What is Business Continuity and Disaster Recovery Planning?

In business, when we look to create something new, we need to follow a process, which is much like a recipe, really.

Because if you go in the kitchen to make a batch of cookies, you're going to follow a recipe.

Otherwise, there's no telling what you're going to end up with, and you're probably not going to want to eat it.

So, in business, we follow a process so that we can enhance our chances for success of creating something usable.

And that means it's time to jump in and take a look at the business continuity and disaster recovery planning process.

So the first thing we're going to do in this process is assign ownership. And that's because we need something. We need accountability.

So we assign who has ownership of our business continuity and who has ownership of our disaster recovery planning.

And again, business continuity and disaster recovery are very similar. And a lot of it overlaps, like a whole lot.

And when it comes to the process of planning, that overlaps as well, 100%.

We go through the same process for each of them. So once we identify who will be accountable for these plans, we have ownership at that point.

So now we can start with the rest of the process, which continues with developing a policy for business continuity and disaster recovery.

because every program or anything we do in business should have a policy around it.

So we have a policy that's going to define what our purpose is of the disaster recovery and business continuity plans.

You know, what is the purpose of these plans? So we need to identify this early on so we know what our target is.

That is our purpose. Then next we have a scope.

We need to identify the scope of what this disaster recovery and continuity planning will cover.

Will it cover the entire organization as a whole? Will it cover only certain parts of the organization?

Or maybe certain branches of the organization? Just depending on what we're looking for.

Now, it will most likely include the entire organization, but there are instances where we might not want to.

And then lastly, we need to define the authority of the program.

So what authority does the program have or those running the program within the organization

so they can do things like, you know, make decisions on behalf of the organization to get things back up and running sooner rather than later.

So those are three things that we need as part of our policy.

We need to have a purpose, we need the scope, and of course, the authority.

and as I mentioned before the business impact analysis

now that we have someone in charge of

the business continuity disaster recovery plans

and again those are two separate plans but

we have someone who's gonna wear the hat of the in charge person and we have also defined a policy we've created it and put it into play.

So those are the two things that we started with. We now need to execute a business impact analysis.

Now this is we're going to go through and identify key business processes.

And we're going to take that list and we're actually going to prioritize it.

And those key business processes are what keep the business alive and functioning.

And once we identify those, again, we're going to prioritize them.

And we should define a statement of impact for each of those items listed so that we know what will happen if we lose that service.

Will we lose email capabilities? Will we not be able to produce a certain product? Will we not be able to process payroll?

You know, what is the statement of impact if we lose that key business process? So that's the third thing.

we perform our BIA. Then we take that BIA information and we put it through some critical analysis, which is step four.

And the critical analysis analyzes the risk. There's our key word there again, risk.

And we analyze the risk associated with that key business process. So that is important.

We're going to analyze the risk associated with it. Then we're going to define the likelihood of occurrence.

That's our next step. So we know how risky it is.

Maybe we define a scale, 1, 2, 3, 4, and 5, 5 being a super high risk and 1 being a low risk.

So that way we have a risk scale.

And then we have a scale of likelihood, maybe 1, 2, and 3, low, medium, and high of likelihood.

And this way we could actually take risk multiplied by likelihood and we can come up with a value that's associated with our critical analysis.

Once we've completed that, we need to go through and establish our recovery goals.

We now know by performing our critical analysis what the impact and likelihood of given scenarios and services are.