Business Continuity Basics:

 

• What is business continuity management (BCM)?
• BCM seems to include many different terms, some of which appear to be very similar. How are they similar or different?
• Is there a best practice approach to business continuity planning (BCP)?
• What BCM elements are included in ITIL – specifically, IT service continuity management?
• What is the relationship between business continuity and enterprise risk management (ERM)?

 

 

Overview of the Regulations and Standards Landscape

 

• How should regulations and standards shape the development of a BCM program?
• What are ISO 22031 and ISO 22313?
• What BCM standards exist in COBIT standard?
• Are these the only BCM mandates an organization should consider?

 

 

Executive Management Support and Sponsorship

 

• Who is the right person in the organization to own the BCM process?
• How can executive management be “sold” on business continuity?
• What is the value to an organization in designing and deploying BCM programs?
• What are the critical elements of a business continuity policy?
• How should an internal business continuity function/planning team be structured?

 

 

Risk Assessment and Business Impact Analysis (BIA)

 

• What are the most common approaches to executing a risk assessment?
• What are the most common approaches to executing a BIA?
• Should key vendors be included in BIA?
• What is a recovery time objective (RTO)?
• What is a recovery point objective (RPO)?
• Are questionnaires necessary when planning for business continuity?
• Are there ways around completing a formal BIA and risk assessment?

Business Continuity Strategy Design

 

• What are the key considerations when developing recovery strategies?
• How far apart should primary and alternate sites be?
• What are the key considerations for pursing an internal versus a third-party recovery solution?
• What is a “mobile recovery center”?
• What is an emergency operations center (EOC)?
• What are the differences among cold, warm and hot sites?
• What are key recovery considerations when negotiating a contract for a hosted solution or disaster recovery support (e.g., hot site contract)?
• How is advancement in technology changing disaster recovery planning considerations?

 

 

Plan Development and Strategy Implementation

 

• Is software necessary to develop a BCP?
• What is the difference between crisis management and crisis communications?
• What is a call tree?
• Is there a way to make the plan more efficient and effective?

 

 

Developing appropriate responses

 

• Matching the response to the risk.
• Taking preventive action.
• Ensuring appropriate contingencies are in place.

 

 

Responding to Incidents

 

• Creating the incident response plan.
• Capturing the planning output.
• Creating incident response team charters.
• Defining roles and responsibilities.
• Responding to incident scenarios.
• Information directories and equipment inventories.

 

 

Directing the incident response team

 

• Setting up the command center.
• Planning and conducting communications.
• Connecting with emergency services.
• Team actions following an incident.

Designing Contingency Arrangements

 

• Establishing a standby site.
• Site choices: configuration and acquisition.
• Choosing suppliers: in-house vs. third-party.
• Specifying equipment.

 

 

Selecting backup and restore strategies

 

• Matching strategy to operational constraints.
• Meeting the organization's storage requirements for vital records.

 

 

Restoring communications and recovering users

 

• Determining vital users with the BIA.
• Rerouting voice, mail, goods delivery.
• Eliminating single points of failure.
• Connecting end users.
• Meeting varied user-recovery needs.

 

 

Training and Awareness

 

• Are training and awareness the same?
• What are some successful business continuity training approaches?
• What are the available certification options?
• What are the available BCM education options?

Testing Maintenance

 

• What are the prevailing practices regarding the storage of BCP documentation?
• How often should business continuity-related documentation be updated and how should the organization keep the plans current?
• Testing plans with a step-by-step process.
• Developing test scenarios and using test results effectively.
• Considering the impact of testing on the organization.
• How often should the BCP be tested?
• What are the available testing options?
• Should the organization expand testing beyond IT?

 

 

Compliance Monitoring and Auditing

 

• How do organizations mature their business continuity programs?
• How often should the business continuity program be audited?
• What is the optimal role for internal audit in the BCM process?
• How does an organization review key vendor planning for business continuity compliance with industry best practices?

 

 

Maintaining and improving the BCMS

 

• Applying change control: why and how.
• Ensuring normal developments are accounted for.
• Leveraging test results to improve organizational practices.
• Managing organizational change.