Business Continuity and Disaster Recovery for InfoSec Managers

171

6

Business Recovery Phase

Once personnel safety is no longer threatened, the fires are

out, and imminent danger has past, the organization must

begin the process of managing the business recovery phase.

A team should be established specific to business recovery

activities and mobilized as soon as danger has subsided. Part

of this team’s responsibility will be to assess the extent of

damage and determine the overall impact the disaster has

had on the business. Their mission will include creation of a

recovery plan. The team will implement the recovery plan

and make sure it stays on track. During these times, when

there is great uncertainty, it is also very important to keep

everyone informed about progress. As soon as possible, the

recovery team should begin handing business operations

back to regular management. After their task is completed,

the business recovery team should prepare a business recov-

ery phase report and submit it to the BC team leader.

6.1 Business Recovery Planning Process

We have said that BCP (business continuity planning) is the process of

identifying critical data systems and business functions, analyzing the risks

of disruption to the data systems and business functions, determining the

probability of a disruption occurring, and then developing business recov-

ery plans (BRPs) to enable those systems and functions to be resumed in

the event of a disruption. The goal of an effective BRP and process is to

facilitate and expedite the recovery of business after a disruption of critical

or impacting data systems and operations has occurred. Disruptions may be

minor, or may include instances where normal functions and services can-

not be performed and may not be performed for an extended period of

172 6.1 Business Recovery Planning Process

time. Business continuity planning minimizes the impact of disruption

while maximizing resources available to resume normal operations. The

principle objectives are to:

 Minimize disruptions of service to the business and any external

entity relying on business data systems and the information stored in

them.

 Provide a road map of predetermined actions that will reduce deci-

sion-making during recovery operations. Good planning will reduce

the number and magnitude of decisions that must be made during

the period when exposure to error is at a peak.

 Ensure the timely recovery of critical and impacting systems, and

enable the recovery of normal business/service at the earliest possible

time in the most cost-effective manner.

 Limit the impact of the disruption on the business mission and repu-

tation, and limit any financial losses.

6.1.1 Mobilizing a Business Recovery Team

Immediately following an emergency that seriously affects one or more of

the organization’s normal business processes, the business recovery team

(BRT) is to be notified. If there is need of a disaster recovery phase, then

initially the BRT is likely to be put on standby. If there is no disaster recov-

ery phase, or the disaster recovery phase is nearing completion, the BRT

will be asked to assemble at the Emergency Command Center set up to

control and manage both the emergency and the recovery process. This sec-

tion of the BCP contains a procedure for mobilizing the BRT and an

appropriate standard wording for notification. It may also contain the pro-

cess for alerting the members of the BRT, moving them from “standby sta-

tus” to “mobilization status.” It may be considered appropriate to include a

suitable three-stage alert status procedure:

Yellow: Place DRT on standby alert

Orange: Place DRT on alert

Red: Mobilize DRT