100%(1)1 out of 1 people found this document helpful
This preview shows page 11 - 13 out of 16 pages.
3.Business Continuity PlanThe strategy for which the sum of downtime cost and recovery cost is the lowest is the optimal strategy.Componentsi.DRP plan: It is critical to initially identify information assets that can be made more resilient to disasters.ii.Plan to restore operations to normal following disasteriii.Improvement of security operations BCP Lifecyclei.Create BCP policyii.Business Impact Analysis (BIA) should be conducted with input from a wide array of stakeholders, which identifiesProtecting human resources during a disaster-related event should be addressed first.Different business processes & criticalityCritical IS resources supporting critical business processesCritical recovery period before significant losses occur A determination of acceptable downtime is madeiii.Classify of operations and criticalityiv.Identify IS processes that support business criticalityv.Develop BCP and IS DRPvi.Develop resumption proceduresvii.Training and awareness programsviii.Test and implement planix.Monitoring: Periodic testing of the recovery plan is critical to ensure that whatever has been planned and documented is feasible.Termsi.Recovery point objective (RPO) – based on acceptable data loss; earliest time in which it is acceptable to recover; date/time or synchronization point to which systems/data will be restored. ii.Recovery time objective (RTO) – based on acceptable downtime; earliesttime when business operations must resume. iii.Interruption window – how long a business can wait before operations resume (after this point, losses are unaffordable) iv.Maximum Tolerable outage (MTO) – maximum time business can operate in alternate processing mode before other problems occur v.Service delivery objective (SDO) – acceptable level of services required during alternate processing Recovery Alternativesi.Hot site – fully configured and ready to operate within hours. Not for extended use.ii.Warm site – partially configured. Site ready in hours, operations ready indays or weeks.