Business Continuity Plan TemplateCIO Maria Sosa has asked you to p.docx

Business Continuity Plan Template
CIO Maria Sosa has asked you to provide her and the other
executives with a business continuity plan for your
organization.
Final Business Continuity Plan (five- to seven-page report using
this template). The plan should include the following
components:
· Title Page
· Include:
· for whom you are preparing the document, the title, the date
prepared, and your name as the preparer of the document
· Overview
· Include:
· justifications demonstrating the value of a BCP for the
organization
· description of the scope of the BCP (one to two-page
narrative, from Step 2)
· Business Impact Analysis and Key Resources and Stakeholders
(Steps 3 & 4 using Template in discussion area, plus one-page
summary of findings)
· Include:
· BIA Template table
· Discussion of the information in the table (Methodology, key
factors, priorities, etc)
· Preventative Controls (one to two pages, from Step 6)
· Provide a list of controls that your organization has put into
place in support of the BCP
· These controls should be specifically focused on the BCP
· Contingency Plan (from Step 11)
· Include:
· implementation and maintenance procedures
· testing procedures
· Recovery Strategies (two to three pages, from Step 8)

Mission/Business Process
Description
Stake Holder
Key Resources
MTD
(Hours)
RTO (Hours)
WRT (Hours)
RPO (Hours)
Financial System
Processes invoices and Payables
CFO
Network, Servers, Wkstns
72
48
24
12

Maximum Tolerable Downtime (MTD). The MTD represents the
total amount of time leaders/managers are willing to accept for
a mission/business process outage or disruption and includes all
impact considerations. Determining MTD is important because
it could leave continuity planners with imprecise direction on
(1) selection of an appropriate recovery method, and (2) the
depth of detail which will be required when developing
recovery procedures, including their scope and content.
Recovery Time Objective (RTO). The time available to recover
disrupted systems and resources. It is typically one segment of
the MTD. For example, if a critical business process has a
three-day MTD, the RTO might be one day (Day 1). This is the
time you will have to get systems back up and running. The
remaining two days will be used for work recovery (see Work
Recovery Time).
Work Recovery Time (WRT)
The second segment that comprises the maximum tolerable
downtime (MTD). If your MTD is three days, Day 1 might be
your RTO and Days 2 to 3 might be your WRT. It takes time to
get critical business functions back up and running once the
systems (hardware, software, and configuration) are restored.
This is an area that some planners overlook, especially from IT.

If the systems are back up and running, they're all set from an
IT perspective. From a business function perspective, there are
additional steps that must be undertaken before it's back to
business. These are critical steps and that time must be built
into the MTD. Otherwise, you'll miss your MTD requirements
and potentially put your entire business at risk.
Remember this formula: MTD = RTO + WRT. So in my
example of above 72hrs = 48hrs + 24hrs
Recovery Point Objective (RPO). The RPO represents the point
in time, prior to a disruption or system outage, to which
mission/business process data must be recovered (given the
most recent backup copy of the data) after an outage.
Data in Italics is for demonstration purposes and should be
replaced when you create your own table.
1. BCP Scope - Submit a brief description for feedback (one
page or less) of the topic areas to be covered in the BCP.
2. Business Impact Analysis – use template
3. Key Resources and Stakeholders – use template
4. Preventive Controls List - write a description of the
preventative controls that you considered in the previous step
5. Viable Recovery Strategies - to create a drawing or
descriptive list that follows both options to each decision of
"yes" or "no" or "success" or "failure" to the reconstructive
effort.
6. Contingency Plan – steps 9 thru 11
7. Business Continuity Plan 5-7 pages
This section is to facilitate continued progress to the ultimate
goal of enterprise risk management. A primary element or
baseline of this process is the business continuity plan (BCP).

With the previous projects of identifying vulnerabilities and
assessing the risk of the various cyberattacks that can occur, the
next level of preparation is to create a plan to continue
operations should a worst-case scenario event take place.
In the following exercises, the earlier results are the basis for
planning this investigation. The vulnerability assessment in
Project 1 helped determine where to look in the creation of the
risk assessment in Project 2. The steps of this project will help
document what to do to "put it all back together," in an orderly,
prioritized method following a documented plan. That plan is
the BCP.
The BCP assignment will detail the following elements:
· resources required and defined stakeholder roles
· business impact analysis
· recommended preventative controls
· recovery strategies
· contingency plan that includes implementation and
maintenance guidelines and defined procedures for testing the
plan
Grades are determined on the ability to clearly articulate a
developed, effective business continuity plan that considers
relevant environmental factors and aligns with organizational
objectives.
Business Continuity Transcript
[MUSIC PLAYING]
You are working at your desk when your boss, CIO Maria Sosa,
stops by. Maria says, did you hear that we won the contract to
provide cloud-based computer services for Enrocca? This is a
high-profile contract and working with this federal client is a
big win for us.
You respond, that's great news. I know that the compliance
requirements for working with a federal agency are pretty
substantial and include a thorough business continuity plan.
We'll need to meet or exceed the federal standards for
compliance, so we should start the process of updating our BCP
soon.

Maria nods and replies, good point. Remember when the Poser
Soft servers were damaged by that flood last year? That caused
them to be late on their deliverables to Enrocca. We definitely
don't want something like that to happen to us.
As Maria is speaking, you remember that a friend of yours was
laid off when Poser Soft lost the Enrocca contract because of
that very incident. You assure Maria that you'll get started on
the new BCP this week.
Step 1: Review Assigned Organization
The process of business continuity planning addresses the
preservation and recovery of business in the event of outages to
normal business operations. The output of the process is
the business continuity plan, an approved set of documented
arrangements and procedures that enables an organization to
facilitate the recovery of business operations, minimize losses,
and replace or repair incurred damages as quickly as possible
(Ouyang, n.d.).
According to the National Institute of Standards and
Technology's Special Publication 800-34, Contingency Planning
Guide for IT Systems, business continuity planning is an
ongoing task, the goals of which are to (Ouyang, n.d.)
· sustain operations
· recover and resume operations
· protect assets
Goals of the BCP Cycle
In the case of your particular organization, the company has an
existing business continuity plan, so the first task may be to
review the company plan. However, in your organization, as
with many others, the business continuity plan (BCP) was
written, put on the shelf, and rarely, if ever, referenced unless
an emergency requires implementation of the plan.
Knowing this, assume the project is starting from scratch, so
take some time to the business continuity planning process, if
needed.

The next step will involve planning for the BCP, including
establishing a need and defining a scope.Step 2: Define the
Scope
In the first step, you reviewed BCP methodologies. You are now
ready to continue the first part of the planning process, which
involves establishing the clear need for a BCP and defining an
appropriate scope for the company outlined in the scenario.
The BCP should address aspects of business continuity,
business recovery, contingency planning, disaster recovery, and
related activities. Focus on those elements of a plan that are
adequate and expedient, based on your risk assessment for the
enterprise.
Note that governmental agencies are required to develop an
enterprise continuity of operations program (COOP). A COOP
is a detailed framework that documents how the agency will
ensure that essential functions continue through an emergency
situation until normal operations can resume. Outside of
federal, state, and local government, enterprises call this
framework a business continuity plan (BCP). Both COOPs and
BCPs are created to help the organization recover from a
disaster.
Consider what aspects of business continuity the BCP will
address, such as business recovery, contingency planning,
disaster recovery. Submit a brief description for feedback (one
page or less) of the topic areas to be covered in the BCP. In the
next step, you will use a risk management framework to put
together a business impact analysis.Step 3: Conduct a Business
Impact Analysis
You've defined the scope for the BCP. Next, use an
established risk management framework to conduct a business
impact analysis (BIA).
The BIA provides written documentation to assist Maria and the
other executives in understanding the business impact should an
outage occur. Such impacts may be financial, in terms of lost
revenues and additional expenses; operational, in terms of
inability to deliver products and services; or even intangible, in

terms of damage to the organization's reputation and loss of
public confidence.
This analysis should include all departments and facilities of
the enterprise, list what it would take for each to resume
adequate operations to meet the needs of the enterprise, and
must include each phase of the recovery activities.
Remember, a key element to "business impact" is the financial
aspect. What will it "cost" to take a particular action and,
equally important, what could be the "cost" of inaction?
Just as in the Risk Assessment of Project 2, prioritization is a
key to the successful recovery of operations. The sequence of
activities is an essential element in your contingency planning.
Refer to the Risk Assessment report delivered in Project 2 to get
started.
Use the business impact analysis template business impact
analysis template to upload the BIA here for feedback. In the
next step, you will take a look at needed resources and who will
be responsible for meeting those needs.Step 4: Identify Key
Resources and Stakeholders
After the BIA, the next step is to identify the key resources
necessary and the stakeholders (executives and management)
responsible for those resources. Remember, some resources
necessary for a successful BCP might be external to the
company. Be sure to include these aspects in the plan.
Now that all resources and stakeholders are identified and
listed, answer these two questions: What resources are needed?
Who are the players?
Expand the table for the BCP by including a column for
accountability. With an assumed and reasonable job title, make
a list of probable stakeholders responsible for execution of each
recovery effort. Clearly identify their respective responsibilities
during the reactivation of business processes.
Use the key resources and stakeholders template to indicate key
resources and stakeholders involved in the recovery for
feedback. In the next step, you will look at what can be done to
prevent or reduce the impact of a significant event.Step 5:

Consider Preventive Controls
After identifying the key stakeholders and resources, take a
look at what can be put in place in advance to prevent or reduce
risk. Based on previous research, plus what you have learned in
the business impact analysis, what could be done to eliminate or
minimize the impact of a major event? These are called
preventive controls in the business process realm, or risk
countermeasure implementation in technology language.
Either way, the BCP should contain controls that can be
classified as measures taken in advance of a catastrophe that are
designed to reduce the risk of a negative impact. In the process
of itemizing the controls, make sure they are properly aligned
with organizational goals and the strategic direction of the
enterprise.
The preventative controls selected should be aligned with the
organizational goals and strategies. You will list these controls
in the next step.Step 6: List Preventive Controls
In this step, you will write a description of the preventative
controls that you considered in the previous step. These controls
could eliminate or minimize the impact of a major event.
Upload a description of the preventative controls to be used in
the BCP here for feedback. In the next step, you will conduct
research on recovery strategiesStep 7: Research Recovery
Strategies
A BCP is uniquely different from a complete disaster recovery
plan (DRP), neither of which is a small undertaking. Both are
required to return the enterprise to 100 percent functionality.
The view for the enterprise is to have one BCP that contains
multiple DRPs generally broken into department or business
function categories.
The BCP is an overarching strategic approach to getting any
business back "in" business with all mandatory functionality as
soon as possible after disaster strikes. This is why the previous
steps and projects have required these elements to be identified

and prioritized. As such, the BCP is not as detail-oriented as the
DRP and only contains DRP requirements that are absolutely
mandatory to get the business back in action at the earliest
opportunity.
The DRP is usually more technical, very specific, and very
much a necessity in today's highly connected technology
infrastructure. The DRP includes descriptions of data backup
strategies, recovery sites, and post-incident requirements.
There will naturally be several aspects of the rebuild that might
not go exactly as planned. This exercise will be to demonstrate
an ability to follow multiple paths in a decision tree
environment. The objective will be to create a drawing or
descriptive list that follows both options to each decision of
"yes" or "no" or "success" or "failure" to the reconstructive
effort.
Specifically, for each step, conclude with an answer to the
question "was the action successful?" If "yes," what is the next
step? Or, if "no," what is the alternative step to take next?
Continue this process until you have successfully returned to
operational status, or determined you cannot reactivate under
current circumstances. If the result of the plan is an inability to
recover, the plan needs additional work to make it successful.
In the next step, you will document the selected recovery
strategies.
Step 8: Document Recovery Strategies
Now that you have researched recovery strategies as they
pertain to a BCP, list or map multiple strategic options to
accomplish the recovery effort. Upload a description of the
planned recovery strategies here for feedback. When that is
complete, move to the next step, where you will consider how
the contingency plan will be implemented and maintained.Step
8: Document Recovery Strategies
Now that you have researched recovery strategies as they
pertain to a BCP, list or map multiple strategic options to
accomplish the recovery effort. Upload a description of the
planned recovery strategies here for feedback. When that is

complete, move to the next step, where you will consider how
the contingency plan will be implemented and maintained.
Step 9: Develop Implementation and Maintenance Procedures
for the Contingency Plan
You've documented recovery strategies and are well on the way
to completing the BCP. But writing a BCP is not enough. You
must also have a clear plan for implementing and maintaining
the BCP, by answering some questions:
· What resources are needed?
· Under what conditions, such as fire, natural disasters,
occurrence of a terrorist attack, etc., will the BCP will be
activated?
· How will stakeholders be made aware of the policies and
procedures of the BCP?
· How will employees be trained on the plan? How often will
training occur? Will there be a general training for all
employees or role-based trainings for people in specific
functional areas?
· How/where will the plan for stored for safekeeping and
accessibility when needed?
· When and how will BCP maintenance reviews be scheduled?
· How will updates and changes to the plan be handled? How
often will the plan be updated?
In this step, begin to develop a strategy for how the BCP will be
implemented and maintained. This information will be used in
Step 11, in which the contingency plan will be documented.
Next, you will develop testing procedures for the plan.Step 10:
Develop Testing Procedures for the Contingency Plan
You've begun to outline your strategy for how to implement and
maintain a BCP. It is also important to conduct business
continuity testing to evaluate the effectiveness of a
preparedness program in practice. This will give insight into
whether the parts of the preparedness program will work and
can help identify aspects of the BCP that work on paper but are
ineffective or impractical in reality.
Examples of BCP Tests

Types of Tests
Description
Structured walk-through
Step-by-step review of BCP plans with organization's functional
representatives
Checklist test
Functional representatives review BCP plans and check off the
points that are listed to ensure concerns and activities are
addressed
Simulation
A scenario-based practice execution of the BCP plans.
Parallel test
Operational test conducted at the alternate site(s).
Full interruption test
Full-scale operational test including shutdown of primary site
and recovery of business operations at alternate site(s).
Source: Ouyang, A. (n.d.). CISSP common body of knowledge:
Business continuity & disaster recovery planning domain. Used
under a Creative Commons Attribution-NonCommercial-
ShareAlike 3.0 Unported license.
Taking time to develop, document, and test consistent processes
and controls will also help you prepare for the annual audit of
your information security system under any of the commonly
used security and audit frameworks. Under these security and
audit methodologies, auditors will gather information about the
organization's security systems, confirm that appropriate
security measures are in place, and provide a report on their
findings.
Now develop your strategy for how the BCP will be tested.
Your plan will be included in the contingency plan to be
submitted in the next step.Step 11: Document the Contingency
Plan
You've developed testing procedures. However, an effective

BCP must outline how the plan will be implemented and
maintained and also how it will be tested to ensure its viability
in a real emergency situation. Therefore, an integral part of the
BCP should be a discussion of plans for implementation and
maintenance and for business continuity testing.
Upload your contingency plan with a description of how the
BCP will be tested and plans for ensuring the proper
implementation and maintenance of the plan here for feedback.
Step 12: Consolidate and Update Your Work
You've documented testing and implementation procedures, and
the plan is nearly complete. In the next step, you will submit
your final BCP. Take some time now to update your work on the
project to this point and make updates based on feedback
received or new information uncovered.
In the final step, you'll complete and submit the BCP.Step 13:
Write the Business Continuity Plan (BCP)
Use the results from the previous steps to create a five- to
seven-page business continuity plan. Explain the thought
process of creating the specific plan steps and how each is
related to business strategy considerations.
Use this Business Continuity Plan template to submit your final
assignment.Check Your Evaluation Criteria
Before you submit your assignment, review the competencies
below, which your instructor will use to evaluate your work. A
good practice would be to use each competency as a self-check
to confirm you have incorporated all of them. To view the
complete grading rubric, click My Tools, select Assignments
from the drop-down menu, and then click the project title.
1.4: Tailor communications to the audience.
2.3: Evaluate the information in a logical and organized manner
to determine its value and relevance to the problem.
9.1: Develop, implement, and maintain a business continuity
plan, ensuring alignment with organizational goals and
objectives.

Key Resources and Stakeholders
Copy the BIA findings into the table below and add information
on the resources that are needed and person or groups
accountable for that specific aspect of the BCP.
Threat
Impacts
Priority Assessment
Recovery Methods
Accountability

Note: You can add more rows to the bottom of the table if
needed.
Threat
Impacts
Priority Assessment
Recovery Methods

Note: You can add more rows to the bottom of the table if
needed.

Business Continuity Plan Template
CIO Maria Sosa has asked you to provide her and the other
executives with a business continuity plan for your
organization.
Final Business Continuity Plan (five- to seven-page report using
this template). The plan should include the following
components:
· Title Page
· Include:
· for whom you are preparing the document, the title, the date
prepared, and your name as the preparer of the document
· Overview
· Include:
· justifications demonstrating the value of a BCP for the
organization
· description of the scope of the BCP (one-page narrative, from
Step 2)
· Business Impact Analysis and Key Resources and
Stakeholders (table from Step 4, plus one-page summary of
findings)
· Include:
· table from Step 4
· summary of findings
· Preventative Controls (one to two pages, from Step 6)
· Recovery Strategies (two to three pages, from Step 8)
· Contingency Plan (from Step 11)
· Include:
· implementation and maintenance procedures
· testing procedures
· Summary
· Include:
· explanation of the thought process of creating the specific
plan steps and how each is related to business strategy
considerations

Business Continuity Plan
Many companies do not realize the importance of a business
continuity plan (BCP) until an incident has occurred. A
cybersecurity BCP includes a strategy of how the organization
information technology would operate and recover after an
incident that could be result of an intentional attack or caused
by a natural disaster.
There are four critical steps when establishing a BCP, according
to guidelines published by the Department of Homeland
Security:
· conduct a business impact analysis to identify time-sensitive
or critical business functions and processes and the resources
that support them
· identify and document resource requirements, and implement
strategies to recover critical business functions and processes
· organize a business continuity team and compile a continuity
plan to manage a business disruption
· conduct training for the business continuity team and testing
and exercises to evaluate recovery strategies and the plan
There are several recovery goals stated within a BCP, such as
recovery point objective (RPO), recovery time objective (RTO),
business recovery requirements, and technical recovery
requirements. An RPO states how far back should an
organization go in time in order to recover data after an
incident. Think of clicking Ctrl+Alt+Shift+H on your computer
in order to see the history of the websites you have visited. RTO
is based on the idea of how long it takes to restore backup data
to its original state in order to resume business operations.
One key component of an BCP is the wellbeing of employees.
People should always be a priority when establishing a BCP. All
other components of an organization can be replaced, rebuilt, or
insured. According to the code of ethics of ISC2, the
International Information System Security Certification
Consortium, an information security professional must always

"protect society, the common good, necessary public trust and
confidence, and the infrastructure."

Business Continuity Plan TemplateCIO Maria Sosa has asked you to p.docx

Recommended

Recommended

More Related Content

Similar to Business Continuity Plan TemplateCIO Maria Sosa has asked you to p.docx

Similar to Business Continuity Plan TemplateCIO Maria Sosa has asked you to p.docx (20)

More from felicidaddinwoodie

More from felicidaddinwoodie (20)

Recently uploaded

Recently uploaded (20)

Business Continuity Plan TemplateCIO Maria Sosa has asked you to p.docx