Business Continuity Planning: Best Practices and Challenges
Business Continuity Planning (BCP) - Best
Practices and Challenges
J
u
n
e
2
4
,
2
0
2
0
A
b
o
u
t
t
h
e
S
p
e
a
k
e
r
–
D
h
i
r
a
j
L
a
l
Over 32 years in the industry. Ex BCM Sponsor and Head of American Express. Mix of
experience as Practitioner, Trainer, and Consultant . BCI Approved Instructor. Over 15 years
in BCM and related domains.
Contributing Autho
r to :
The Encyclopaedia of Business Continuity, 3
rd
Edition
Author of:
Step by Step guide AE/SCNS/NCEMA 7000:2015.
Implement BCM the UAE Way!
Dhiraj Lal
,
E
XECUTIVE DIRECTOR, CONTINUITY & RESILIENCE (CORE)
MBCI, CBCP, CBCI, ISO 22301 Technical Expert, CISA, ITIL, ISO 31000, ISO 27001 Lead Auditor
A Chemical Engineer from IIT Delhi and MBA from IIM Calcutta, , Dhiraj Lal has over 20 years BCM
experience and 32 years overall. He has worked with Citibank, Standard Chartered, Agilent and
American Express, where he was the Program Sponsor and BCM Head. He is Asia’s first BSI
appointed Technical Expert for BS25999/ ISO 22301, and assessed 2 of the top 10 certified
organizations globally. He teaches and consults in BCM (NCEMA 7000/ ISO 22301) and related
domains. He has been invited to present at the BCI Annul conference in the UK, DRI US, BCMI
Singapore, itSMF UK, DRI Asia in Malaysia, ISACA UAE, KSA and India, and also various Middle
East Crisis, BCM and IT Resilience Summits in Abu Dhabi, Dubai, KSA and India
A
b
o
u
t
C
o
n
t
i
n
u
i
t
y
&
R
e
s
i
l
i
e
n
c
e
ISO 22301 Certified Management Consulting Firm
•
Business Continuity Management
•
Crisis Management
•
IT Disaster Recovery
•
Information Security
•
Cyber Security
•
Risk Management
We Consult / Train / Assess and Certify in these domains
We provide advisory services
•
Automation tools – BCM/ ITDR/ Mass Communication
•
Workplace recovery
•
E-Learning
A
g
e
n
d
a
•
Business Continuity Planning
•
Business Continuity Implementation Roadmap
•
BCP in times of COVID-19
•
Challenges and Best Practices
B
u
s
i
n
e
s
s
C
o
n
t
i
n
u
i
t
y
P
l
a
n
n
i
n
g
•
“Planning to to continue the Business”
•
Not a new concept. A fancy name for common sense. In reality, we have
been performing Business Continuity Planning for centuries
•
But still, many organizations struggled to restart operations during
COVID-19
•
So we need more than just common sense. We need a structured and
formal implementation of common sense.
W
h
a
t
w
e
d
o
n
o
t
f
u
l
l
y
d
o
i
n
B
A
U
c
o
m
m
o
n
s
e
n
s
e
1.
Agree timelines, worst case and best case (MTPD and RTO)
2.
Base it fully on facts and data (consequences of downtime)
3.
C
o
n
s
u
l
t
a
t
i
v
e
p
r
o
c
e
s
s
i
n
v
o
l
v
i
n
g
a
l
l
i
n
t
e
r
e
s
t
e
d
p
a
r
t
i
e
s
4.
Comprehensive, documented and signed off
5.
Communicate to all who need to know, including relevant third parties
and service providers
6.
Practice, Test & exercise. Review. Maintain & continually Improve
Amazingly, this works…!!
C
h
a
l
l
e
n
g
e
s
f
o
r
c
y
b
e
r
p
r
o
f
e
s
s
i
o
n
a
l
s
•
An uneven battle against an unknown enemy who has nothing
better to do
•
Y
ou have other matters to focus on but they have a single point
agenda – to damage
•
Y
ou constantly focus on getting better and better - but so do they
•
By the sheer law of averages, once in a while they will succeed
•
At those times, your best best is to be able to restart fast and within
minimum loss. So you need the world’s best Business Continuity
readiness
Have you formally put in place the 6 Rs (Reduce, Respond,
Recover, Resume, Restore Return)?
When did you last practice them?
C
h
a
l
l
e
n
g
e
s
f
o
r
c
y
b
e
r
p
r
o
f
e
s
s
i
o
n
a
l
s
Economic Times, June 24 2020
S
o
m
e
r
e
a
s
o
n
s
f
o
r
O
u
t
a
g
e
s
(
G
l
o
b
a
l
d
a
t
a
)
9
B
u
s
i
n
e
s
s
C
o
n
t
i
n
u
i
t
y
i
s
a
w
i
s
e
i
n
v
e
s
t
m
e
n
t
•
Minimize business disruptions and quickly recover
•
Retain business model and increase market share and profits
•
Protect the organization’s value and reputation
•
Corporate governance and shareholder commitment
•
National requirements
•
Contractual commitments, Legal and regulatory compliance
•
Moral and social responsibilities
•
Demonstrate “best practice”
•
Reduce insurance liabilities
10
Lack of BCP is self goal
T
y
p
i
c
a
l
s
t
e
p
s
B
u
s
i
n
e
s
s
C
o
n
t
i
n
u
i
t
y
I
m
p
l
e
m
e
n
t
a
t
i
o
n
R
o
a
d
m
a
p
I
n
t
e
r
n
a
t
i
o
n
a
l
B
C
M
S
t
a
n
d
a
r
d
–
I
S
O
2
2
3
0
1
12
Clause 1
: Scope
Clause 2
: Normative references
Clause 3
: Terms and definitions
Clause 4
: Context of the organisation
Clause 5
: Leadership
Clause 6
: Planning
Clause 7
: Support
Clause 8
: Operation
Clause 9
:
Performance evaluation
Clause 10
:
Improvement
P
l
e
a
s
e
i
m
p
l
e
m
e
n
t
a
B
C
M
S
–
n
o
t
j
u
s
t
B
C
M
•
“Part of the overall management
system that establishes, implements,
operates, monitors, reviews,
maintains and improves business
continuity”– ISO 22301
•
Ensure continual improvement via
the PDCA cycle
B
C
P
i
n
t
i
m
e
s
o
f
C
O
V
I
D
-
1
9
COVID-19 is different from a typical Business Continuity situation
•
Much longer duration
•
No clarity on final resolution
•
Triggered not by damage to resources
•
Entire ecosystem is impacted
SOME POSITIVES
•
Realization by all
•
Even the PM asked entities to
implement Business Continuity
•
Tolerance – “It’s Ok”
•
Permanent mindset changes
S
u
g
g
e
s
t
i
o
n
s
f
o
r
p
r
o
f
e
s
s
i
o
n
a
l
s
•
Don’t stop now – complete the journey
•
Protect yourself against other new threats - implement the full BCM
cycle
•
Use this opportunity to create permanent BCM readiness and
awareness across all segments
•
Get your people ISO22301 trained and your organization ISO22301
compliant – or even ISO22301 certified
I
m
p
l
e
m
e
n
t
t
h
e
f
u
l
l
B
C
M
l
i
f
e
c
y
c
l
e
Choose
the
right
people
Provide effective
training in advance
of the
implementation
B
e
s
t
P
r
a
c
t
i
c
e
s
Customers
Citizens
Distributors
Shareholders
Investors
Owners
Insurers
Government
Regulators
Recovery Services
Suppliers
Competitors
Media
Commentators
Trade Groups
Neighbours
Pressure Groups
Emergency Services
Transport Services
Other Response
Agencies
Dependents of staff
THE ORGANIZATION
Top Management
Those who establish policies and
objectives for the BCMS
Those who set up & manage BC
Those who maintain BC Procedures
Owners of business
continuity procedures
Incident Response Personnel
Those with authority to invoke
Appropriate spokespeople
Response Teams
Other Staff
Contractors
B
u
i
l
d
c
u
l
t
u
r
e
a
c
r
o
s
s
a
l
l
I
n
t
e
r
e
s
t
e
d
P
a
r
t
i
e
s
.
.
B
u
i
l
d
C
u
l
t
u
r
e
v
i
a
T
r
a
i
n
i
n
g
a
n
d
A
w
a
r
e
n
e
s
s
Graph not to scale
Cost
Complexity
Risk
Assurance
Frequency
B
u
i
l
d
C
u
l
t
u
r
e
v
i
a
t
e
s
t
s
a
n
d
e
x
e
r
c
i
s
e
s
E
n
s
u
r
e
R
e
v
i
e
w
,
M
a
i
n
t
e
n
a
n
c
e
a
n
d
I
m
p
r
o
v
e
m
e
n
t
•
Maintenance
•
Advanced Testing and Exercising
•
Ongoing Awareness and Training
•
Internal Audit and Self Assessment
•
Management review
•
Supplier Review
•
Corrections and Corrective actions
•
Benchmarking
•
Continual Improvement
•
Instilling a BCM mindset
20
W
a
y
F
o
r
w
a
r
d
=
>
O
r
g
a
n
i
z
a
t
i
o
n
a
l
R
e
s
i
l
i
e
n
c
e
W
a
y
F
o
r
w
a
r
d
=
>
O
r
g
a
n
i
z
a
t
i
o
n
a
l
R
e
s
i
l
i
e
n
c
e
The ability of an organisation to absorb and adapt in a changing environment
(BCI GPG 2018/ ISO 22316:2017)
Q
u
e
s
t
i
o
n
s
?
23
LETS KEEP IN TOUCH!!
Dhiraj Lal, Executive Director +91 99101 10240
dhiraj.l@continuityandresilience.com
Thank You!
Explore the world of Business Continuity Planning (BCP) through the lens of best practices and challenges. Delve into the structured implementation of common sense strategies for ensuring operational resilience, particularly in times of crisis like COVID-19. Learn from the experiences and insights shared by industry expert Dhiraj Lal, Executive Director at Continuity & Resilience (CORE), as he guides you through the essential aspects of BCP. Gain valuable knowledge on how to navigate through disruptions and uncertainties effectively to safeguard your organization's continuity.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
LOGO Business Continuity Planning (BCP) - Best Practices and Challenges June 24, 2020
About the Speaker About the Speaker Dhiraj Lal Dhiraj Lal LOGO Dhiraj Lal, EXECUTIVE DIRECTOR, CONTINUITY & RESILIENCE (CORE) MBCI, CBCP, CBCI, ISO 22301 Technical Expert, CISA, ITIL, ISO 31000, ISO 27001 Lead Auditor A Chemical Engineer from IIT Delhi and MBA from IIM Calcutta, , Dhiraj Lal has over 20 years BCM experience and 32 years overall. He has worked with Citibank, Standard Chartered, Agilent and American Express, where he was the Program Sponsor and BCM Head. He is Asia s first BSI appointed Technical Expert for BS25999/ ISO 22301, and assessed 2 of the top 10 certified organizations globally. He teaches and consults in BCM (NCEMA 7000/ ISO 22301) and related domains. He has been invited to present at the BCI Annul conference in the UK, DRI US, BCMI Singapore, itSMF UK, DRI Asia in Malaysia, ISACA UAE, KSA and India, and also various Middle East Crisis, BCM and IT Resilience Summits in Abu Dhabi, Dubai, KSA and India Over 32 years in the industry. Ex BCM Sponsor and Head of American Express. Mix of experience as Practitioner, Trainer, and Consultant . BCI Approved Instructor. Over 15 years in BCM and related domains. Contributing Author to : The Encyclopaedia of Business Continuity, 3rd Edition Author of: Step by Step guide AE/SCNS/NCEMA 7000:2015. Implement BCM the UAE Way!
About Continuity & Resilience About Continuity & Resilience ISO 22301 Certified Management Consulting Firm LOGO Business Continuity Management Crisis Management IT Disaster Recovery Information Security Cyber Security Risk Management We Consult / Train / Assess and Certify in these domains We provide advisory services Automation tools BCM/ ITDR/ Mass Communication Workplace recovery E-Learning
Agenda Agenda LOGO Business Continuity Planning Business Continuity Implementation Roadmap BCP in times of COVID-19 Challenges and Best Practices
Business Continuity Planning Business Continuity Planning LOGO Planning to to continue the Business Not a new concept. A fancy name for common sense. In reality, we have been performing Business Continuity Planning for centuries But still, many organizations struggled to restart operations during COVID-19 So we need more than just common sense. We need a structured and formal implementation of common sense.
What we do not fully do in BAU common sense What we do not fully do in BAU common sense LOGO 1. Agree timelines, worst case and best case (MTPD and RTO) 2. Base it fully on facts and data (consequences of downtime) 3. Consultative process involving all interested parties 4. Comprehensive, documented and signed off 5. Communicate to all who need to know, including relevant third parties and service providers 6. Practice, Test & exercise. Review. Maintain & continually Improve Amazingly, this works !!
Challenges for cyber professionals Challenges for cyber professionals LOGO An uneven battle against an unknown enemy who has nothing better to do You have other matters to focus on but they have a single point agenda to damage You constantly focus on getting better and better - but so do they By the sheer law of averages, once in a while they will succeed At those times, your best best is to be able to restart fast and within minimum loss. So you need the world s best Business Continuity readiness Have you formally put in place the 6 Rs (Reduce, Respond, Recover, Resume, Restore Return)? When did you last practice them?
Challenges for cyber professionals Challenges for cyber professionals LOGO Economic Times, June 24 2020
Some reasons for Outages (Global data) Some reasons for Outages (Global data) LOGO Fire 6.6% Hurricane 7.2% Hardware error 5.6% Power surge 8.2% Earthquake 4.3% Network Outage 3.6% 3.5% Human Error Flood/Water 8.5% 2.5% Bombing 7.4% Others Including: Software Error 1.2% Employee sabotage 1.2% Burst water pipe 1.2% Miscellaneous 3.8% 11.5% Storm Damage 31.1% Power Outage 9 Source: Contingency Planning Research Inc.
Business Continuity is a wise investment Business Continuity is a wise investment LOGO Lack of BCP is self goal Minimize business disruptions and quickly recover Retain business model and increase market share and profits Protect the organization s value and reputation Corporate governance and shareholder commitment National requirements Contractual commitments, Legal and regulatory compliance Moral and social responsibilities Demonstrate best practice Reduce insurance liabilities 10
Business Continuity Implementation Roadmap Business Continuity Implementation Roadmap LOGO Typical steps
International BCM Standard International BCM Standard ISO 22301 ISO 22301 LOGO Clause 1 Clause 2 Clause 3 Clause 4 Clause 5 Clause 6 Clause 7 Clause 8 Clause 9 Clause 10 : Scope : Normative references : Terms and definitions : Context of the organisation : Leadership : Planning : Support : Operation : Performance evaluation : Improvement 12
Please implement a BCMS Please implement a BCMS not just BCM not just BCM LOGO Part of the overall management system that establishes, implements, operates, monitors, reviews, maintains and improves business continuity ISO 22301 Ensure continual improvement via the PDCA cycle
BCP in times of COVID BCP in times of COVID- -19 19 LOGO COVID-19 is different from a typical Business Continuity situation Much longer duration No clarity on final resolution Triggered not by damage to resources Entire ecosystem is impacted SOME POSITIVES Realization by all Even the PM asked entities to implement Business Continuity Tolerance It s Ok Permanent mindset changes
Suggestions for professionals Suggestions for professionals LOGO Don t stop now complete the journey Protect yourself against other new threats - implement the full BCM cycle Use this opportunity to create permanent BCM readiness and awareness across all segments Get your people ISO22301 trained and your organization ISO22301 compliant or even ISO22301 certified
Best Practices Best Practices LOGO Choose the right people Provide effective training in advance of the implementation Implement the full BCM lifecycle Right Commitment of Top Management Competency of all resources communication and tools Clearly defined roles, responsibilities, and authorities Continued management focus on the BCM Program
Build culture across all Interested Parties .. Build culture across all Interested Parties .. LOGO THE ORGANIZATION Customers Competitors Top Management Citizens Media Those who establish policies and objectives for the BCMS Distributors Commentators Those who set up & manage BC Shareholders Trade Groups Those who maintain BC Procedures Investors Neighbours Owners of business continuity procedures Owners Pressure Groups Incident Response Personnel Insurers Emergency Services Those with authority to invoke Government Transport Services Appropriate spokespeople Other Response Agencies Regulators Response Teams Recovery Services Suppliers Dependents of staff Other Staff Contractors
Build Culture via Training and Awareness Build Culture via Training and Awareness LOGO Group/ Audience Training Top Management Awareness, Crisis Management, Crisis Communication Core BCM Team CBCI/ Lead Implementer, Lead Auditor Core BCM Team Specialised courses (BIA, RA, Plan Writing, Testing etc.) Department Coordinator/ BC Champions Implementer, Internal Auditor Audit Team Internal Auditor, Lead Auditor All Employees Awareness
Build Culture via tests and exercises Build Culture via tests and exercises LOGO 7 6 Cost Complexity Risk Assurance 5 4 Cost Complexity Risk (of distrurabnce due Test) 3 Assurance Frequency 2 1 Frequency 0 Review/ Walkthrough Table Top Call Tree Graph not to scale Simulation IT/ Work Area Recovery Integrated
Ensure Review, Maintenance and Improvement Ensure Review, Maintenance and Improvement LOGO Maintenance Advanced Testing and Exercising Ongoing Awareness and Training Internal Audit and Self Assessment Management review Supplier Review Corrections and Corrective actions Benchmarking Continual Improvement Instilling a BCM mindset 20
Way Forward=> Organizational Resilience Way Forward=> Organizational Resilience LOGO The ability of an organisation to absorb and adapt in a changing environment (BCI GPG 2018/ ISO 22316:2017) Way Forward=> Organizational Resilience Way Forward=> Organizational Resilience
LOGO Questions?
LETS KEEP IN TOUCH!! LOGO Thank You! Dhiraj Lal, Executive Director +91 99101 10240 dhiraj.l@continuityandresilience.com image005 image007 image008 Twitter logo 23
