Business Continuity Planning

The numbers speak for themselves. It is reported that nearly half of all small to medium sized business that lose their data will be out of business within two years. Another report states that over 25 percent of all business that experience as IT loss for more than 3 days go out of business almost immediately. With these statistics in mind, it is important for any business to have a comprehensive Business Continuity Plan (BCP) in place. The BCP is a way to ensure that key aspects of the business are managed and protected in such a way so the business can survive in the wake of a disaster. All plans need a policy and the BCP is no different.

The policy statement outlines the key elements of a successful BCP. These key elements are: Purpose, Scope, Roles and Responsibility, Resources, Training, Testing, Plan Maintenance and Other Considerations. The purpose statement may not seem important, but it is this statement that provides a brief overview of what the BCP is for and how it will work. Scope describes those that the plan encompasses either the organization as a whole, or certain divisions within the organization. Roles and Responsibilities describes the players that are involved with the BCP and the functions those individuals are to provide. The resource section is a statement that provides for allocation of funds to develop and support the plan. The training requirements section outlines how employees are to be trained for the implementation of the BCP. In the testing section it should be noted when tests should be conducted on the plan. The section will also describe the type of testing to be done, a white paper test or a walk trough. Plan maintenance is designed to ensure that the BCP is not just developed and forgotten. All plans need to be updated on a regular basis, and this section is in place to ensure the plan is review periodically. The elements of the BCP are in place, so it is now time to develop a plan. To start with, a business continuity team must be in place.

The business continuity team members should have representatives from every department within the business. Even thought the BCP focuses on business activities and not information technologies, the IT department will still be part of the team. The team should have a team leader, a response team and others depending on business needs. Other team members will consist of management, members of the human resources department, legal department, accounting department, technical specialists and information security personal. The members of the BC team may be split into smaller groups with specific areas of expertise all overseen by the business continuity management team.

In preparing a BCP, it is important to understand those business activities that are critical to the business. A business impact analysis should be conducted to establish the critical business activities, the resources to support critical activities and the impact of losing these activities. Once the key areas have been