BCP & Risk Management Banktech Asia V2

Importance of
Business Continuity &Risk Management
Jorge.sebastiao@its.ws

Agenda
Business Continuity Planning and Disaster Recovery Planning
British Standard on BC - BS25999
BCP
Risk Management
Process and Best Practices
Business Value

Views of BCP and Risk Management
Business View
Service and
Continuity
Customer Focus
Managing Risks
Operation Risk Controls
Auditing
Governance & Compliance
IT Infrastructure
Disaster Recovery
High Availability

Business Continuity Management
To counteract interruptions to business activities
To protect critical business processes from the effects of major failures or disasters
“2 out of 5 companiesthat experience a disasterwill go out of business
within 5 years”
- Gartner

The cost of ignoring it too high

Threats
Cyber terrorism
Viruses
Environmental
Threats
Unexpected
(“OOPS” factor)
Natural
Disasters
Industrial
Espionage

Business Risks
Financial
loss
Intellectual
capital
Public
Image/Trust
Litigation
Business
Risks
Legislative
violations
Employee &
customer
privacy

Examples - 1

Examples - 2

Threats to Availability
DATA CORRUPTION
APPLICATION FAILURE
COMPONENT FAILURE
HUMAN ERROR
MAINTENANCE
SITE OUTAGE

Can you afford it?
Charles Schwab & Co.
24 February 1999 through 21 April 1999: 4 outages of at least 4 hrs.Upgrades/Operator ErrorsCost: ???; Announced that it hadmade a $70 million new infrastructure investment.
eBay
12 June 1999 outage: 22 hrs.
Operating System failure
Cost: $3 million to $5 million revenue hit26% decline in stock price
Causes of Unplanned Application Downtime
Dev. Bank of Singapore
1 July 1999 to August 1999: Processing ErrorsIncorrect debiting of POS due to a system overloadCost: Embarrassment/loss of integrity; interest charges
AT&T
13 April 1998 outage: 6 to 26 hrs.
Software Upgrade
Cost: $40 million in rebatesForced to file SLAs with the FCC (frame relay)
OperatorErrors40%
ApplicationFailures40%
TechnologyFailures20%
Hershey Foods
September 1999 system failuresApplication RolloutCost: delayed shipments; 12% decrease in 3Q99 sales; 19% drop in net income from 3Q98
MCI
August 1999 frame relay outage: 10 daysSoftware UpgradeCost: Up to 20 days free service to 3,000 enterprises

Sources of Disaster
Survey of Disasters

Why should you care?
Avoiding complete loss of organization
Avoid
Revenue Loss
Damage to Reputation
Productivity
Performance and Governance
Complex Problem to Solve
Protect critical business processes
Protect critical supporting infrastructure
Protect company data and Intellectual Property
Meet Compliance regulations
Manage People in the Process

Impact of Disaster
Revenue:
Direct loss, compensatory payment, lost future revenues, billing losses and investment losses
exponential increase
Governance
Performance
damaged reputation
Productivity:
Number of employees x impacted x hours out x burdened hours = ?
productivity/ employees
direct financial/ customer
Damaged reputation:
Customers, competitors gain advantage, suppliers, financial markets, business partners
constant increase
Governance & performance:
Revenue recognition, cash flow, credit rating, stock price, regulatory fines
Indirect impact of downtime can befar more severe and unpredictable
$ billions
$ impact
$ millions
minutes
days
time
14

Importance of Critical Infrastructures

Can not be ignored by business anymore

To survive a disaster you need?
A Place to GO
Vital Data
A Plan to Follow
Well Trained People

Successful implementation requires
Technology
Process
People

Business Continuity Management overview
Business Continuity
Management
HUMAN RESOURCES
KNOWLEDGE MANAGEMENT
COMMUNICATIONS & PR
EMERGENCY MANAGEMENT
IT DISASTER RECOVERY
FACILITIES MANAGEMENT
PHYSICAL SECURITY
SUPPLY CHAIN MANAGEMENT
QUALITY MANAGEMENT
CRISIS MANAGEMENT
ENVIRONMENTAL MANAGEMENT
RISK MANAGEMENT
Source: BSI PAS56

Business Continuity Management
PROCESS
BCMOngoing Process
Change Management
Education
Testing
Review
Testing
Risk Reduction
Implement
Standby Facilities
Group Plans
and Procedures
BCM
Project
Create Planning Organization
Recovery Strategy
Risk Analysis
Business Impact Analysis
Policy
Scope
Resources
Organization
Business Continuity Planning Initiation

Business Continuity timeline
A successful recovery
ActiveBusiness

British Standard BS25999
Determining BCM
strategy
Developing & implementing BCM response
Embedding BCM in the organization's culture
Understanding the organization
BCM Programme Management
Exercising, maintaining & reviewing
The BCM Lifecycle: BS 25999-1 2006

Processes - Business Continuity Mgmt
Business ContinuityAssessments / Audits
Risk Analysis
Business ImpactAnalysis
Continuity Strategies
Business ContinuityTesting
Awareness andTraining

BCM Structure

Risk Analysis provides focus for BCM
High
Medium
Probability of Likelihood
Area of
Major
Concern
Low
Low
Medium
High
Severity of Consequence

Application Prioritization
Application Priority Rating
Recovery Requirements
Recovery Time Objective
Disaster Recovery needed: Restoration
AAA
0–6 Hours
at a geographically remote data center.
Local Fail over should also be considered
AA
6–12 Hours
Local Fail over should also be considered.
A
12–24 Hours
Local Fail over should also be considered.
Fail over Local,
B
24-48 Hours
Disaster Recovery
C
48–96 Hours
Scheduled/Delayed Recovery
D
Recovery in 1 Week
Recovery when Resources Permit
E

Leveraging Virtualization
Clients
Services
Business Continuity
Applications
Best Practices
NETWORK
OS
Hardware
Storage

Data Center Best Practices

Risk Management
Elimination
Reduction/Controls
Transfer/Outsource
Not all risk can be eliminated via controls
Insurance
Residual

DR Strategies Options
Weekly Backup and
Off-site Storage
Owned
Cold Site
Daily Backup and
Off-site Storage
Owned
Hot Site
Vendor
Agreements
Weekly Mirroring &
Electronic Vaulting
Quick Ship
Agreements
External
Cold Site
Daily Mirroring &
Electronic Vaulting
External
Hot Site
Real-time Mirroring &
Electronic Vaulting
Immediate,
High-Impact
Strategies
Decision Tree contains5 x 2 x 4 = 40 strategic options

Strategy Optimization
Optimum Mitigation Strategy
Cost of Strategy Mitigation
Lost Revenue
Time
Recovery strategy must be optimized to business requirements

Practical Testing

Response and Risk approach
Crises
Impact
Monitor & resolve the “critical few” with crisis management team
Crisis ManagementProcess
Monitor & resolve at appropriate level using processes
Incident Management
Process
Incidents
Risk Management and Business Controls
Events
Assess impact of events & implement appropriate controls

Crisis Management Team Organization

Response Timeline
Stage 1
Stage 2
Stage 3
Stage 4
Stage 5
Stage 6
Stage 7
Recovery Point Objective
(RPO)
Restore Technology
Synchronization
Applications
Op. Sys.
Data
Last Offsite
Backup
Restore Communications
Immediate
Response
& Relocation
Interim
Site
Resume
Business
Return
Home
Business
as Usual
Restore Business Functions
Functional
Restoration
Workarea
Restoration
Backlog &
Lost Data
Recovery Time Objective (RTO)

Comprehensive Response
Traditional Emergency Management
Contingency Planning
Disaster Recovery
Security
Business Continuity
Crisis Communications

Time for action is now

Questions
Jorge.sebastiao@its.ws