Dr. Gerry Firmansyah CID Business Continuity and Disaster Recovery Planning for IT (W-VIII)

Business Continuity/Disaster Recovery Plan Development Phases of business continuity and disaster recovery Defining BC/DR teams and key personnel Defining tasks and assigning resources Communications plans Event logs, change control, and appendices

Phases of business continuity and disaster recovery Phases of Business Continuity and Disaster Recovery Major Disaster or Disruption Intermediate Disaster or Disruption Minor Disaster or Disruption Activating BC/DR Teams Developing Triggers Transition Trigger—Activation to Recovery Recovery Phase Transition Trigger—Recovery to Continuity Business Continuity Phase Maintenance/Review Phase

Defining BC/DR teams and key personnel ❖ A good team description will identify the following attributes: ❖ Positions or job functions included on the team (Facilities Manager, HR Director, etc.) ❖ Team leader and contact information ❖ Team mission statement or set of objectives ❖ Scope of responsibilities (define what is and is not part of this team’s mission) ❖ Delineation of responsibilities in each phase of BC/DR (i.e., when will the team be activated and deactivated?) ❖ Escalation path and criteria ❖ Other data, as needed

Defining tasks and assigning resources Develop these tasks, keep in mind standard project management processes: 1. Identify high-level tasks, use verb/noun format when possible (i.e., “test security settings” rather than “security settings”). 2. Break large tasks into smaller tasks until the work unit is manageable. 3. Define duration or deadlines. 4. Identify milestones. 5. Assign task owners 6. Define task resources and other task requirements. 7. Identify technical and functional requirements for task, if any. 8. Define completion criteria for each task. 9. Identify internal and external dependencies.

Communications plans You should define the following: ❖ Name of communication team, members of team, team lead, or chain of command ❖ Responsibilities and deliverables for this team ❖ The boundaries of responsibilities (what they should and should not do) ❖ Timing and coordination of communication messages (dependencies, triggers) ❖ Escalation path ❖ Other information, as appropriate

Event logs, change control, and appendices Create a BC/DR event log for tracking various events and milestones. For example, your decision to activate your BC/DR plan may be based on two or three event types occurring, either simultaneously, in quick succession, or within a specified time period.