPENDIX A: BUSINESS CONTINUITY PLAN OUTLINE
The following table describes the outline of a typical business continuity plan.

S. No. Name of Chapter Topics to Cover

01 Introduction • BCM policyScope

• Objectives
• Assumptions
• Limitations
• Organization of the document
• Distribution
• Review, ownership, and change/version control
02. BCM organization • Organization structure
• Roles and responsibilities
• Crisis management team
• BCM implementation teams
03. Notification and activation • Recognition and notification
• Escalation and emergency notification Mechanism (call tree/
automated solution)
• BCM implementation teams activation
• Assembly point
04. Disaster recovery procedures • Failure scenarios
• BCM implementation teams action plans
05. Plan maintenance and testing • Education and training
• Exercising the plan
• Reviewing the plan
• Internal audit
• Management review
• Maintaining the plan
06. Appendices • (Call tree/automated solution procedure)
• Contact lists
• Checklists
• Event log
• Media notification
• Templates
07. Acronyms and glossary • Acronyms
• Glossary

R. L. Tammineedi 50