The
HVR Business Continuity Planning process
provides our clients with a structured methodology
that starts with the identification of Critical
Business Functions, and their dependence on other
business functions and capabilities. Careful selection
of Critical Business Functions reduces the
cost of maintaining business operations through a
crisis period, and focuses attention on areas where
limited budgets can best be applied.
The
various stages can be described as follows:
•
Business Impact
Analysis
• Contingency
and Business Resumption Planning
• Implementation
Planning
• Testing and Training
Business
Impact Analysis
Business
continuity planning starts with evaluating the
business under the questions. What functions does
the business perform to deliver its product or service
and which of these functions are critical to the business?
Then for each of these critical business functions
we need to determine:
-
What is the minimum level of service at which further
degradation or loss of service is unacceptable?
- How
long can the business afford to wait to restore
the minimum level of service, and then return to
a normal, or full, level of service?
- What
other supporting functions, assets, services, infrastructure
elements and external dependencies are required
to deliver the minimum level of service?
These elements together comprise the business critical
vulnerabilities, and constitute the basis of the contingency
planning necessary to restore the minimum level of
service within the specified time.
Contingency
and Business Resumption Planning
Contingency
plans are developed for critical failures (both
internal and external) based on strategies developed
for protecting the business function from failure.
These contingency plans are designed to restore
a minimum level of service until the situation is
stabilised.
Business resumption planning is the plans made to
return to normal service operations once the overall
situation has been stabilised at the minimum level
of service.
A
Crisis Response Plan is also developed to define how
the client company or organisation will respond to
a crisis. Such a plan is required because a crisis
normally requires a response outside the bounds of
normal company organisation structures or processes.
Implementation
Planning
This
process details how the contingency plans are made
an integral part of business operations. This process
includes the integration of all the previous steps
into an overall Business Continuity Plan,
and helps to ensure the continuous commitment of the
organisation to business continuity.
Long
term commitment will be required from senior management
to the contingency planning process and for planning
of the periodic maintenance and exercise of the completed
business continuity plan.
Testing
and Training
A
test programme validates the Contingency, Business
Resumption and Crisis Response plans. Test schemas
need to be developed to exercise, in varying degrees
of complexity, all aspects of the business continuity
plans and actual performance assessed. Any lessons
learnt through the conduct of testing exercises need
to recorded and then incorporated through further
changes to the business continuity plans.
Testing
may be preceded by a training programme, where the
participants in the various plans are trained in the
processes for which they are responsible. Testing
then ensures that the training has been successful,
that the plans integrate smoothly, and that the plans
are adequate to ensure business continuity.
