Business Continuity Management and IT Disaster Recovery

By the end of the program, participants will be able to: 

1. Identify components and best practices of a successful BCM Program, specifically its policy, strategy and supporting tools
2. Explain a 10 Stage “Plan, Do, Check, Act” (PDCA) approach for establishing an operational Business Continuity Management System (BCMS)
3. List components of a Business Impact Analysis (BIA) that meet strategic, tactical and operational requirements of an organization
4. Explain Command, Coordination, Communications (3C) and Intelligence (3Ci) organizational requirements for managing a major incident within a Network Operations Centre (NOC)
5. Identify components of a successful IT Disaster Recovery (DR) Program, specifically carrying out a technology Business Impact Analysis (BIA) and identifying Maximum Tolerable Downtime (MTD), Recovery Time Objective (RTO) and Recovery Point Objective (RPO)
6. Apply best practice for building and managing resilient Data Centers (DC)

Business continuity, quality, audit and IT professionals including Business Continuity Manager (BCM), Business Continuity Coordinator (BCC), Crisis Manager (CM), IT Disaster Recovery (DR) Manager or anyone with the responsibility for, or involvement with Business Continuity Plans (BCP) and/or technology and auditing of Disaster Recovery Plans.

Business Continuity Management (BCM) and Organizational Resilience: 

• How Business Continuity provides value to an organization
• Definition and ingredients of organizational resilience

“10 Stage Framework”, and Compliance with Relevant ISO Standards: 

• Business Continuity Management System (BCMS) BCM Program, Policy, Strategy and Tools
• Implementing a BCM program, and its leadership
• The BC policy requirements
• The BC strategy – how and depth?
• Contingency and standby
• Understanding stakeholders
• Legislations, regulations and standards

Embedding Business Continuity: 

• Training needs analysis, skills and competency framework
• Criticality of a Competency Framework
• Developing a Competency Framework

Business Impact Analysis (BIA): 

• Types of BIA: strategic, tactical and operational
• Implementation methods for BIA and Risk Analysis (RA)

Developing, Implementing and Testing a Business Continuity Plan (BCP): 

• Ownership and plan structure
• Roles and responsibilities of BC Champion and Team Leaders
• Command, Coordination, Communications and Intelligence (C3i)
• Role of the command center and essentials
• Equipment and supporting information
• Producing Situation Reports (SITREPS)
• Types of testing/exercising

Maintenance of the BCMS: 

• What is the function of an Audit?
• BCM Steering Committee and Terms of Reference (ToRs)
• Overriding management review and continuous improvement

Understanding IT Disaster Recovery (DR) and Reviewing the Main Activities: 

• DR lifecycle, including resources and training
• IT DR as part of the Business Continuity Management System (BCMS) 
• Scope of IT elements and requirements
• DR Project outline, including Network Operations Centre (NOC) requirements, Emergency Response and Plan invocation
• Technology Business Impact Analysis
• Threat Modeling with a Risk Analysis and scenario planning

Building Technology Recovery Plans: 

• Roles and responsibilities of IT DR Team
• Data and information sources, and internal and external dependencies
• Best practice considerations using ITIL and ISO 20000, taking into account ISO 27031
• Managing and recovering end-user computing and communications technology and infrastructure
• Supporting infrastructure requirements for establishing a resilient Data Centre (DC) environment 
• Recovery options

Managing Recovery Plans: 

• Defining a DR test strategy
• Processes and procedures for supply chain management using a Third Party Questionnaire (3PQ) approach, aligned with BSI PAS 7000 
• On and off-site data and information storage, including emergency response arrangements
• Change management processes and procedures for day-to-day requirements as well as DR
• Incorporating DR into the organization lifecycle processes and establishing virtual teams
• DR documentation, and working with internal and external audit functions
• Risk control measures for critical MandE supporting equipment and systems

Major Incident Response: 

• Defining an “incident” and the escalation process
• Clarifying the role of the Network Operations Centre
• Establishing Command, Coordination and Communications
• Consideration of the supporting information, equipment and systems required
• Production of Situation Reports (SITREPS), activity logging and tools

• The Training lectures.
• The Group discussions.
• The Training Workshops.