Business Continuity Planning and IT Risk Management Nazim Kasumzade Head of IT Department State Treasury Agency

WHAT IS IT? BCP (business continuity planning) – is a framework to prevent potential threats and ensure recovery in the event of a disaster.

WHY IS IT NEEDE? Serves as a formal set of rules in the event of a disaster Defines the notion of disaster (scope) Appoints disaster managers Identifies disaster management working groups and their chiefs, and reporting lines in the event of a disaster. Appoints those in charge of public relations Identifies resources and procedures required for disaster recovery Identifies key organizations which must be notified (suppliers and budget organizations) Documents procedures for testing and recovery to minimize the likelihood of misunderstanding and miscommunication during recovery Identifies alternative sources of delivery and suppliers Identifies key data storage, security, and recovery principles

HOW IS IT DONE? Assessing and classifying risks Measuring the business impact of each risk Designing a business continuity plan Testing - > Updating - > Testing - > …….. - > Finalizing Identifying emergency communication lines and an emergency contact list Holding regular training sessions

HOW MUCH WILL IT COST? The cost will depend on a variety of factors – not least on recovery point objective and recovery time objective. The cost will also depend on the level of technical support. The significance of the system (core business applications, non-core software, etc.) will define the level of technical support: 24/7 – response time < 30 minutes for hardware 24/7 – response time < 30 minutes for OS 24/7 – response time < 30 for applications The next banking day – for non-core applications and auxiliary hardware  

HOW CAN I BE SURE THAT IT WORKS? KPIs & KRIs may be used to understand how well the BCP system works KPIs are used for: Monitoring and analysis of the current business status Identifying required changes Detailing the list of necessary steps Measuring results Measurable: % of recovered capacity Recovery time % of capacity restored in the organization ……. Non- Measurable: Recovery quality Organization’s satisfaction with recovery time

WHERE DID IT ORIGINATE AND WHAT ARE THE GUIDELINES FOR DESIGINING A BCP? BCP originated in the IТ industry. The original standards were designed by the American National Standard Institute (ANSI), International Standards Organization (ISO), and the National Institute of Standards and Technology (NIST). Modern BCP basics: ISO 22301 – BCMS – Requirements ISO 22313 – BCMS – Guidelines ISO 22315 – BCMS – BIA Guidelines BCMS Template https://www.ready.gov/business Proprietary data center certification: https://uptimeinstitute.com/ Staff training: http://www.thebci.org/