The document outlines the fundamentals of business continuity and disaster recovery planning, detailing the types of disasters, their impacts on businesses, and the essential components of creating and maintaining effective recovery plans. It distinguishes between business continuity planning (BCP) and disaster recovery planning (DRP), emphasizing the importance of testing, training, and adherence to industry standards such as ISO and NIST. Additionally, it covers the phases of project execution, including business impact assessments and the development of recovery targets to improve organizational resilience.

1. Business Continuity and
Disaster Recovery Planning
CISSP Guide to Security Essentials
Chapter 4

2. Objectives
• Running a business continuity and
disaster recovery planning project
• Developing business continuity and
disaster recovery plans
• Testing business continuity and disaster
recovery plans
• Training users
• Maintaining business continuity and
disaster recovery plans

3. Business Continuity and Disaster
Planning Basics

4. What Is a Disaster
• Any natural or man-made event that
disrupts the operations of a business
in such a significant way that a
considerable and coordinated effort is
required to achieve a recovery.

5. Natural Disasters
• Geological: earthquakes, volcanoes,
tsunamis, landslides, and sinkholes
• Meteorological: hurricanes, tornados,
wind storms, hail, ice storms, snow
storms, rainstorms, and lightning
• Other: avalanches, fires, floods, meteors
and meteorites, and solar storms
• Health: widespread illnesses,
quarantines, and pandemics

6. Man-made Disasters
• Labor: strikes, walkouts, and slow-downs
that disrupt services and supplies
• Social-political: war, terrorism, sabotage,
vandalism, civil unrest, protests,
demonstrations, cyber attacks, and
blockades

7. Man-made Disasters (cont.)
• Materials: fires, hazardous materials spills
• Utilities: power failures, communications
outages, water supply shortages, fuel
shortages, and radioactive fallout from
power plant accidents

8. How Disasters Affect Businesses
• Direct damage to facilities and equipment
• Transportation infrastructure damage
– Delays deliveries, supplies, customers, employees
going to work
• Communications outages
• Utilities outages

9. How BCP and DRP
Support Security
• BCP (Business Continuity Planning) and
DRP (Disaster Recovery Planning)
• Security pillars: C-I-A
– Confidentiality
– Integrity
– Availability
• BCP and DRP directly support availability

10. BCP and DRP Differences
and Similarities
• BCP
– Activities required to ensure the continuation of
critical business processes in an organization
– Alternate personnel, equipment, and facilities
– Often includes non-IT aspects of business
• DRP
– Assessment, salvage, repair, and eventual
restoration of damaged facilities and systems
– Often focuses on IT systems

11. Industry Standards Supporting
BCP and DRP
• ISO 27001: Requirements for
Information Security Management
Systems. Section 14 addresses
business continuity management.
• ISO 27002: Code of Practice for
Business Continuity Management.

12. Industry Standards Supporting
BCP and DRP (cont.)
• NIST 800-34
– Contingency Planning Guide for Information
Technology Systems.
– Seven step process for BCP and DRP projects
– From U.S. National Institute for Standards and
Technology
• NFPA 1600
– Standard on Disaster / Emergency Management
and Business Continuity Programs
– From U.S. National Fire Protection Association

13. Industry Standards Supporting
BCP and DRP (cont.)
• NFPA 1620: The Recommended
Practice for Pre-Incident Planning.
• HIPAA: Requires a documented and
tested disaster recovery plan
– U.S. Health Insurance Portability and Accountability
Act

14. Benefits of BCP and DRP
Planning
• Reduced risk
• Process improvements
• Improved organizational maturity
• Improved availability and reliability
• Marketplace advantage

15. The Role of Prevention
• Not prevention of the disaster itself
– Prevention of surprise and disorganized response
• Reduction in impact of a disaster
– Better equipment bracing
– Better fire detection and suppression
– Contingency plans that provide [near] continuous
operation of critical business processes
– Prevention of extended periods of downtime

16. Running a BCP / DRP Project

17. Running a BCP / DRP Project
• Main phases
– Pre-project activities
– Perform a Business Impact Assessment
(BIA)
– Develop business continuity and recovery
plans
– Test resumption and recovery plans

18. Pre-project Activities
• Obtain executive support
• Formally define the scope of the project
• Choose project team members
• Develop a project plan
– Get a project manager
• Develop a project charter
– A document listing all these items, plus budget, and
milestones

19. iClicker Questions
iClicker Questions

20. Which of these is essential to a
Which of these is essential to a
business continuity plan?
business continuity plan?
A.
A. A fence to deter attackers
A fence to deter attackers
B.
B. A RAID array
A RAID array
C.
C. Fire drills
Fire drills
D.
D. Separation of duties
Separation of duties
E.
E. Off-site backups
Off-site backups
1 of 5

21. Which of these is essential to a
Which of these is essential to a
Disaster Recovery Planning?
Disaster Recovery Planning?
A.
A. Temporary alternate office space
Temporary alternate office space
B.
B. Safety inspection of damaged buildings
Safety inspection of damaged buildings
C.
C. Server clustering
Server clustering
D.
D. Surveillance cameras
Surveillance cameras
E.
E. Bollards
Bollards
2 of 5

22. Which of these will not reduce
Which of these will not reduce
the impact of a disaster?
the impact of a disaster?
A.
A. Off-site backups
Off-site backups
B.
B. Sprinkler systems
Sprinkler systems
C.
C. BCP
BCP
D.
D. DRP
DRP
E.
E. Fire drills
Fire drills
3 of 5

23. CVS is a pharmacy chain.
CVS is a pharmacy chain.
Which standard should they
Which standard should they
focus on most?
focus on most?
A.
A. NFPA 1620
NFPA 1620
B.
B. HIPAA
HIPAA
C.
C. NIST 800-34
NIST 800-34
D.
D. ISO 27001
ISO 27001
E.
E. None of the above
None of the above
4 of 5

24. Which item contains projected
Which item contains projected
costs and specific measurable
costs and specific measurable
goals?
goals?
A.
A. Executive support
Executive support
B.
B. Project scope
Project scope
C.
C. Personnel list
Personnel list
D.
D. Project plan
Project plan
E.
E. Project charter
Project charter
5 of 5

25. Business Impact Assessment
(BIA)

26. Performing a Business
Impact Assessment
• Survey critical processes
• Perform risk analyses and threat
assessment
• Determine Maximum Tolerable Downtime
(MTD)
• Establish key recovery targets

27. Survey In-scope
Business Processes
• Develop interview / intake template
• Interview a rep from each department
– Identify all important processes
– Identify dependencies on systems, people,
equipment
• Collate data into database or
spreadsheets
– Gives a big picture, all-company view

28. Threat and Risk Analysis
• Identify threats, vulnerabilities, risks, for
each key process
– Rank according to probability, impact, cost
– Identify mitigating controls

29. Determine Maximum
Tolerable Downtime (MTD)
• For each business process
• Identify the maximum time that each
business process can be inoperative
before significant damage or long-term
viability is threatened
• Probably an educated guess for many
processes

30. Determine Maximum
Tolerable Downtime (cont.)
• Obtain senior management input to
validate data
• Publish into the same database /
spreadsheet listing all business
processes

31. Develop Statements of Impact
• For each process, describe the impact
on the rest of the organization if the
process is incapacitated
• Examples
– Inability to process payments
– Inability to produce invoices
– Inability to access customer data for support
purposes

32. Record Other Key Metrics
• Examples
– Cost to operate the process
– Cost of process downtime
– Profit derived from the process
• Useful for upcoming Criticality Analysis

33. Ascertain Current Continuity and
Recovery Capabilities
• For each business process
– Identify documented continuity capabilities
– Identify documented recovery capabilities
– Identify undocumented capabilities
• What if the disaster happened tomorrow

34. Develop Key Recovery Targets
• Recovery time objective (RTO)
– Period of time from disaster onset to
resumption of business process
• Recovery point objective (RPO)
– Maximum period of data loss from onset
of disaster counting backwards
– Amount of work that will have to be done over

35. Develop Key Recovery
Targets (cont.)
• Obtain senior management buyoff on
RTO and RPO
• Publish into the same database /
spreadsheet listing all business
processes

36. Sample Recovery Time Objectives
RPO Technology(ies) required
8-14 days New equipment, data recovery from backup
4-7 days Cold systems, data recovery from backup
2-3 days Warm systems, data recovery from backup
12-24 hours Warm systems, recovery from high speed
backup media

37. Sample Recovery
Time Objectives (cont.)
RPO Technology(ies) required
6-12 hours Hot systems, recovery from high speed
backup media
3-6 hours Hot systems, data replication
1-3 hours Clustering, data replication
< 1 hour Clustering, near real time data replication

38. Criticality Analysis
• Rank processes by criticality criteria
– MTD (maximum tolerable downtime)
– RTO (recovery time objective)
– RPO (recovery point objective)
– Cost of downtime or other metrics
– Qualitative criteria
• Reputation, market share, goodwill

39. Improve System and
Process Resilience
• For the most critical processes (based
upon ranking in the criticality analysis)
– Identify the biggest risks
– Identify cost of mitigation
– Can several mitigating controls be combined
– Do mitigating controls follow best / common
practices

40. iClicker Questions
iClicker Questions

41. A company has enough stored water in a
A company has enough stored water in a
tank to operate for 2 days. After that work
tank to operate for 2 days. After that work
will cease. Which item below best describes
will cease. Which item below best describes
that information?
that information?
A.
A. BIA
BIA
B.
B. MTD
MTD
C.
C. BCP
BCP
D.
D. DRP
DRP
E.
E. Criticality analysis
Criticality analysis
1 of 5

42. A Web-based retailer purchases an alternate
A Web-based retailer purchases an alternate
hosting service which promises to bring the site
hosting service which promises to bring the site
back up within one hour of a failure of the original
back up within one hour of a failure of the original
servers. Which term best describes the "one hour"
servers. Which term best describes the "one hour"
value?
value?
A.
A. MTD
MTD
B.
B. BCP
BCP
C.
C. DRP
DRP
D.
D. RTO
RTO
E.
E. RPO
RPO
2 of 5

43. A written document explains how to transfer
A written document explains how to transfer
operations to a different location, if needed.
operations to a different location, if needed.
Which item below best describes that
Which item below best describes that
document?
document?
A.
A. BIA
BIA
B.
B. BCP
BCP
C.
C. DRP
DRP
D.
D. Criticality analysis
Criticality analysis
E.
E. RTO
RTO
1 of 5

44. Develop Business Continuity
and Recovery Plans

45. Select Recovery Team Members
• Selection criteria
– Location of residence, relative to work
and other key locations
– Skills and experience (determines effectiveness)
– Ability and willingness to respond
– Health and family (determines probability to serve)
– Identify backups
• Other team members, external resources

46. Emergency Response
• Personnel safety: includes first-aid,
searching for personnel, etc.
• Evacuation: evacuation procedures to
prevent any hazard to workers.
• Asset protection: includes buildings,
vehicles, and equipment.

47. Emergency Response (cont.)
• Damage assessment: this could involve
outside structural engineers to assess
damage to buildings and equipment.
• Emergency notification: response team
communication, and keeping
management and organization staff
informed.

48. Damage Assessment and Salvage
• Determine damage to buildings,
equipment, utilities
– Requires inside experts
– Usually requires outside experts
• Civil engineers to inspect buildings
• Government building inspectors
• Salvage
– Identify working and salvageable assets
– Cannibalize for parts or other uses

49. Notification
• Many parties need to know the condition
of the organization
– Employees, suppliers, customers, regulators,
authorities, shareholders, community
• Methods of communication
– Telephone call trees, web site, signage, media
– Alternate means of communication must be
identified

50. Personnel Safety
• The number one concern in any disaster
response operation
– Emergency evacuation
– Accounting for all personnel
– Administering first-aid
– Emergency supplies
• Water, food, blankets, shelters
• On-site employees could be stranded for
several days

51. Communications
• Communications essential during
emergency operations
• Considerations
– Avoid common infrastructure
• Don't have emergency communications through the
same wires as normal communications
– Diversify mobile services
– Consider two-way radios
– Consider satellite phones
– Consider amateur radio

52. Public Utilities and Infrastructure
• Often interrupted during a disaster
– Electricity: UPS (Uninterruptible Power Supply),
generator
– Water: building could be closed if no
water is available for fire suppression
– Natural gas: heating
– Wastewater: if disabled, building could be closed
– Steam heat

53. Logistics and Supplies
• Food and drinking water
• Blankets and sleeping cots
• Sanitation (toilets, showers, etc.)
• Tools
• Spare parts
• Waste bins
• Information
• Communications
• Fire protection (extinguishers, sprinklers,
smoke alarms, fire alarms)

54. Business Resumption Planning
• Alternate work locations
• Alternate personnel
• Communications
– Emergency, support of business processes
• Standby assets and equipment
• Access to procedures, business records

55. Restoration and Recovery
• Repairs to facilities, equipment
• Replacement equipment
• Restoration of utilities
• Resumption of business operations in
primary business facilities

56. Improving System Resilience
and Recovery
• Off-site media storage
– Assurance of data recovery
• Server clusters
– Improved availability
– Geographic clusters: members far apart
• Data replication
– Application, DMBS, OS, or Hardware
– Maintains current data on multiple servers even in
remote places

57. Training Staff
• Everyday operations
• Recovery procedures
• Emergency procedures
• Resumption procedures

58. Testing Business Continuity
and Disaster Recovery Plans

59. Testing Business Continuity
and Disaster Recovery Plans
• Five levels of testing
– Document review
– Walkthrough
– Simulation
– Parallel test
– Cutover test

60. Document Review
• Review of recovery, operations,
resumption plans and procedures
• Performed by individuals
• Provide feedback to document owners

61. Walkthrough
• Performed by teams
• Group discussion of recovery, operations,
resumption plans and procedures
• Brainstorming and discussion brings out
new issues, ideas
• Provide feedback to document owners

62. Simulation
• Walkthrough of recovery, operations,
resumption plans and procedures in a
scripted “case study” or “scenario”
• Performed by teams
• Places participants in a mental disaster
setting that helps them discern real
issues more easily

63. Parallel Test
• Full or partial workload is applied to
recovery systems
• Performed by teams
• Tests actual system readiness and
accuracy of procedures
• Production systems continue to operate
and support actual business processes

64. Cutover Test
• Production systems are shut down or
disconnected; recovery systems assume
full actual workload
• Risk of interrupting real business
• Gives confidence in DR (Disaster
Recovery) system if it works

65. Maintaining Business Continuity
and Disaster Recovery Plans

66. Maintaining Business Continuity
and Disaster Recovery Plans
• Events that necessitate review and
modification of DRP and BCP
procedures:
– Changes in business processes and procedures
– Changes to IT systems and applications
– Changes in IT architecture
– Additions to IT applications
– Changes in service providers
– Changes in organizational structure

67. iClicker Questions
iClicker Questions

68. Which of these is the highest
Which of these is the highest
priority in a disaster?
priority in a disaster?
A.
A. Personnel safety
Personnel safety
B.
B. Asset protection
Asset protection
C.
C. Damage assessment
Damage assessment
D.
D. Emergency notification
Emergency notification
E.
E. The answer depends on the situation
The answer depends on the situation
1 of 4

69. Which of these is often performed
Which of these is often performed
by amateurs during a disaster?
by amateurs during a disaster?
A.
A. Damage assessment
Damage assessment
B.
B. Salvage
Salvage
C.
C. Communications
Communications
D.
D. Electricity generation
Electricity generation
E.
E. Training staff
Training staff
2 of 4

70. Which of these is the most likely to
Which of these is the most likely to
interrupt real business operations?
interrupt real business operations?
A.
A. Document review
Document review
B.
B. Walkthrough
Walkthrough
C.
C. Simulation
Simulation
D.
D. Parallel test
Parallel test
E.
E. Cutover test
Cutover test
3 of 4

71. Which of these involves only a
Which of these involves only a
group discussion of procedures,
group discussion of procedures,
without a specfic fictional
without a specfic fictional
emergency?
emergency?
A.
A. Document review
Document review
B.
B. Walkthrough
Walkthrough
C.
C. Simulation
Simulation
D.
D. Parallel test
Parallel test
E.
E. Cutover test
Cutover test
4 of 4