IT Solution
What is a business continuity planning?
Business continuity plan (BCP) is the process of planning for unexpected events. An efficient BCP includes procedures designed to mitigate unexpected events that can interrupt the business processes; the plan is olso needed in order to allow a rapid recovery of the business, and minimize the effects of down-time on daily activities.
The importance of developing and implementing a business continuity strategy for an IT department
Business continuity plan is a process designed to come as a solution to deterioration / damage / malfunction of a critical business infrastructure. It is a management concept, not just something within the IT department. If a critical node of IT infrastructure is broken, there will be a significant impact on the entire business. Therefore, it is very important for any company to be prepared and have a BCP in place for its IT infrastructure. A business continuity plan has to cover all the services and infrastructure necessary for business operation, as well as provide all applications and resources to support the business recovery in case of damage, downtime or disaster.
Who has implemented BCP?
Business continuity plan format and update
The structure of a business continuity plan must be clear, brief and easy to understand, not only for those directly involved in the business continuity management process; the rest of the staff must be briefd in order to be prepared to react fairly and support a possible process of fast recovery. In order to develop a business continuity plan, the company needs to understand that implementation is an ongoing process and a long term commitment. Business processes evolve constantly, which is why recovery strategies must evolve with the business. The plan has to be updated, withthe technological advances of IT infrastructure, and the evolution of human resources within the organization.
What should the business continuity plan include?
The first steps in developing a business continuity plan are:
- assessments of risk factors;
- potential threats to business continuity;
- determining whether they can occur;
- their frequency and severity factor.
For each risk within the business continuity plan, there must be a way to reduce the probability of its materialization. For situations when the threat is materialized, there are procedures to restrict the impact on internal business processes, as well as procedures of return and recovery.
What are the risk factors for business continuity?
The threats for an IT infrastructure, are divided into several categories:
- Environmental and geopolitical, disaster threats: floods, fire, hurricanes, explosions, earthquakes, military conflicts, terrorism.
- Infrastructure threats: total and temporary interruptions of electricity, telecommunications, internet
- Physical threats: server’s misuse of access (incorrect or not allowed) or defects, active network equipment, storage equipment, computers.
- Technical threats: single point of failure, a-single non-redundant hard-disk, a-single non-redundant energy source, storing information in one place.
- Threats to security, integrity and accessibility of information: the access to information from outside the company must be protected against hackers, viruses; the accessibility of critical applications from inside the company which is essential for the functionality of an activity.
- Human error threats: too permissive access rights to the company’s information resources and lack of user security, can generate serious human errors, most often unintentional, and can draw huge losses on a company.
Some of the actions that can be taken to prevent the materialization of risk factors for an IT infrastructure, are:
- An internal backup strategy and an external (off-site) storage.
- Developing an informational infrastructure with redundancy in case of key components failure, for instance: – Having a mirror (mirror – a server with the same capabilities) for the central server in another location.
- Eliminating single points of failure; for instance: – One power, one ISP.
- Developing and implementing a security system to protect the company’s information against external (hackers, viruses) and internal (employees, industrial and commercial espionage, etc.) attacks.
The business continuity plan must include prevention and recovery methods for situations when risk factors are materialized, such as a Disaster Recovery Plan.
