Business Continuity and Disaster Recovery for InfoSec Managers

152 4.4 Key Documents and Procedures

continuing a satisfactory level of business operations. Consider carefully

here the cross-relationship between information and data and the availabil-

ity of the information system where such data or information may be held

or processed. Assess the adequacy of existing backup arrangements and

alternative methods for accessing such data or information.

4.2.14 Insurance Coverages and Claims Process

Insurance coverage is another consideration the BCP should account for. In

cases of disaster, knowing the name of the insurance agent, how to contact

that person, and when to contact the insurance agency are all very impor-

tant. The BCP should have guidelines established for such purposes and,

often, it is helpful to have a checklist of conditions to help emergency

response teams decide if and when they should contact the insurance agency.

4.3 Key BCP Personnel and Supplies

Employees are an organization’s most important and valuable asset. In any

emergency, in addition to its systems recoveries, the organization will rely

on its employees to recover normal business operations in the least amount

of time possible. Likewise, the organization will also rely on its main suppli-

ers of critical goods and services to continue to support recovery of business

operations. The plan you establish as a part of your organization’s BCP will

rely on key members of management and staff to provide the technical and

management skills needed to achieve a smooth business recovery process.

These key members of management and staff are responsible for the imple-

mentation of the BCP in the event of an emergency. A well-organized and

structured approach will avoid the unexpected crisis deteriorating into

chaos. To facilitate these efforts, the plan should include a functional orga-

nization chart. The BCP project coordinator and deputy for each func-

tional area should be listed. A table of key personnel and emergency contact

information is vital. Listing the key suppliers and vendors and their emer-

gency contact information will speed up the resupply process. There should

be a manpower recovery strategy to reestablish processes after a disaster. The

plan should establish who is on the disaster recovery team and, likewise, it

should establish who is part of the business recovery team.

4.4 Key Documents and Procedures

In every business or organization, there are certain documents and records

vital to the business operation. These types of documents should be identi-