course | IT Disaster Recovery

Business Continuity Basics:
 

• What is business continuity management (BCM)?
• BCM seems to include many different terms, some of which appear to be very similar. How are they similar or different?
• Is there a best practice approach to business continuity planning (BCP)?
• What BCM elements are included in ITIL – specifically, IT service continuity management?
• What is the relationship between business continuity and enterprise risk management (ERM)?
   

Overview of the Regulations and Standards Landscape
 

• How should regulations and standards shape the development of a BCM program?
• What are ISO 22031 and ISO 22313?
• What BCM standards exist in the COBIT standard?
• Are these the only BCM mandates an organization should consider?

Executive Management Support and Sponsorship
 

• Who is the right person in the organization to own the BCM process?
• How can executive management be “sold” on business continuity?
• What is the value to an organization in designing and deploying BCM programs?
• What are the critical elements of a business continuity policy?
• How should an internal business continuity function/planning team be structured?
   

Risk Assessment and Business Impact Analysis (BIA)
 

• What are the most common approaches to executing a risk assessment?
• What are the most common approaches to executing a BIA?
• Should key vendors be included in BIA?
• What is a recovery time objective (RTO)?
• What is a recovery point objective (RPO)?
• Are questionnaires necessary when planning for business continuity?
• Are there ways around completing a formal BIA and risk assessment?

Business Continuity Strategy Design
 

• What are the key considerations when developing recovery strategies?
• How far apart should primary and alternate sites be?
• What are the key considerations for pursuing an internal versus a third-party recovery solution?
• What is a “mobile recovery center”?
• What is an emergency operations center (EOC)?
• What are the differences among cold, warm, and hot sites?
• What are key recovery considerations when negotiating a contract for a hosted solution or disaster recovery support (e.g., hot site contract)?
• How is advancement in technology changing disaster recovery planning considerations?

 

Plan Development and Strategy Implementation
 

• Is software necessary to develop a BCP?
• What is the difference between crisis management and crisis communications?
• What is a call tree?
• Is there a way to make the plan more efficient and effective?

 

Developing appropriate responses
 

• Matching the response to the risk.
• Taking preventive action.
• Ensuring appropriate contingencies are in place.

Responding to Incidents
 

• Creating the incident response plan.
• Capturing the planning output.
• Creating incident response team charters.
• Defining roles and responsibilities.
• Responding to incident scenarios.
• Information directories and equipment inventories.

 

Directing the incident response team

 

• Setting up the command center.
• Planning and conducting communications.
• Connecting with emergency services.
• Team actions following an incident.

 

Designing Contingency Arrangements

 

• Establishing a standby site.
• Site choices: configuration and acquisition.
• Choosing suppliers: in-house vs. third-party.
• Specifying equipment.
   

Selecting backup and restore strategies

 

• Matching strategy to operational constraints.
• Meeting the organization's storage requirements for vital records.

Restoring communications and recovering users
 

• Determining vital users with the BIA.
• Rerouting voice, mail, and goods delivery.
• Eliminating single points of failure.
• Connecting end users.
• Meeting varied user-recovery needs.
   

Training and Awareness
 

• Are training and awareness the same?
• What are some successful business continuity training approaches?
• What are the available certification options?
• What are the available BCM education options?

 

Testing Maintenance
 

• What are the prevailing practices regarding the storage of BCP documentation?
• How often should business continuity-related documentation be updated, and how should the organization keep the plans current?
• Testing plans with a step-by-step process.
• Developing test scenarios and using test results effectively.
• Considering the impact of testing on the organization.
• How often should the BCP be tested?
• What are the available testing options?
• Should the organization expand testing beyond IT?
   

Compliance Monitoring and Auditing

 

• How do organizations mature their business continuity programs?
• How often should the business continuity program be audited?
• What is the optimal role for internal audit in the BCM process?
• How does an organization review key vendor planning for business continuity compliance with industry best practices?
   

Maintaining and improving the BCMS
 

• Applying change control: why and how.
• Ensuring normal developments are accounted for.
• Leveraging test results to improve organizational practices.
• Managing organizational change.