Business and IT Continuity: Overview and Implementation Principles

(Parts of this report constitute the deliverable defined in the ENISA Work Programme 2007 as “Report on Business Continuity risk analysis methods for SMEs”)

Conducted by the Technical Department of ENISA Section Risk Management

in cooperation with: Janet Beattie et al. - Glen Abbot Ltd.

February 2008

Risk Management

Legal Notice

Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless it is stated otherwise. This publication should not be construed to be an action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA Regulation (EC) No 460/2004. This publication does not necessarily represent state-of the-art and it might be updated from time to time.

Third party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external web sites referenced in this publication.

This publication is intended for educational and information purposes only. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic mechanical, photocopying, recording, or otherwise without the prior written permission of ENISA, or as expressly permitted by Law or under terms agreed with the appropriate rights organisations. Source must be acknowledged at all times. Enquiries for reproduction can be sent to the contact address quoted in this publication.

© European Network and information Security Agency (ENISA), 2008

Editors: Simone Balboni, Louis Marinos ENISA Technical Department – Section Risk Management

Document Revision: 1.51

______________________________________________________________________ ENISA 2

Risk Management

Executive Summary

This report is an ENISA deliverable in the area of Risk Management as foreseen in the ENISA Work Programme 2007 (item 2.2.4). The report elaborates on continuity risks and contains an overview of numerous Business Continuity models. The report addresses open issues identified in previous ENISA reports on Risk Management [ENISA RM]. Moreover in various events and discussions the need for an overview on Business Continuity has been communicated by both experts and non-experts.

The field of Business Continuity has been attracting increasing attention because it greatly contributes to the quality of services and to the resilience of systems and processes. Many good practices, regulations and recommendations underline the importance of Business Continuity for all organisations, especially for those which rely on IT systems to implement their business processes.

The purpose of this document is to provide information on and generate awareness of the important topic of Business and IT Continuity. Our main objective is to offer solutions to the following general problems encountered in the area of Continuity Management:

• missing overview on the contents and structure of methods, tools and good practices; • absence of a “common language” in the area of IT Continuity Management to facilitate communication among stakeholders and • lack of surveys on existing methods, tools and good practices.

• Furthermore this updated version includes an inventory of methods and tools: similar to the work on Risk Management / Risk Assessment inventory, this deliverable is the basis for an inventory in the area of Business Continuity methods and tools.

Based on the overview presented in this report ENISA is going to:

• Perform a survey on the usage of continuity measures in e-communication: during 2008 ENISA plans to survey e-communication providers in order to assess continuity controls and technologies used to guarantee the resilience of networks. • Develop an approach to IT continuity that can be used within micro enterprises and SMEs: in the future ENISA plans to develop an approach to Business and IT continuity that can be utilized by non experts within small enterprises.

Editors’ contact details: ENISA Technical Department – Section Risk Management Dr. Simone Balboni, National Expert Seconded by the University of Bologna Dr. Louis Marinos, Senior Expert Risk Management e-mail: 0HRiskMngt@enisa.europa.eu

______________________________________________________________________ ENISA 3

Risk Management

1 Introduction

This report has been written to fulfil the objective of the European Network and Information Security Agency (ENISA) to: “Promote Risk Assessment and Risk Management methods to enhance the capability of dealing with network and information security threats” [ENISA Regulation]. As continuity risks are considered to be amongst the most important faced by many organisations and businesses, ENISA decided to invest its efforts in the promotion of methods, tools and good practices for continuity management. As the main focus of the Agency is on Network and Information Security, the context of this work will be on Information Technology and closely related areas.

Business processes are increasingly linked together via information and communication technology. This is accompanied by increases in the complexity of the technical systems and with a growing dependence on the correct operations of the technology (BSI Standard 100-2: 2005) [IT Grundshutz].

Through an organisation’s Risk Management process0F it is likely that continuity risks will be identified. These risks can be managed to reduce their likelihood and/or impact, but it may be necessary to have plans in place to deal with the effects of the risk should it occur.

Business Continuity is the term applied to the series of management processes and integrated plans that maintain the continuity of the critical processes of an organisation, should a disruptive event take place which impacts the ability of the organisation to continue to provide its key services. ICT systems and electronic data are crucial components of the processes and their protection and timely return is of paramount importance.

Business Continuity (BC) is now recognised as an integral part of good management practice and corporate governance.

The need for Business Continuity has expanded in recent years following incidents (malicious, terrorist attacks and environmental disasters) which have disrupted large enterprises and forced many smaller ones to cease trading. Government legislation e.g. Sarbanes-Oxley [SOX] in the US, Bill 198 in Canada [BILL 198] (both target the private sector), the Civil Contingencies Act (2004) [CC ACT] in the UK and the Presidential Decision Directive 67 [PDD 67] in the USA (necessitating the need for Continuance of Government), state the requirement for Business Continuity although they do not detail a particular methodology.

Regulatory bodies also influence the requirement for BC, for example the regulations of the Finance Services Authority [FSA] in the UK state the acceptable period for call centres to be unavailable, letters unanswered, etc. There are many similar financial bodies throughout the world, each have their own regulatory requirements. In Australia this led to the requirement for APS232 [APS 232].

Financial benefits are also evident as an incentive to widen the practice of BC. In some parts of the western world, insurance companies offer discounts when BC plans are in place. With Business Continuity Management (BCM) penetration lower than 20% in Japan, despite the frequent natural disasters, the Development Bank of Japan offer a Disaster Prevention Loan with reduced interest rates, to be used to plan BC programmes, to prepare facilities to reduce the effects of a disaster or to provide backup ICT services.

See [ENISA RM] and in particular http://www.enisa.europa.eu/rmra/rm_process.html ______________________________________________________________________ ENISA 8

Risk Management

Reflecting this upsurge in interest there are a number of emerging standards (and overlapping standards) in the area of Business Continuity Management. With a choice of different terminologies and areas of overlap a company must adopt one specific methodology and apply it throughout the organisation.

Factors such as human resources, financial and technological limitations and regulatory constraints will shape the strategy and drive the eventual solution. With an increasing reliance on ICT in all areas of our lives this becomes an important part of the solution. The term “Disaster Recovery (DR)” has over many years migrated from its true meaning within business to a response to an ICT problem or failure. ICT departments provide DR Plans to recover important systems within a reasonable timescale in accordance with a Service Level Agreement but this rarely meets the end-user’s expectations based on their BC requirements.

These issues and overlaps are being addressed in the latest standards and frameworks but this evolves into a complex web of procedures and policies e.g. ITIL [ITIL] is a Framework for Information Technology (IT) infrastructure with v2 being divided into 9 areas; while the idea is to utilise the areas relevant to the organisation, the existence of relationships among the areas means that taking one and not another could create deficiencies. This is also reflected in standards, where the relationships are now starting to be defined. For example, PAS 77 IT Service Continuity Management [PAS 77] acknowledges the need for Business Continuity Management (BCM) before IT Services Continuity (ITSC) plans can be developed. It also states that if there is no BC in place then a subset of the Business Impact Analysis (BIA) must be completed in order to understand the business requirements and to align IT services to business requirements.

Emerging standards (and existing ones which are evolving) reflect their roots and so the target audience for each must be known to best understand their basis. The American standard NFPA 1600 comes from the National Fire Protection Association [NFPA] and is the standard on Disaster and Emergency Management and Business Continuity Programs. Early versions are more about saving the environment than IT but the latest version (2007) moves towards BC. This contrasts with BS 25999-1, which was written purely as a BC standard to enable businesses to recover from incidents ranging from minor (outage of a few hours) to a major incident requiring relocation of services [BS 25999-1].

A number of frameworks in this area identify a purely IT aspect of BCM referred to as IT Service Continuity. IT Service Continuity Management (ITSCM) is a discipline which has evolved from IT Disaster Recovery (ITDR) but is more customer-centric. The paradigm is similar, but the underlying assumptions made by ICT as to priorities, timescales and important components are replaced with accurate data from the business units. ITSCM is the control which transforms ICT into a pro-active service organisation, meeting the needs of its customers, understanding their requirements and fulfilling these requirements. In the event of an incident the plans and systems in place should ensure a resumption of service within the agreed Service Level Agreements (SLAs) ensuring compliance and customer satisfaction as well as aiding in Business Continuity.

This report utilises knowledge of many different methods, represents them on a Business Continuity overview process diagram and then compares the methods through individual process diagrams and entries in an inventory. This allows the readers to assess their suitability for use within their own organisation. Moreover, it provides an orientation for the target audience who would like to have an overview on the state of art of methods and good practices for continuity and who would like to properly apply existing approaches to their organisation.

______________________________________________________________________ ENISA 9

Risk Management

2 Scope

This report will provide an introduction to establishing a Business Continuity Management process within an organisation in order to mitigate the technology and information continuity risks identified as part of Risk Management.

In order to maintain availability of IT and information the organisation needs to understand:

• which processes are critical; • how quickly they must to be restored; • what are the IT and information required in order to keep these critical processes running.

Using this information, ICT and Information Security (IS) professionals are able to determine the actions that must be performed to ensure that the IT and information requirements of the critical processes can be met, despite a disruptive event. This includes ensuring that the ICT and IS staff are available within the required timeframes and the identification of an alternative site(s) from which to work should it become necessary. This information is detailed within the Business Continuity Plan (BCP).

Once ICT and IS are operational again, the operational teams will be able to work from their IT Service Continuity Plan to restore the critical IT components and information required to support the critical processes.

This report does not address the continuity of the critical processes themselves but rather the continuity of ICT and IS that is needed to provide the critical processes with their technology and information requirements following an incident. This is represented in the figure below.

______________________________________________________________________ ENISA 10

Risk Management

Within the organisation Business Units may have a number of critical processes which each have a time period within which they must be recovered in order to meet the organisational objectives. This time period is known as the Recovery Time Objective (RTO). Most critical processes will have a dependency upon IT in order to function, therefore the IT components upon which they depend will also need to be recovered within the Recovery Time Objective. Without information or data the critical process will not be able to operate and the point in time to which this can be recovered is known as the Recovery Point Objective (RPO). The RTO and RPO are shown as green and blue arrows in Figure 1. These requirements for availability of IT and IS feed into the IT Service Continuity Strategy and drive the overall architecture of ICT and the IT Service Continuity Plans.

The Business Continuity Plans which detail the method of recovery of the critical processes are out of scope of this report, but the IT and IS requirements of those critical processes are within the scope of this report as IT Service Continuity Management (ITSCM) is determined purely by the requirements of Critical Processes. This covers a number of interdependent IT components such as hardware, applications, databases, networks and pre-requisite software. The chain of dependencies determines the prioritised order of recovery and timescales for recovery. If outages are recovered within the approved timeframe, IT outage events will not trigger Business Continuity events.

In order for ICT to be available to recover the required IT and IS in accordance with the IT Service Continuity Plan and within the agreed RTOs and RPOs, ICT need to be operational themselves. The continuity of operation of ICT is covered by their own Business Continuity Plan, which defines their requirements for recovery in terms of technology, equipment, materials, people, premises and critical suppliers. If ICT do not have a Business Continuity Plan, it is unlikely that the critical processes IT and IS dependencies could be recovered if the incident also impacted ICT. Business Continuity Planning for ICT is within the scope of this report and is shown at the bottom of the diagram, where their RTOs and RPOs are not only driven by the requirements of the Business Units, but also by the recovery capabilities. In order for an effective IT Service Continuity Strategy to be developed, the Business Units and ICT need to work together at this point to develop a strategy which not only meets the requirements of the organisation, but is also within the capabilities of ICT. This is discussed further in this report.

Specific technical procedures for IT system recovery – usually contained in the IT Service Continuity Plan - are not developed in detail in this report, and more information can be found within standards and guidelines such as PAS 77, NIST 800-34, ITIL v3 and COBiT v4 [COBIT]. However, the interfaces between the Business Continuity Plan and the IT Service Continuity Plan are extensively covered in this report.

Whilst this report focuses on Business Continuity, it concentrates on ICT, on the relationship of IT Service Continuity to Business Continuity, and on the importance of considering both together (and not each in isolation) to achieve a successful, integrated recovery from an incident. The methodologies described in PAS 77, ITIL v3 and COBiT v4 all state that BCM should be in place before ITSC can be achieved. If it is not, then BIAs must be performed by the Business Units in order to provide ICT with a business view of the IT requirements. The results of the BIA study are recorded in a report which is then transferred from BCM to ICT. This report is referred to in the present document as the IT Requirements document.

______________________________________________________________________ ENISA 11

Risk Management

The present document shows the relationship between BCM and RM, where BC is seen as a method of Risk Treatment to mitigate continuity risks. These risks are either treated in a proactive or reactive manner. Proactive controls implement agreements and systems in place to deal with the effects of a disruption. These can take the form of an agreement with a Work Area Recovery Facility (WARF), a clustered server with UPS and RAID disks or simply having a second telephone line installed. Business Continuity Plans are developed for a reactive response.

HB 292-2006, the Australian Handbook for Business Continuity practitioners [HB 292- 2006], advocates a proactive approach to Business Continuity where the BCM practitioner works closely with the risk managers so that much of the Risk Assessment for BCM is undertaken by others, providing more quality input into the process. This means that treatment of disruption events become a focus and ‘the (BCM) practitioner can lead the creation of proactive improvements in capabilities in resilience’. It goes on to state that the contents of the standard have a strong emphasis on conducting a robust Risk Management process as part of BCM.

A number of standards use a proactive and reactive approach to Risk Management and the mitigation of continuity risk e.g. NIST 800-34, BS 25999-1 and Business Continuity Institute Good Practice Guide [BCI GPG]. In this report we consider only the reactive controls as the proactive ones are mitigated in the classical Risk Management activity leaving Business Continuity to address the risks which cannot be successfully mitigated or treated as well as those that arise as a result of an incident. More detail is given in Section 312H7.1.

______________________________________________________________________ ENISA 12

Risk Management

3 Assumptions

In writing this report, the following assumptions have been made:

• Any Disaster Recovery Plan contains the procedures for restoring IT components, telephony and information following a disruptive event. • Information refers to electronic information e.g. application files, data within databases, data on CD, DVD or memory stick etc. • ICT and Information Security are functions. As such, they are not necessarily managed by a single department (ICT). • Preventative risk controls (proactive measures to reduce the likelihood of a disruptive event) are outside the scope of this document. Instead, they are fed back into the classical Risk Management model.

______________________________________________________________________ ENISA 13

Risk Management

4 Approach

To ensure that no standard has been given an unequal priority within the review process for this document the following methodology was adopted:

• Evaluate a number of standards from different parts of the world to see how they relate to BC and ITSC; • Develop a generic Business Continuity Management process to show activities including how they flow; • Integrate this result with the existing ENISA process model on Risk Assessment and Risk Management.

In compiling this report, various standards, handbooks and good-practice guides related to Business Continuity, Information Technology Service Continuity, Risk Management and Information Security were evaluated (see 313HBibliography).

An overview Business Continuity process (see 314HFigure 7) was developed which represents most of the Business Continuity methods available at present, while remaining independent. The language used fits all current methods rather than being aligned with any one method in particular.

It was felt that the existing Risk Assessment model [ENISA RM] could be utilised for BCM since it is important to show the relationship between Business Continuity and Risk Assessment. Since Business Continuity is risk-based the model appears to fit at many levels. The block diagram was then developed and the interfaces and overlaps were discussed (see 315HFigure 8).

______________________________________________________________________ ENISA 14

Risk Management

5 Structure and target groups of this document

The structure of the present document is illustrated in 316HFigure 3.

The intended target group for the present document is Information Security and Information Technology experts. It focuses on how to write a Business Continuity Plan (BCP) to protect ICT or Information Security in the event of an incident which threatens their ability to provide their services to the rest of the organisation. The general overview of BCM also provides background to anyone writing a Strategy/Plan. In addition it addresses the interfaces among Business Continuity and Risk Management.

The structure of the document is not intended to be used as step by step instructions for conducting any of the activities described herein, but it is intended to provide an overview of a complete process.

The main body of the report draws on various worldwide standards, good practices and the experience of the authors to describe the main principles of Business Continuity Management. These main principles are summarised in an overview process diagram while the various standards that can be used to assist individuals in writing a BCP are illustrated in the process maps appended to the document.

Also appended to this report are two templates that will serve as a basis for the generation of an inventory of methods, tools and good practices for Business Continuity. They will be used later on to generate a survey on existing methods, tools and good practices in this field. The purpose of each template is to represent all necessary information required for the inventory entries. This information includes the main features of the methods and tools available and how they may best be used to assist an organisation in writing a BCP. Each method and tool has its own particular strengths.

______________________________________________________________________ ENISA 15

Risk Management

Accordingly the inventory compares and contrasts these tools and methods to ensure that those most appropriate to the organisation’s needs will be selected.

A 317HGLOSSARY provides an explanation of the BC terminology used both in this document and in the standards and good practices used as a basis for this document. Where there is more than one term for the same entity it is cross-referenced.

To assist further with Business Continuity planning a list of useful web-site links has been appended in addition to the Bibliography (see Section 318HWebsites).

Although the document appears to be aimed at larger organisations with separate ICT and IS departments, and several sites, it is equally relevant for firms defined as Small to Medium Enterprises (SMEs). Their plans will obviously be simpler since the roles and responsibilities and membership of the Operational Team may well amount to a single person rather than several individuals. Some plans may also be combined and sections irrelevant to the organisation deleted.

Appendix A outlines an initial framework for the BCM approach for SMEs. ENISA will elaborate on this document to develop it into a full fledged approach for SMEs.

Appendix B provides a simple example of a BCM Policy.

______________________________________________________________________ ENISA 16

Risk Management

6 Business Continuity and its interface with related disciplines1F

Corporate Governance is concerned with improving the performance of companies for the benefit of shareholders, stakeholders and economic growth. It focuses on the conduct of, and relationships among, the Board of Directors, Managers and Shareholders. It generally refers to the processes by which organisations are directed, controlled and held to account. It encompasses authority, accountability, stewardship, leadership, direction and control exercised within the organisation [HB 254-2005].

The Australian Stock Exchange has developed ten core principles which underlie sound corporate governance, one of which is recognising and managing risk. According to HB 254-2005, the integration of a Risk Management processes into an organisation’s corporate governance framework has the following advantages:

• More effective strategic and operational planning • Greater confidence in achieving planned operational and strategic objectives • Greater confidence in the decision-making process • Greater stakeholder confidence and enhanced capital-raising • Director protection • Enhanced operational resilience (and continuity)

Risk is present in all decisions and activities undertaken by organisations and a number of these will present continuity issues. The approach to managing these continuity risks is twofold:

1 Pro-actively manage the risk, as part of the organisation’s Risk Management process on an ongoing basis to lessen the likelihood or impact of an incident. The Business Continuity process itself can highlight further risks, which will themselves become part of the Risk Management process.

2 Implement a Business Continuity Management process to treat residual risk. Business Continuity Management should be conducted as one of the required outcomes of the Risk Management programme. Both BS 25999-1 and the Draft for Public Comment BS 31100 – Code of Practice for Risk Management [BS 31100 DPC] – states that Business Continuity is one of the ways of modifying risk to lessen the impact if the risk occurs; especially in cases where avoiding, transferring or accepting the risk are not appropriate risk treatments. This could be considered a reactive method of managing risk.

ISO 27001:2005 - Annex A [ISO 27001] calls for Business Continuity Management, as a method of risk treatment, to be considered as a measure to counteract interruptions to business activities and to protect critical business processes from the effect of major failures of information systems or disaster as well as to ensure their timely resumption.

It is very difficult to isolate all the disciplines related to planning for and recovering from an incident which threatens an organisation either from an internal or external source. All the disciplines are closely related and there are areas of cross-over, where it is difficult to implement one plan without the other. For instance if an external incident resulted in a large-scale evacuation, the BCP would not be effective in helping to restore critical activities if the Emergency Plan had not been put into action, staff were not accounted for, the area made secure and the damage assessed. ______________________________________________________________________ ENISA 17

Risk Management

A further comparison of Risk Management and Business Continuity Management is given in 319HTable 1.

Risk Management Business Continuity Management

Key Method Risk Analysis Business Impact Analysis Key Parameters Impact and Probability Availability and Impact Type of incident All types of events Events causing significant business disruption Size of events All events affecting the Those threatening availability organisation of organisation’s core processes Scope Focus primarily on Focus mainly on incident management of risks to management and recovery of core business objectives, critical business processes to prevent or reduce following an incident incidents Intensity All, from gradual to Sudden or rapid events sudden (although response may also be appropriate if a creeping incident suddenly becomes severe)

Business Continuity Management is concerned with managing risks to ensure that at all times an organisation can continue operating at least to a pre-determined minimum level. The BCM process involves reducing the risk to an acceptable level and planning for

______________________________________________________________________ ENISA 18

Risk Management

the recovery of business processes should a risk materialise and a disruption to the business occur.

Disaster Recovery Planning is concerned with the actual technical recovery of the IT components and details the procedures to be used to restore the IT components following a failure. As the plan is devised by ICT without the knowledge and understanding of business units as to their IT requirements, it is an orderly but nonprioritised recovery process. The Disaster Recovery Plan will not be discussed in this document, but its existence is mentioned for completeness.

Information Technology Service Continuity Management (ITSCM) ensures that information technology technical and services facilities (including computer systems, networks, applications, telecommunications, technical support and service desk – referred to as IT components throughout the remainder of this document) can be recovered within required and agreed business timescales. ITSC Management should be part of the overall BCP and not dealt with in isolation (PAS 77: 2006). The major difference between DR planning and ITSCM is that the user requirements drive ITSCM their recovery time objectives and agreed recovery sequence (taken from dependencies and RTO for applications). This enhances the service as it focuses the recovery effort on the Business Continuity requirements and reduces disruption to the critical processes.

Definitions of the various risk-related disciplines are given in 320HTable 2.

Risk discipline Description

Corporate Governance The system by which entities are directed and controlled [HB 254-2005] Risk Management Process of enhancing an organisation’s likelihood of success in achieving its objectives [HB 254-2005], [BS 31100 DPC] IT Risk Management The process, distinct from Risk Assessment, of weighing policy alternatives for the safeguard of data assets and IT systems in consultation with interested parties, considering Risk Assessment and other legitimate factors, and selecting appropriate prevention and control options. (ENISA) Business Continuity BCM assures the availability of processes and Management resources in order to ensure the continued achievement of critical objectives [HB 293-2006] IT Service Continuity Supports the overall Business Continuity Management Management process by ensuring that the required information technology components can be recovered within required, and agreed, business timescales and in the agreed order of priority, from data extracted from the BIAs. The underlying recovery procedures can then be prioritised to effect recovery in a timely fashion [PAS 77] Disaster Recovery Disaster Recovery Planning refers to an IT-focused Planning plan designed to restore operability of the target system, application, or computer facility. The scope may overlap that of an IT Service Continuity Plan; however, the DR Plan is narrower in scope as it does not address the requirements of the business (based on [NIST])

______________________________________________________________________ ENISA 19

Risk Management

The relationships among Corporate Governance, Risk Management, Business Continuity Management, IT Service Continuity Management and Disaster Recovery Planning are complex since some can exist without the others. 321HFigure 5 on the following page tries to explain the relationships, should they co-exist.

BCM overlaps with Risk Management (see 322HFigure 5), and one of the areas of convergence is Business Impact Analysis. If ITSCM is in place, it utilises some of BIA’s information in order to achieve Continuity Management and align it with the needs of the business. That is the only information which BCM and ITSCM have in common. ITSCM uses this information in order to prioritise the plans developed through DR Planning.

If ITSCM does not exist within the organisation then DR Planning is the pro-active risk mitigation function of Risk Management and although it impacts BCM and can be invoked by a BCM event it is not part of BC. Similarly, ITSCM can exist without BCM but requires a subset of BIA information so the Business must conduct BIAs in order to ascertain the necessary information. If there are no DR Plans then these must also be developed. DR Planning is an essential part of ITSCM. Although it may not exist when originally developed it must be in operative if ITSCM is to be considered complete. In a similar way, BCM cannot exist without BIA information.

Risk Management and Business Continuity need to be considered as an integrated whole together with IT Service Continuity and Information Security. The successful implementation of a robust Business Continuity Plan is dependent upon having a tried and tested ITSC Plan in place which improves the technological resilience of the organisation. This requires the presence of procedures for restoration should any part of the IT infrastructure fail.

Not only should the Business Continuity Plan consider the IT requirements of the business processes within the organisation, and how ICT will organise themselves to restore services to meet the business requirements following an incident, but the Business Continuity Plan must consider the information requirements. BS 7799-3 [BS

______________________________________________________________________ ENISA 20

Risk Management

7799-3] states that one of the most valuable assets of an organisation is its information which needs to be protected whatever its form. Information assets, which can be databases, contracts, user manuals and training materials, or other types of information, are stored on or used by other assets and these may be defined as:

• Processes and services • Software • Physical items • Personnel

Information Security (IS) must be able to recover its own processes following an incident in order to be able to restore the business processes’ information requirements. Interdependencies will exist between ICT and IS and the two will need to work together to ensure an integrated approach which meets business needs.

There are other security disciplines related to Business Continuity which are described in the following paragraphs and illustrated in 323HFigure 6.

Emergency Planning: Emergency planning is a process resulting in a set of agreed procedures to prevent, reduce, control, mitigate and take other actions in the event of a civil emergency which impacts the organisation [BS 25999-1].

Incident Response: Incident response is the immediate response to an incident usually within the first few hours of occurrence. It is an important phase in which control should be gained of the incident, the impact assessed, personnel made safe and key communications made to staff, public, stakeholders and the media. If control is not gained at this stage it is extremely difficult to implement effective incident management thereafter (Glen Abbot).

Incident Management: Incident Management is the process of taking central command and control of an incident which threatens the operations, staff, stakeholders or reputation of an organisation. The incident management team ensures that staff are able to restart their critical processes and communications are made internally and externally (Glen Abbot).

BCM

______________________________________________________________________ ENISA 21

Risk Management

7 The Business Continuity Process

7.1 Overview of the Business Continuity Process

The presentation of Business Continuity Management processes in this chapter is a consolidated overview of relevant content found in the corresponding literature (see Bibliography). As mentioned above (see Approach), various standards, handbooks and good-practice guides related to Business Continuity, Information Technology Service Continuity, Risk Management and Information Security were evaluated to derive the process model overview. It then presents most of the Business Continuity methods available at present, while remaining neutral. The language used fits most current methods rather than being aligned with any one method in particular.

In the present document Business Continuity is considered to be the umbrella under which take place several processes/activities related to the identification, mitigation, management and control of continuity risks, as well as the governance of such a project inside an organisation. For the sake of the presentation, an integrated view of Business Continuity is presented in terms of a “big picture”, i.e. the six processes and their activities (see 324HFigure 7). Furthermore, this figure shows possible interfaces among the processes presented.

Recurrence is a measure of how often the BCM tasks should be performed. Short term tasks should be carried out more often as they go out of date easily (e.g. training), while long term tasks are more enduring and do not need to be reviewed as often.

Business Continuity Management is considered as consisting of the six main processes shown in the figure above: Define a Business Continuity Management framework, Conduct of Business Impact Analysis, Design of a Business Continuity Management approach, Deliver Business Continuity Plans, Test of Business Continuity Plans, Sustain Business Continuity Management Programme.

______________________________________________________________________ ENISA 22

Risk Management

The content of these processes is outlined in the following paragraphs with a short description. A more detailed description can be found in Section 325H8-326H13.

The ideal sequence for the performance of the process of Business Continuity is to start with the definition of a Business Continuity Framework which defines the overall Programme Governance. The tasks should be undertaken in the sequence indicated in the figure above by the cyclic arrow.

It is found however that some organisations don’t follow this best practice approach while implementing their Business Continuity programme. For example some commence the programme at the Business Impact Analysis stage and therefore not defining in advance a Business Continuity Policy or the roles and responsibilities of the people involved in the project. This approach is not ideal as it often leads to significant delays due to the difficulties in decision making caused by the lack of clearly defined roles and to the lack of ‘buy in’ from the senior management. There will be a low level of awareness throughout the organisation leading to poor incident management and out of date plans because they are not maintained. Often plans won’t even be developed for some areas of the organisation.

Other organisations will attempt to write Business Continuity Plans without carrying out Risk Assessments or Business Impact Analysis, which leads to plans which do not address the areas of continuity risk and which do not aim to recover the only the critical processes in order of priority. This leads to an ineffective recovery as valuable resource is wasted bringing resource back up which is not required.

Without detailed analysis it is not possible to develop a Business Continuity Strategy which meets the objectives of the organisation and where the solution does not cost more than the impact of the event.

7.1.1 Define BCM framework

In order to implement successful Business Continuity Management within an organisation, it must first be initiated as a project, including well defined project structure, scope, objectives and deliverables aligned with the business strategy and the risk appetite. It is essential for the success of the project that the senior management team endorse the project and provide support to it at all times.

Once the Business Continuity project has been established, and in order to be able to commence development of the suite of Business Continuity Plans, it is essential to understand the organisation with respect to its mission critical activities or services, its organisational structure, roles and stakeholders.

This understanding aids the development of continuity plans that will support the strategic needs of the organisation, ensure that key internal and external customer needs can be met and also protect the safety and welfare of staff.

7.1.2 Conduct Business Impact Analysis

Once the mission critical activities or services of the organisation have been identified, the purpose of Business Impact Analysis (BIA) is to formally define the business critical processes of the organisation, their resource requirements, technology risks and loss impacts they face. Moreover through BIA specific IT components are correlated with the critical processes that they support and based on that information, the consequences of a disruption to the components on the critical processes are characterized.

______________________________________________________________________ ENISA 23

Risk Management

The technology risks thus identified will contain enough information to produce the IT Requirements report. This should include not only the technological components (specific hardware, applications and peripherals which in turn point to infrastructure, servers, databases and networking components) but also the specific Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) required by the business units for their critical business processes. The definition above relates to two different objectives. The BIA gathers ‘process RTO’, the recovery time objective for the process as a whole. In order to achieve this objective there is a critical path of underpinning components. The latter must be recovered in a shorter timeframe in order to achieve the process RTO. Throughout the remainder of this document the timeframe to recover such underpinning components will be referred to as the ‘component RTO’.

The process RTO specifies the critical processes’ desired recovery time and the ITSC Plan will need to consider the actual RTOs for all dependent components (e.g. infrastructure, server build, network connections, data restore) in determining how or whether it is possible to achieve an overall RTO which meets the requirements of the business.

The RPO specifies the recovery period for data, e.g. no more than 24 hours of data can be lost. This is a trickier metric since it is a checkpoint in time which may require that database checkpoints, transaction logs or write-through disk data, more frequent backups, and all the associated recovery procedures are carried out in a timely and consistent fashion.

7.1.3 Design BCM approach

Once the processes have been prioritised and the critical technology infrastructure, hardware, software and information resource needs of the processes which depend upon IT have been identified, it is necessary to design the way in which recovery from an incident can be effectuated. Given the requirements and the various methods of recovery, decisions must be made as to how recovery may be best achieved. Factors such as budget, manpower and compliance will drive the decision making process. A list of options can be drawn up and weighted to aid decision making. For this reason, the management of the organisation will be asked to accept both the risks treated and the ones that will not be treated. This can happen within the activity “Risk Acceptance” of the IT Risk Management process (see 327HFigure 8).

7.1.4 Deliver BCP

A Business Continuity Plan is not one document but rather a whole suite of documents which integrate to form the organisation’s response to an incident from the moment of impact to near normal recovery of the organisation. Everyone who is responsible for recovery actions will work according to their specific recovery plan.

7.1.5 Test BCP

This area of BC ensures that the Business Continuity Plan is adopted by the whole organisation and is viable and workable. Testing verifies that the plan actually meets its objectives whilst training allows staff involved in the recovery of the business to gain experience in their roles. Plans must be kept up to date and regularly reviewed and retested.

7.1.6 Sustain BCM programme

BCM is not a static or point-in-time solution. In order to ensure that it is current, it will be necessary to implement an on-going maintenance regime and internal communication. BCM cannot be effective if staff are unaware of the existence of plans or if those with roles to play are unsure of their roles, of what is expected of them and where to find information. This requires the training of BCM staff and awareness by all. ______________________________________________________________________ ENISA 24

Risk Management

It is important that strict change control and maintenance regimes are in place and that the identified updating tasks are performed regularly and in a regulated manner.

7.2 Relationship between IT Risk Management and Business Continuity

As mentioned previously, Business Continuity Management has an inseparable relationship with Risk Management. Traditional thinking has positioned Risk Management as a tool to be used within Business Continuity, whereas more contemporary thinking sees Risk Management as a broad philosophy looking at understanding uncertainty, informed decision making and managing surprise in the achievement of objectives. This thinking also views BCM as an integral part of the broad field of Risk Management, a part that considers the management (both pre- and post-incident) of those risks which may result in disruption to the organisation [HB 292-2006].

HB 292-2006 goes on to include the following among the benefits of this more contemporary approach to Risk and Business Continuity:

• a more comprehensive consideration of risk within the BCM process • improved integration between BCM and Risk Management activities which in turn includes: - improved flow of risk related information; - a better understanding of the requirements of both activities; - a reduction in repeated demands for the same sets of information; - an organisational focus on priority risks including those related to Business Continuity; - a more cost effective use of resources; - an improved focus of BCM activity on business improvement rather than reactive planning only.

328HFigure 8 shows the overlap between the Risk Management process and the Business Continuity process, where the definition of the framework for the Business Continuity Management could be carried out as part of the definition of the Risk Management framework. Conducting a Business Impact Analysis is an extension of assessing risk and the two tasks can be carried out simultaneously as a way of gaining complete insight into the risks faced by the organisation, the likelihood of them occurring and the impact upon the organisation’s ability to continue to operate. However, further work is required during this stage of Business Continuity to determine the resources required by the critical processes and the timescales for recovery should there be an incident which prevents normal operation.

When determining the strategy for recovery it is likely that further risks relating to continuity of operation will be highlighted. These are then fed back into the Risk Management process (see pink arrow labelled “Acceptance of continuity risks”). Decisions are taken whether to accept the risks or develop an action plan to treat the risk. This may then feed back into the Business Continuity process.

The stage of Risk Treatment in the Risk Management process determines the action to take to avoid, share, retain or modify the risk. One method of modifying risk is to lessen its impact by implementing a plan for continuity: this is shown in the pink arrow labelled “Controls for Continuity”.

329HFigure 8 represents the classical approach to Business Continuity, where Business Continuity is seen as a way to cover residual (continuity) risk only and is therefore not seen as a preventative control. This view is presented in BS 25999-1 and FEMA 141 [FEMA] and is discussed further in this report.

______________________________________________________________________ ENISA 25

Risk Management

Other standards present a more integrated approach to Risk Management and Business Continuity, where preventative controls are part of Business Continuity Management. These standards include HB 292-2006, NIST 800-34 and NFPA 1600.

uit tin c o ks nc ls ty ta tro ui ep in on cc nt C A co

The figure depicting the Risk Management process has been taken from a previous ENISA deliverable [ENISA RM]. ______________________________________________________________________

Risk Management

8 Define BCM framework

safeguard the interests of key stakeholders, Define BCM as well as the reputation, brand and value-

Initiate BCM Programme creating activities [TR 19:2005] of an

organisation.

Where BCM is being implemented for the first time in an organisation, it is advisable to treat the implementation as a project.

The project should be managed in line with the organisation’s normal project management methodology [COBiT].

In order to manage and maintain BCM within the organisation, personnel must be appointed who will be responsible for defining and managing the complete BCM programme.

The next step is to ensure that a BCM Policy is defined which is appropriate to the nature, scale, complexity, geography and criticality of the business processes and that it reflects the culture, dependencies and operating environment. The Policy should also consider budget availability, time constraints, regulatory aspects, deadlines and the source of the Business Continuity expertise [HB 221:2004] Definition of the BC Policy is essential before the development of the BCP can commence since it forms the foundation for the rest of the work and for the continued viability of BCM (see example in Appendix B).

The BCM capability should be integrated into the organisation’s change management process so that it is incorporated into the growth and development of the organisation’s products and services [BS 25999-1].

During this stage of the BCM programme consideration should be given to the personnel who will form part of the organisation’s response and recovery teams during and after an incident.

8.1 Initiate a BCM programme

When implementing a BCM programme for the first time in an organisation, project management disciplines should be adopted, which define clear deliverables, budgets and timescales.

Once the BCM programme has been established and the key elements are in place, further work programmes are likely to develop as the maintenance, testing, training and review cycle get under way and the BCP evolves.

Initiating the programme should include:

• Goals and objectives of strategic and operational activities of BCM • Identification of deliverables and outcomes • Timescales and deadlines • Constraints • Budget and work effort control • Resourcing capabilities

______________________________________________________________________ ENISA 27

Risk Management

There are several project management methods, some of which have software support. The method selected should be appropriate to the size and complexity of the organisation.

8.2 Identify the organisation

So that ICT and IS can prioritise and manage their recovery activities they need to understand the requirements of the rest of the organisation. The scope of the BCM programme will assist in identifying the key business areas that need to be questioned about their use of technology and information as well as about the likely impact of its loss.

A clear understanding of the key responsibilities and position inside the organisation is also required to appoint the teams that will be responsible of the BC project in all the different phases, as described below.

Once the business areas have been identified it is necessary to identify the business processes within those areas. It is more effective to recover an organisation at process level following an incident as it ensures that non essential areas are not recovered before essential ones.

8.3 Assign BCM responsibilities

The senior management team should appoint or nominate a person with appropriate seniority and authority to be accountable for BCM policy and implementation and appoint one or more individuals to deliver and maintain the BCM programme.

Essentially, responsibility for the implementation and ongoing day to day management of the Business Continuity project is undertaken by two teams; the Business Continuity Management Team and the Business Continuity Steering Committee.

In addition to it, specific teams will be appointed to deal with incidents, as described in Section 330H8.4.

The team structures proposed in the following paragraphs to steer and deliver the Business Continuity Project, derived from some leading standards, better suit the need of larger organisations as in smaller organisations many roles and responsibilities may be bundled together and covered by fewer teams/people. This holds true also for the teams in charge of operations following an incident (see Section 331H8.4).

Appendix A outlines a framework for the BCM approach for SMEs.

8.3.1 Business Continuity Management Team

The Business Continuity Management Team will be led by the Business Continuity Manager, who will be responsible for the delivery of the BCP, embedding BC within the organisation and ongoing maintenance of the BCP. Depending on the scope of the programme the BC Manager might be assisted by a Business Continuity Analyst. In large organisations there may also be Business Continuity Co-ordinators within each business unit, who are responsible for assisting with the gathering of the impact data (see Section 9) and for writing and maintaining their own business unit recovery plans under the guidance of the Business Continuity Manager.

______________________________________________________________________ ENISA 28

Risk Management

The Business Continuity Manager does not necessarily become a member of the Incident Management Team during an incident (see Section 332H8.4). Rather, this role is often used in a consultative capacity owing to its extensive knowledge of the organisation.

8.3.2 Business Continuity Steering Committee

It is imperative for the governance of the BC programme that a Business Continuity Steering Committee (BCSC) is appointed. Because Business Continuity Management is concerned with infrequent but potentially catastrophic events, it can be overlooked as individuals within the organisation are pressed by their day-to-day responsibilities. When this occurs the Business Continuity Plan can decay and become increasingly irrelevant to the organisation. The implementation of a Business Continuity Steering Committee ensures that the organisation’s Business Continuity Plans are regularly considered, reviewed, tested and updated when organisational change occurs.

This group comprises the most senior managers from the organisation and each key department must be represented. The BCSC should be lead by the senior manager with responsibility for BCM. NIST 800-34 suggests that this might be the Chief Information Officer. BS 25999-1 states that the responsibility for BCM should be assigned to the owner, a board director or elected representative. The profile of a typical BCSC is shown in 333HFigure 10. Each box represents a role rather than a management position, therefore more than one role may be held by the same person.

______________________________________________________________________ ENISA 29

Risk Management

The Business Continuity Steering Committee are tasked with making strategic recovery and continuity planning decisions for the organisation and will sign off on each stage of the programme. Unlike the usual project management steering committee, which is disbanded on completion of the project, this committee is permanent [TR 19:2005].

The BCSC should meet regularly at suitable intervals during and after the implementation programme. It is likely that the meeting interval would lengthen once the BC programme has been completed. Suggested meeting frequencies are monthly during the implementation phase of the programme and quarterly once the BCP has been delivered and BCM is part of everyday organisational management.

Most experienced Business Continuity Managers would state that implementation of successful BCM is dependent upon having senior management “buying in” from the very start of the programme.

Strategic management of an incident is carried out by the Senior Management Team (strategic/gold level incident team – see Section 334H8.4.1). It is very likely that some or all of the members of the BCSC or their deputies would become members of the Senior Management Team during an incident. Given the seniority of the members of the BCSC, it is unlikely that they would become members of the Incident Management Team (tactical/silver level incident team – see Section 335H8.4.2).

8.4 Assign incident teams

PAS 77 suggests a three-tiered approach to manage an incident. The three tiers are referred to as Strategic or Gold, Tactical or Silver and Operational or Bronze and this approach is in line with the approach the emergency services use. This is illustrated below in 336HFigure 11. Early identification of the personnel who will comprise these teams is recommended so that they may become involved in the BC programme from the beginning and become familiar with Business Continuity and all that it involves.

These teams are only formed during an incident and do not have a line management relationship to each other. During day to day operation of the organisation, the members of these teams will be undertaking their normal duties, while attending incident management briefings and training as required.

8.4.1 Senior management team (Gold team)

The Senior Management Team leads the incident strategically. They do not carry out recovery tasks, but are more concerned with strategic decisions such as longer term planning for normal business resumption from the incident, liaising with the stakeholders and giving media interviews.

Many members of the Business Continuity Steering Committee are also automatically members of this team which is in charge of strategic decisions following an incident, i.e. the ICT, the Information Security and the Communication and Media members. Other members such as HR, Facilities and other interested business area managers are called upon as necessary, depending on the incident.

8.4.2 Incident management team (Silver team)

The Incident Management Team is responsible for central command and control of the incident and assists the critical processes in implementing their recovery plans. The team works to the procedures within the Incident Management Plan and liaises both with the Business Unit Management Team and the Senior Management Team.

______________________________________________________________________ ENISA 30

Risk Management

8.4.3 Business unit management team (Bronze team)

The Business Unit Management Team is responsible for recovery of their critical processes in accordance with their Business Recovery Plans. Each department will have a Recovery Manager who will liaise with the Incident Management Team.

8.4.4 Incident response team

The Incident Response Team will be involved in the management of an incident if there is a need to call out the emergency services and/or evacuate one or more buildings. Their responsibilities fall mainly in the first few hours after an incident. Once the incident is stabilised, and once it is established that the staff and anyone else who is affected (e.g. customers and public) are safe, then at that point they will handover the situation to the Incident Management Team.

NIST 800-34 [NIST] states that the specific types of teams required to manage an incident are based on the system affected. The functional teams are described below and some or all of these teams may be needed to effect a Business Continuity response:

In a smaller organisation, some of the bronze roles may be rolled up together and covered by fewer teams. ______________________________________________________________________

Risk Management

______________________________________________________________________

Risk Management

8.4.5 Example of how the three-tier incident response would operate

This section provides an example of the way in which each team would operate and each plan would be used during an incident.

The organisation, River Bank, is a bank which provides mortgages. The main office, Riverside House, is situated on Tay Street, which runs alongside the River Tay. In this example ICT and IS work in Riverside House, together with the bank’s Mortgage Application Call Centre, the Finance department and the Credit Control office.

The main Communication Room (which unfortunately is in the basement) is flooded, causing several servers to be damaged and also compromising the electrical safety of the whole of Riverside House.

The Facilities Manager advises the ICT and IS Manager, the Call Centre Manager, the Finance Manager and the Credit Control Office Manager that they should evacuate the building in accordance with the Incident Response Plan and then informs the Health and Safety Manager and the Business Continuity Manager of what has happened and the extent of the damage. The Business Continuity Manager contacts the members of the Incident Management Team who meet at the Incident Room in Glenalmond House and start implementing the Incident Management Plan.

ICT and IS are relocated to Gleneagles House in accordance with their Business Recovery Plan where everything needed has been set up. The management team will establish their own Incident Management Team to manage the operational teams and to liaise with the organisational Incident Management Team. The ICT and IS operational teams can then implement the IT Service Continuity Plan to restore the technology and information service to the affected Business Units.

______________________________________________________________________ ENISA 33

Risk Management

The critical processes from the Call Centre, Finance and Credit Control teams will relocate to the alternate sites referenced in their Business Recovery Plans (which could include another bank site, working from home, relocating to a Work Area Recovery Facility – WARF) and once there will start working in accordance with their Business Recovery Plans. This might necessitate using the procedure for manual operation while ICT and IS restore service.

As the incident affects the bank’s ability to answer customer telephone calls and release mortgage funds a gold team is established in order to cope with relevant managerial decisions related to the incident. The ICT Director would be part of this team.

8.5 Define BCM Policy

The BCM Policy provides the framework around which the BCM capability is designed and built. The BCM Policy is the key document which sets out the scope and governance of the BCM programme.

8.5.1 Define scope

It may be that an organisation wishes to include the whole of the organisation in the BCM programme or that it wishes, in the first instance, to cover only certain key areas such as the data centre or the processes which support key services. Alternatively the scope of the BCM programme may be to cover certain customer groupings, essential plant or geographical locations.

BS 25999-1 allows for this approach, since compliance may be achieved for parts of an organisation rather than the whole organisation. However the BCI Good Practice Guidelines 2007 urge caution: “the limitation of scope should be seen as a tactical approach that allows a staged development to the introduction of BCM across an organisation. If a product or service is defined as being within scope then all activities which support its delivery must be included in the BCM programme”.

8.5.2 Define BC drivers

The drivers against which the BCM is implemented should be defined so that the requirements of the organisation are met. The Australian standard HB 292:2006 suggests that key components of determining the organisational need for BCM should include:

• Understanding key imperatives of the organisation including: − critical objectives, critical success factors and key performance indicators − major current and emerging risks exposures • Critical organisational dependencies and interdependencies both within and external to the organisation, including: − critical business activities − critical plant, property assets and other infrastructure − third party relationships such as with the community, suppliers, customers and partners − regulators (e.g. financial regulators such as FSA in the UK [FSA], APRA in Australia [APRA], Bundesanstalt für Finanzdienstleistungs in Germany) • Analysis of past incidents and disruptions that indicate a propensity for future disruption, including: − occurrences in the area of the organisation under consideration (e.g. ICT and IS)

______________________________________________________________________ ENISA 34

Risk Management

− occurrences in the organisation as a whole − prior involvement of customers, suppliers, strategic alliances and other stakeholders − experiences of others within the same market sector, industry, geographical location etc

The information gathered from this activity can be used to answer the three following questions:

‘What is important to my organisation and why?’

‘What does my organisation depend upon to continue operating?’

‘What might prevent my organisation from achieving its key objectives?’

The answers to these fundamental questions will allow the organisation to determine what BCM objectives it wishes to achieve and the areas to concentrate upon when developing the BCP.

8.5.3 Define stakeholders

It is important to understand the stakeholders in the organisation in order to ensure that all aspects of Business Continuity planning have been addressed and all concerned parties have been accounted for in the BCP. A stakeholder in any particular organisation is any party that has an interest in the success and ongoing operation of an organisation such as employees, directors, shareholders, regulators and customers. Each stakeholder, while sharing a common interest in the ongoing health of an organisation, can and will have slightly different perspectives:

• Employees will have expectations relating to security of employment and a safe working environment (the latter often being a regulatory requirement also) • Directors will have expectations and responsibilities for ensuring growth, protection of revenues and profits and reputation management • Shareholders will be concerned with the financial performance of the organisation, its commercial prospects and, particularly in the case of institutional investors, the overall systems of control and governance that are in place • Regulators, depending on their remit, will have specific concerns regarding workplace safety, environmental issues, financial and/or operational controls • Customers will be primarily concerned with availability and quality of goods and services provided

An organisation’s Business Continuity arrangements should encapsulate all of these considerations when setting both its Business Continuity strategy and its specific recovery approaches.

______________________________________________________________________ ENISA 35

Risk Management

9 Conduct Business Impact Analysis

Assess Risks and Impacts process. The BIA enables the Business Analyze Results Continuity Manager or Business Continuity

Requirements Co-ordinator to fully characterise the systems requirements, processes and Test BCP interdependences and use this information to determine continuity requirements and priorities.

The purpose of the BIA is to correlate specific IT components with the critical processes that they support and based on that information, to characterise the consequences of a disruption to the components. Results from the BIA should be appropriately incorporated into the analysis and strategy development efforts for the IT Disaster Recovery Plan, Business Recovery Plans and the Incident Management Plan [NIST 800-34].

9.1 Assess risks and impacts

Once the business critical processes of the organisation have been identified (see Section 337H8.2), the Business Continuity Manager may interview the managers of each business area at process level. The interview should ascertain for each process the impacts of losing technology or information in the following areas [BS 25999-1]:

• Impact on staff or public wellbeing • Impact of breaches of statutory duties or regulatory requirements • Damage to reputation • Damage to financial viability • Deterioration of product or service or service quality • Environmental damage

HB 221:2004 adds the following impacts:

• Intellectual property, knowledge and data • Stakeholder confidence and goodwill • Political interest and comment

Additional methods to identify impact may be used. To this extent, qualitative or quantitative impact statements can be formulated. Such impact-measurement methods can be actually found in many Risk Management methods [ENISA_RM].

The technology required to operate each critical process should subsequently be identified and a Recovery Time Objective for that technology should be defined. This is the translation from process RTO (the RTO of the critical process as a whole) to component RTO (the RTO agreed for the various IT components required to operate the critical process itself). From the BIA data the ICT department must determine the supporting components. This may be a complex network (see 338HFigure 1) as it may include several components (network, multiple servers, databases, data feeds from disparate systems, pre-requisite applications, security settings, web server, etc) or it may be ______________________________________________________________________ ENISA 36

Risk Management

simple (Finance departments typically have a standalone PC with a single application, modem and smartcard reader in order to authorise bank payments). ICT must list the components and recovery sequence.

It may be helpful at this stage to start with a list of known technology so the list is not being re-created when it already exists. The ICT department may already have this information on their asset list, or IS may have this information if they have recently conducted a Risk Assessment. If this information is not already held, it would be a good idea to co-ordinate the efforts of ICT and IS. In this way, that not only are the details for the BIA collected, but any other information the ICT or IS departments may wish to gather about the business areas’ use of technology and information are also obtained.

ICT will then be in a position to map the recovery process for components and relate the combined component RTO to the process RTO. If the sum of the components cannot be recovered within the process RTO then there is a gap (339HFigure 16).

For a BIA the minimum information which the Business Continuity Manager needs to gather from the business process manager is:

• business area and process names • Recovery Time Objective for the process (based on the criticality ratings and recovery timescales defined in the BCM Policy) • type of software used • acceptable levels of downtime for the software • information required (electronic and paper) • acceptable levels of downtime for the information • type of hardware used (can include workstations, printers, faxes, exception PCs, modems etc...) • number of items of each hardware type normally used • minimum number of items of each hardware type which could be used during an incident ______________________________________________________________________ ENISA 37

Risk Management

• acceptable levels of downtime for the hardware • telephony used • acceptable levels of downtime for the telephony • Service Levels agreed with hardware, software and service providers and within any IT support contract

The BIA should also be carried out on ICT and IS as an incident may require them to operate from an alternative location, and it is essential that they understand how they will support the organisation should they be affected by an incident.

If it has not already been carried out as part of the organisation’s Risk Management, a Risk Assessment should be carried out on ICT and IS to assess areas of risk that may lead to a disruption. This Risk Assessment should be carried out in accordance with any of the relevant Risk Management methods as the ones described [ENISA RM].

The outcome of the Risk Assessment will provide the information with which to assess ICT and IS’ vulnerabilities and allow them to develop an action plan to mitigate the risks. It is likely that some of the risks cannot be eliminated and the Business Continuity Plan must address them and provide a course of action should a disruption occur.

9.2 Analyse results

Once the information regarding technology usage, information requirements and acceptable downtimes has been gathered from the business processes, it is necessary to collate all the results and analyse them to determine the Recovery Time Objectives for each item of software, hardware, information and telephony used by the critical processes and the Recovery Point Objectives for the information requirements (critical data).

HB 292-2006 suggests one approach to consolidating and summarising this information is to construct a resource matrix which allows for mapping of the requirements over the whole or parts of the organisation.

Depending on the size of the organisation and the complexity of the resource requirements, there may be one resource matrix, which collates all the requirements identified in the BIA, or there may be several resource matrices, which individually show the required resources for staffing, technology, information/data, premises, equipment and materials. An example of a single Resource Matrix is shown in 340HTable 4.

______________________________________________________________________ ENISA 38

Risk Management

From this Technology Resource Matrix an Application Resource Matrix could be constructed which only shows the applications and displays the information a different way. This representation highlights the discrepancy between the RTO required for that particular IT component (Required Application RTO) and the actual RTO (Required Application RTO):

An Application Recovery Profile can then be determined which shows the order of priority of restoration of the critical applications, to meet the requirements of its most critical dependent process(es). The information is presented in 341HTable 6 and as a graph in 342HFigure 14.

If more than one process is dependent upon an application, the needs of the least critical process will be met by restoring the application to meet the requirements of the most critical application (e.g. Payroll and Mortgage Payment Defaults are both dependent upon GLedger. By restoring GLedger within 3 days for Mortgage Payment Defaults, Payroll’s requirement of 5 days has also been met).

This is a very simplified Recovery Profile for illustrative purposes only; other factors may need to be considered such as inter-dependencies between applications, use of IT resource over different locations, prioritisation when several applications need to be restored at the same time or existing Service Level Agreements (SLAs) both internally and with third-party suppliers.

______________________________________________________________________

Risk Management

There may be instances when the actual RTO for an application (this is the minimum length of time within which ICT can restore it) is greater than the application RTO required by the process. This is illustrated in 343HFigure 15. A further explanation of gap analysis is given in the next paragraph.

Very often there are several interdependencies between the various IT components (applications, infrastructure, servers, databases), and if all the different component RTOs and RPOs do not match the process requirements these gaps constitute a risk and are highlighted in the IT Requirements Gap Analysis (see Section 344H11.8.1). The relationship between the different RTOs and the potential gap between actual component RTOs and the process RTOs are illustrated in 345HFigure 16 and Figure 19.

______________________________________________________________________

Risk Management

However the process RTO and component RTOs can vary wildly. Processes may require applications to be restored in order to commence work within their RTO, but because of the complexity of today’s technology, this may involve restoration of a number of components (e.g. application server, file server, operating systems, infrastructure and data) in order to be able to recover the application for the business unit. An illustration of how the various component RTOs can impact availability of the critical process is shown in 346HFigure 17. The discrepancies between the process RTO and the component RTO should be highlighted in an IT Requirements Gap Analysis which should be escalated to the BC Steering Committee, for gaps where there is a significant risk to be included in the Risk Register (see Section 347H11.8.2). In these cases a decision must be taken by the BCSC as to whether the affected business processes should develop manual workarounds, or increase their recovery timescales or whether, alternatively, the ICT or IS departments implement should a solution to improve their response times.

The gap between the process’ requirements and the IT capability is illustrated below in 348HFigure 17.

ICT and IS should also conduct a BIA on their own processes to understand their own needs for recovery so that the needs of the business and ICT can be weighed together.

9.3 Prioritise recovery/define critical resource requirements

Drawing on the analysis of the results from the BIAs and in consideration of all the factors involved, the Business Continuity Manager can define the priorities for recovery of the IT and IS components. This assessment will be based upon the criticality of each process, the required RTOs and RPOs, restoration capability, the component/process

______________________________________________________________________

Risk Management

location and component interdependencies. This is essential information since in turn it helps ICT and IS define their own staffing levels and resource requirements over time, in order to be able to support the recovery effort following an incident.

The end result will be a finalised recovery profile which shows over time what is being recovered and the specific resource (technical, staff, premises, equipment or materials) that is required at any time to support the recovery. The recovery profile will allow the identification of a number of possible recovery options; the choice of recovery option will determine the BCM strategy and subsequently the development of an appropriate IT Service Continuity Plan and the Business Continuity Plan.

Should discrepancies occur between the required process RTO and the component RTO, as highlighted in the IT Requirements Gap Analysis, these must be addressed before the BCP can be completed.

______________________________________________________________________ ENISA 42

Risk Management

10 Design BCM approach

provides guidance on the way in which

Define BCM recovery can be effected. The first stage is

Design BCP to develop the possible recovery options which outline what the organisation could do Test BCP to meet its BC Objectives as stated in the BCM Policy

The strategy is developed once the most

appropriate recovery option(s) has been chosen and this will enable the key components of the suite of BCP documents to be identified.

10.1 Determine recovery options

The possible options for recovery should be documented and presented to the BC Steering Committee. The options will build on the BIA results and will outline how ICT and IS can continue to meet the organisation’s objectives, obligations and statutory duties in a cost-effective manner, despite an incident which affects their ability to operate at normal levels.

Options should be determined for the following areas:

• Staff (including skills and knowledge) • Premises (location(s) of work and locations where information is held) • Technology (telephony, data, applications, systems) • Supplies (materials and equipment) • Stakeholders

It is quite likely that various issues will be identified as a result of Risk Assessment, Business Impact Analysis, hazard identification or from operational experience which, if not addressed, may represent continuity risks. These risks should be recorded in the Business Continuity Risk Register (see Section 349H11.8.2) and highlighted to the Business Continuity Steering Committee.

Examples of continuity risk might include:

• Records management – an issue regarding poor storage, archiving and retrieval of vital records has been identified which could lead to vital information not being available when it is required and leading to a regulatory or reputational risk • Staff training - issues have been identified regarding low levels of multi-skilling, cross-training or succession planning. This could lead to a continuity risk if there were above average levels of sickness, industrial action or a key member of staff was unavailable for several weeks or months • Back-up plan (where risks have been identified with respect to the back up of data and the recovery and restoration of that data)

Activity plans to address the continuity risks should be implemented and related work integrated to ensure that the deadline for the delivery of the BCP is achieved.

______________________________________________________________________ ENISA 43

Risk Management

The options will depend on:

• Recovery Time Objectives for the critical processes • Recovery Point Objectives for the critical data • Interdependencies of components • Costs of implementation of various options • Consequences of inaction

It must be noted that the organisation should minimise the likelihood of implementing a solution which could be impacted by the same incident that caused the business disruption. For example relocating to a WARF which is only a few hundred metres down the road and which could be affected by the same power cut, telephony outage or flood as the organisation.

The strategies adopted for ICT and IS are often quite complex and will typically be one or a combination of the following alternate site options [BS 25999-1]:

• Provision made within the organisation (Budge Up, Displacement, Remote Working, Reciprocal Agreements) • Services delivered to the organisation (mobile facilities or prefabricated units) • Services provided externally by a third party e.g. Work Area Recovery Facilities (WARF) (dedicated, syndicated or shared seats) • Mirrored sites which are identical to the primary sites in all technical aspects

There are several options available depending upon the organisation’s technology strategy, and the solution can be complex. These options can be classified according to whether they are cold, warm or hot sites and their relative advantages and disadvantages can be seen in the following table:

Site Cost Hardware Telecoms Setup Time Location Equipment

Cold Low None None Long Fixed Warm Medium Partial Partial Medium Fixed Hot Medium/ Full Full Short Fixed High Mobile High Dependent Dependent Dependent Not Fixed Mirrored High Full Full None Fixed

In turn, the choice of these options will depend upon:

• RTOs for processes which support the critical activities identified in the business area BIAs: - a process RTO of several months may allow the organisation to chose to leave any decisions until after the event - a process RTO of over a day or two may allow time for staff to be relocated to another site - a process RTO of less than a day will require tactics that enable the activity to be taken on by staff at other locations, or quick relocation of affected staff • Location and distance between technology sites • Number of technology sites ______________________________________________________________________ ENISA 44

Risk Management

• Remote access • Unstaffed (dark) sites or staffed sites • Telecoms connectivity and redundant routing • The nature of failover (automatic or manual) 5 6 • Back up strategy (e.g. daily, weekly, monthly, CDs, tape, DASD4F or RAID5F ) • Third party connectivity and external links

Further options may be selected to reduce the likelihood of an IT disruption and could include the following strategies:

• Geographical spread of technology • Holding older equipment as emergency replacements or spares • Additional risk mitigation for unique or long lead time equipment • Cross training to ensure that there is more than one member of staff with key skills • Succession plans so that the loss of a senior manager or the IT Director does not present a risk.

10.2 Agree recovery strategy

The chosen options will then be signed off by the BCSC and the BC Strategy will have been chosen. Any proactive measures put in place to mitigate the risk are fed back into the Risk Management strategy.

The strategies which are adopted for Business Continuity will, for some processes, be dependent upon the strategy for IT Service Continuity. For example if ICT Operations has decided that the best strategy for backing up and restoring the critical systems is to do a mirrored back up to a WARF, the business processes who use those systems will then recover to desks in the WARF if their building becomes unavailable or access to the systems is denied. The strategy for staff in ICT Operations will also be to recover to the WARF, as they will be required to restore the data back ups and provide workstations for use by the staff recovering to the WARF site to maintain and to provide ongoing support.

A Help Desk facility may have to restore to another site within the organisation if they have complex telephony which makes it difficult or expensive to relocate to a WARF, and this in turn will govern where some of the Telephony Team will relocate following an incident.

As discussed by Thomas Carroll in The Definitive Handbook of Business Continuity Management [DH BCM], all organisations are careful about expenditure and budget will nearly always be a limiting factor on the solution or options that are implemented to protect the organisation. It does not make sense to implement an expensive solution for a loss which may have little value to the business or a solution which enables an RTO of minutes when days are required.

The following graph shows the relationship between RTO and cost and when determining the strategy for recovery an acceptable combination between the cost to recover, the cost of impact and RTO should be determined, so the chosen solution can be justified on a cost/benefit basis.

Direct Access Storage device Redundant Array of Independent Disks ______________________________________________________________________ ENISA 45

Risk Management

The next step is to prepare a project plan for implementing the strategy and to design the BCP.

10.3 Design BCP

Once the strategies have been determined and any continuity risks have been addressed, the organisation should decide how it wishes to present the BCP.

The BCP should at a minimum cater to three sets of activities, which correlate to the three phases of an incident, as shown in 350HFigure 19:

• Respond to an incident, emergency or disaster; • Recover business-critical activities (this may include interim workarounds in the absence of essential technology); • Resume normal working of all business operations from the temporary measures adopted during recovery.

Adapted from Figure 3.3: Recovery cost balancing [NIST 800-34]. ______________________________________________________________________ ENISA 46

Risk Management

10.3.1 Suite of documents

The suite of documents comprising the BCP will vary from organisation to organisation, but it is recommended that the following plans be considered. In smaller organisations these plans might be combined into one, but in larger organisations they will probably either exist as separate entities or some of the plans may be combined together.

______________________________________________________________________

Risk Management

A further illustration of the relationship between the plans comprising the BCP and the phases of recovery are shown in the diagram below.

When BC is introduced into an organisation one of the results is the production of a number of documents, not all of which are necessarily included in the BCP (e.g. a number of policies and procedures such as HR policies). The BCP can be used in isolation to effect recovery in the event of an incident affecting the organisation but in reality it interacts with other documents in the areas of Risk Management, Information Security, HR/Health and Safety policies and ITSC.

The following diagram shows the relationship between the potential plethora of documents and their relative ownership.

______________________________________________________________________

Risk Management

Some of the documents and processes already in place will require modification as different information is required e.g. HR will need next of kin information with current contact details, this system will require change management process to ensure the information is current, an information security policy to ensure that it is not widely accessible and BC to ensure that the information is available during an incident involving the information repository.

The details of the interfaces between these programmes (ISMS, ITSCM, BCM, RM) is dependent on the organisation and method of implementation.

Design BCP not only comprises a whole suite of documents, but further work is required to enable delivery and successful adoption of the plan. More details on training and awareness to sustain the Business Continuity Plan are given in Section 351H13. In this stage some consideration should be given to:

• How the BCP will be distributed (paper, electronic, intranet, z-cards); • How the training will be delivered (e-learning, classroom learning, scenario exercises); • How awareness of the plan will be raised (lunch n’ learn, company newsletter articles, intranet, questionnaires).

These elements influence the way the plans are written and delivered, therefore it is important to give some thought to them at this stage.

______________________________________________________________________

Risk Management

11 Deliver BCP

comprising the BCP has been determined the Plans can be written.

Incident Management Plan These documents each serve a different

Test BCP purpose and range from detailing how the

Communications and Media Plan incident will be managed by the incident

management team, to the tasks which HR,

Facilities, Health and Safety and possibly

other support functions will carry out to support recovery.

The plans also detail how communications internally and externally will be handled.

It should be noted that the following plans are only suggestions based on a combination of authors’ experience and the recommendations of a variety of BC Standards.

11.1 Incident Response Plan

The Incident Response Plan is concerned with the immediate aftermath of an incident and is primarily concerned with keeping people safe. This plan would normally be written by Health and Safety and Security with assistance from the Business Continuity Manager, but ICT and IS should ensure that there is a plan, especially if they are the sole occupants of a building.

The Incident Response Plan should give details of:

• The structure of the Incident Response Team • Members of the Emergency Response Team • Roles and responsibilities of the Incident Response Team • Muster Points • Decision making process and escalation

In addition the Incident Response Plan should detail procedures to:

• Evacuate the building or shelter in site (“invacuate”) • Move evacuated staff to a safe site • Liaise with the emergency services • Stabilise the situation immediately following a incident • Communicate with people affected by the incident or impending incident – this may include the public and neighbours • Mobilisation of first aid, safety and evacuation assistance teams • Account for those who were on site or in the immediate vicinity • Locate safe site including details for accessing it • Incident Room location and details for accessing it • Interact with external agencies and regulatory authorities • Ensure security or personnel, information and physical premises • Assess the situation ______________________________________________________________________ ENISA 50

Risk Management

11.2 Incident Management Plan

This plan details how the incident will be managed from occurrence to back-to-normal operation and provides information about the structure of the Incident Management Team, the criteria for invoking Business Continuity, the management of the incident, resource requirements, any necessary staff movements and critical processes.

PAS 77 suggests that a tiered incident management structure be established that is in line with that used by both public and private sector companies. 352HFigure 11 shows how this three-tiered structure is implemented in the UK.

In outline the IMP should contain:

• Background • Scope and purpose of document • Relationship to other plans • Definition of the Incident Response structure • Handover from the Emergency Response Team • Procedure for assessing the situation • Roles and responsibilities of the Incident Management Team. Only incident roles should be used throughout the document – not names • Incident Room location and details for accessing it • Location of an alternate Incident Room • Invocation criteria • Invocation procedure including rendezvous points and responsible persons • Procedure for setting up and managing the Incident Room (this should include a list of the required equipment, procedures and responsibilities for setting up PCs, telephones, teleconferencing or video-conferencing facilities, the layout of the room, location of a quiet room, details about catering arrangements, shift lengths, telephone numbers and so on.) If the room is normally a meeting room it is sometimes beneficial to prepare a notice for the door, stating that in the case of an incident the room must be vacated immediately • Action plans for implementing the Business Continuity response – it is helpful if these are included as a checklist and have a box for ticking that the action has been completed. Sometimes it is useful if action checklists are written for each member of the team separately so they can be printed and handed to each individual • Recovery Profiles – these detail the critical activities to be recovered, the number of staff involved and their alternate location. The critical resource requirements for each critical activity will also be detailed and the timescale in which they are required • Resumption Process – this details how the organisation can resume normal operations following recovery of the critical processes. This may be a separate document or the organisation can decide how to manage this at the time once the critical processes are operational and the organisation has stabilised • Details of equipment storage • Maps and directions to all locations mentioned in the Plan • Site access plans • Claims management procedure • Charts, plans (e.g. floor plans), photographs and other information which might be useful

______________________________________________________________________ ENISA 51

Risk Management

• Contact information. This section can include the names of the staff in each role and should also include at least one deputy. − Senior Management Team (gold) − Incident Management Team (silver) − Bronze Team Leaders (all departments within the organisation) − External suppliers − Internal contacts − Regulatory bodies − Useful local information (e.g. hospital, doctors, plumbers, electrician, local council) − Neighbours − stakeholders • Communications Matrix • Incident Log • Incident Management stand-down procedures − Decision to stand down − Who to communicate with − Filing of paperwork − Post incident report

11.3 Business Recovery Plans

Business Recovery Plans are the plans used by the bronze or operational teams following an incident which affects their ability to operate normally. They provide the information for the ICT or IS teams to recover their processes in order for the IT Service Continuity Plan to be put into action. If necessary the critical business units affected by the incident and who are suffering a loss of critical technology or information will also activate their Business Recovery Plans.

The Business Recovery Plans should include:

• Background • Scope and purpose of document • Relationship to other plans • Definition of the Business Unit Team • Roles and responsibilities of the Business Unit Team. Only incident roles should be used throughout the document – not names • Procedure for assessing the situation • Incident Room contact information • Invocation criteria • Escalation criteria • Invocation procedure including rendezvous points and responsible persons • Action plans for implementing the Business Continuity response – it is helpful if these are included as a checklist and have a box for ticking that the action has been completed. Sometimes it is useful if action checklists are written for each member of the team separately so they can be printed off and handed to each individual. These action lists should cover the loss of each critical resource i.e. equipment, materials, technology and information, staff and buildings • Recovery Profiles – these detail the critical activities to be recovered, the number of staff involved and their alternate location. The critical resource requirements for ______________________________________________________________________ ENISA 52

Risk Management

each critical activity will also be detailed and the timescale in which they are required • Details of equipment storage • Maps and directions to all locations mentioned in the Plan • Incident Log • Communications Matrix • Contact information – this section can include the names of the staff in each role and should also include at least one deputy − Incident Management Team (silver) − Other Bronze Team Leaders − External suppliers − Internal contacts − Regulatory bodies − Useful local information (e.g. hospital, doctors, plumbers, electrician, local council) • Recovery stand down procedures − Decision to stand down − Who to communicate with − Filing of paperwork − Post incident report

11.4 Recovery Support Plans

Recovery Support Plans are aimed at the teams who have a supporting role to the organisation and who, during an incident, would have very specific roles to play. They include, but are not limited to:

• Human Resources • Facilities • Health and Safety • Security • Legal • Alternate Site Co-ordination • Original Site Salvage • Damage Assessment

The ICT/IS Incident Management Team should be aware of these plans and enlist the help of these departments if required. Representatives can be co-opted onto the ICT Incident Management Team, but if the incident has a far-reaching affect, it is advisable to invoke the organisation-wide Incident Management Team which automatically includes the managers from these teams.

11.5 Communications and Media Plan

NFPA 1600 suggests that procedures should be developed to disseminate and respond to requests for pre-incident, incident and post-incident information, as well as to provide information to internal and external audiences including the media, and to respond to their enquiries.

______________________________________________________________________ ENISA 53

Risk Management

Organisations should also establish and maintain the capability to provides accurate and up to date information for the organisation and the public which includes:

• Central contact point for the media • Systems for gathering, monitoring and disseminating emergency information • Pre-scripted information bulletins for potential disruption scenarios • Method to co-ordinate and clear information for release • Identification of the audience for communications (e.g. stakeholders, key customers, staff, emergency services, suppliers, families, regulators, government ministers etc) • Policies for communicating with the audience • Policies for communicating with special needs populations • Ongoing employee/customer communications and safety briefings • Protective action guidelines (e.g. shelter at site, evacuation, move to safe site) • Advice to the public through appropriate agencies concerning threats to the people, property and the environment • Definition of the means and frequency with which information will be provided

BS 25999-1 also suggests that a suitable venue should be established to support liaison with the media and other stakeholder groups and that appropriate numbers of trained, competent spokespeople should be nominated and authorised to release information to the media.

A communications (or audience) matrix should be written to summarise key information about the audience including who should communicate with each group. The key points of the message could also be noted in this matrix. It is useful to include this tool in all plans, to avoid confusion over who communicates with whom.

11.6 IT Service Continuity Plan

The Information Technology Service Continuity Plan is the collection of policies, standards, procedures and tools through which organisations not only improve their ability to respond when major system failures occur, but also improve their resilience to major incidents, ensuring that critical systems and services do not fail or that failures are recovered within acceptable process RTO limits.

BIA information is used to define the process RTO and determine the recovery prioritisation. This makes the recovery process a user-centric activity matching business requirements.

The recovery plans are organised in a hierarchy. A site loss plan details the systems which would be affected by the loss of a building. A separate plan for each service should provide detailed procedures and step-by-step guidelines for each stage of an incident so that the Recovery Teams are able to restore the services and thereby to meet the agreed process and component RTOs.

The plans should be clear and concise and expect a level of knowledge but not presume explicit local knowledge, in the event that external assistance is required to rebuild systems (the same is true of Disaster Recovery Plans). Each procedure should be selfcontained so that it can be utilised to effect recovery of a single system or component (e.g. the server is running successfully but the database management system has crashed). Each document must also contain details of pre-requisites; this means that in the event of multiple component failures the correct sequence can be followed (e.g.

______________________________________________________________________ ENISA 54

Risk Management

replace failed disk, rebuild operating system, install database, configure security settings and then restore data).

In summary the IT Service Continuity Plan should typically contain the following information:

• Details of the combined component RTOs and RPOs and inclusion of the IT Requirements Gap Analysis • IT Architecture • Roles and Responsibilities • Invocation Procedures • Damage Assessment • Escalation and process flow charts • Detailed procedures specifying how to recover each component of the IT system • Test Plans specifying how to test that each component has been recovered successfully • Incident Logs • Contact Details • Fail-back procedures • IT Test Plan

These plans detail the four stages:

• Initial response: damage assessment and invocation of the appropriate incident management teams. • Service recovery: this maybe staged and offer a degraded service. • Service delivery in abnormal circumstances: interim measures may include relocation of services to another site or utilisation of spare equipment (often training or test servers). This is a temporary measure to provide a limited service until normal service can be resumed. • Normal service resumption: returning to the usual service, fail-back from the abnormal service delivery.

PAS 77 also details strategy and infrastructure improvements to improve resilience. Improving the environment is a proactive measure to minimise the risk of IT outages. The strategy is a phased approach to achieving that resilience. It is driven by budgets, risk, experiences and changing user requirements. Experience comes from implementation, testing and failures. The three criteria they use for strategy are component RTO, RPO and cost; introducing measures to reduce component RTO and get to a stable RPO can be very costly in time, resources and finances for new technology.

If an ITSC Plan is successful then its success is difficult to measure. Any incident will be recovered within the process RTO and will not invoke a BC incident. The only measurement is the reduction of downtime and improvement to SLA adherence.

11.7 Business Resumption Plan

Business Resumption Plans (BRP) are defined in NIST 800-34, BS 25999-1, APS 232, NFPA 1600, COBiT, HB 292-2006 and PAS 77. This plan details how the business unit can resume normal operations following recovery of their critical processes. This may be a separate document or the business may decide how to manage this at the time that

______________________________________________________________________ ENISA 55

Risk Management

critical processes are operational and the organisation has stabilised (PAS 77 refers to this process as ‘fail-back’).

While Business Continuity may necessarily involve adopting temporary measures (such as office relocation, reduction of working hours, reduction of staffing levels and/or usage of backup IT systems), business resumption is concerned with restoring operations to as near normal levels as possible.

The upheaval of relocating, changing IT systems, etc. can be as traumatic to an organisation as the BC event which invoked plans in the first place. One advantage of the resumption process is that it can be scheduled to cause minimum disruption through correct planning.

Resumption may be to the original site or to a new location (depending on the damage sustained) and will need to be treated as a work programme in its own right, utilising the information from the resource matrices to develop a programme plan for reinstating normal operations in order of priority. The plan details the sequence, parties involved and other considerations (security, various timings, intermediate measures, communication, etc).

The Office of the Chief Information Officer (US Government) states that “Development of the Business Resumption Plan should be coordinated with Disaster Recovery Plan and Business Continuity Plan”.

11.8 Supporting Documents

The following documents are not formally part of the BCP in any standard but experience shows that they are necessary in order to support the process:

11.8.1 IT Requirements & Gap Analysis

These two documents are working documents which are the liaison between BC and ITSCM. ITDR does not take this into consideration. Although these documents are not defined in any specifications the Requirements document is implied in ITIL. From a practical perspective they are important as they are the formal specification of requirements and the risk response and as such require a high-level sign-off from senior management.

The IT Requirements are the details taken from the BIAs. This lists the applications and IT components in general, and for each relevant IT component an RTO and RPO dictated by each critical process. This information is used to determine the critical components and their RTOs. This will ultimately drive the Service Catalogue, Service Level Agreements and IT Strategy as well as the ITSC Plans.

ICT are not always able to meet these requirements due to the current infrastructure. This leads to a Gap Analysis report which highlights the gaps (see 353HFigure 17). The BCSC (or senior management) can then decide how to mitigate the risk. This may either be a strategic decision to upgrade the infrastructure (at some cost) or the Business Units may have to provide manual workarounds to meet the actual recovery time. Items from the Gap Analysis are logged in the Risk Register.

11.8.2 Risk Registers

The Corporate Risk Register contains details of all of the risks to the organisation. It is a tool that captures, describes and assesses risks as they are identified, together with risk accountabilities, actions where required, review dates and dates when actions were completed and the risk item closed [BS 31100 DPC].

______________________________________________________________________ ENISA 56

Risk Management

A Business Continuity Risk Register will include the date of the last assessment, a description of the risk, an estimate of the impact and the likelihood, any mitigating controls, and a statement of action required, with target date and owner. A properly maintained risk register provides a useful vehicle for communication [ISO 27000].

The IT Risk Register records the risks identified with Information Technology and Information Systems. While many companies will bundle this into the Corporate Risk Register, larger organisations tend to have one Register per department with the highest severity risks being promoted to the Corporate Risk Register.

These Risk Registers are owned by the senior management team since the acceptance of risks contained therein is not the responsibility of ICT, given that some of the risks will affect business areas.

______________________________________________________________________ ENISA 57

Risk Management

12 Test BCP

Management arrangements cannot be Define BCM considered reliable until tested. Testing is

essential to develop teamwork, competence, confidence and knowledge all of which are Test BCP vital at the time of an incident.

Deliver Debrief/Test Report ISO 27002 expands this further by stating Sustain BCM Programme that the tests should ensure that all members of the recovery teams and other relevant staff are aware of the plans and of their responsibility for Business Continuity and Information security as well as know their role when a plan is invoked.

12.1 Determine type of test

There are many ways of testing that a BCP is fit for purpose and the table below describes a number of these methods. The method chosen will depend on the maturity of BCM within the organisation and the testing which has been conducted before. It would not be a good idea to opt for a full rehearsal if the BCP has not been tested before.

In some case, it would be a good idea to appoint some of the people involved (employees and also trusted external consultants) in the role of facilitator and observer to help conducting and understanding the test.

The facilitator runs the test or exercise, but does not take an active part. He will brief the participants on the objectives of the test and will set the scene of the scenario. During the test, the facilitator co-ordinates the test activities (e.g. phone calls, playing of mock radio/TV broadcasts) and ensures that the test runs to time. After the test the facilitator will run a debriefing session and be responsible for writing a Test Report.

An observer observes the test and takes no part in the test at all. He records the outcomes of the test, as it progresses, against the critical success criteria for the test. He will assist in the debriefing session by summarising the key points observed and will pass their results to the facilitator to enable the Test Report to be written.

Risk Management

12.2 Write test plan

To derive the most value from a test a Test Plan should be developed to define the selected elements against explicit test objectives and success criteria. The test plan should contain a schedule detailing the time frames for each test and test participants and should clearly delineate scope, objectives, scenario and logistics.

The scenario should be as realistic as possible to test the plan properly and gain maximum support from the participants. In some tests it is appropriate to seek involvement from outside personnel such as emergency services, security, the Local Authority emergency planning officer, subject experts and suppliers

Questionnaires should be prepared for observers so they can record their observations during the test.

12.3 Conduct test

Prior to the test the participants should be provided with the necessary information and briefed about the ‘situation’.

______________________________________________________________________

Risk Management

The participants take part in the test using the relevant plans, which is facilitated by the Facilitator. The Observers will determine which aspects of the test they are observing and record what they see and hear on the questionnaire.

After the test the Facilitator and Observers should get together to document the outputs from the test and identify key learning outcomes and potential improvement actions.

12.4 Deliver debrief and test report

As soon as possible after the test a debriefing should be conducted where the participants say what they felt went well, what went badly and where their response could be improved. The debriefing should include all participants, the observers and those with responsibility for plan maintenance or future activation. At the end of the debriefing responsibilities for plan improvement activities should be assigned.

The final deliverable is a Test Report outlining the scope, approach, method and results of the test with the recommendations for action and the action owners. The audience for this report should be the BC Steering Committee.

______________________________________________________________________ ENISA 60

Risk Management

13 Sustain BCM Programme

a few weeks, if not updated, the effectiveness and relevance of plans can

Framework begin to deteriorate.

Following implementation of the tested

BCP, it is therefore necessary to keep the plan up to date, ensure that all the staff involved with ongoing BCM or incident Sustain BCM Programme response and management have been

Maintain and Review BCP trained in their roles and awareness of

BCM is raised at all levels throughout the organisation.

13.1 Train staff

[NIST 800-34] advises that training for personnel with Business Continuity responsibilities should complement testing. Training should be provided at least annually; new staff who will have plan responsibilities should received training shortly after they are hired. Ultimately personnel must be trained to the point that they are able to execute their respective incident response and incident management procedures without the aid of the documents.

Training should encompass:

• Purpose of the plan • Cross team co-ordination and communication • Reporting procedures • Security arrangements • Team specific processes • Individual responsibilities

[TR 19:2005] recommends that training be aimed also at specific groups, namely:

All staff Basic awareness training which gives the staff an insight into basic Business Continuity and informs them about their Business Recovery Plans and what will happen to them during an incident Management Team Management training to inform managers about the overall incident response and management, the purpose of their Business Recovery Plans, what they will be expected to do during an incident and how they will implement their plans Business Continuity Specialised training to train all staff involved in incident and Incident response, management and recovery. This will probably Personnel involve a number of different training courses. Scenario exercises as mentioned in Section 354H12.1 are a good way of training staff following a classroom session.

______________________________________________________________________ ENISA 61

Risk Management

Examples of the types of training courses which could be delivered to the staff in the third group are:

• Evacuation • Media communications (aimed at spokespeople) • Establishing an Incident Room • Managing an incident • Crisis communications • Working from alternate sites

Training should also be provided for the staff who will form the Business Continuity Management Team, which should cover:

• Programme management • Conducting a BIA • Designing and implementing BCPs • Risk and threat evaluation • Designing tests and exercises

The Business Continuity training programme should be embedded within the organisation’s training and development programme and form part of staff personal development plans. Details of the specific training and its frequency (taking into account refresher training as well as training new members of the team) should be included in a Training Manual that is part of the organisation’s training portfolio.

Ideally, general Business Continuity training is included within the induction programme so that all staff are made aware of Business Continuity from the start of their career.

13.2 Maintain and review BCP

The programme should ensure that any changes (internal or external) which impact the organisation are reviewed in relation to BCM. It should also identify any new products and services and their dependent activities which need to be included in the BCM maintenance programme.

If there are any major business changes, a revision of the BIA ought to be undertaken. The other components of the BCM programme may be amended to take account of these changes.

The organisation’s top management should, at intervals that it deems appropriate, review the organisation’s BCM capability to ensure its continuing suitability, adequacy and effectiveness. This review should be documented and should ensure that within the BCM programme:

• All key products and services and their supporting critical activities and resources have been identified and included in the BCM strategy; • The BCM policy, strategies, framework and plans accurately reflect priorities and requirements; • The BCM competence and capability are effective and fit for purpose and will allow management command, control and co-ordination of an incident; • The BCM solutions are effective, fit for purpose and appropriate to the level of risk faced by the organisation; ______________________________________________________________________ ENISA 62

Risk Management

• BCM strategies and plans incorporate improvements identified during incidents and exercises as well as in the maintenance programme; • The organisation has an ongoing programme for BCM awareness and training; • BCM procedures have been effectively communicated to relevant staff, who understand their roles and responsibilities; • The BCM maintenance and exercising programmes have been effectively implemented; • Change control processes are in place and operate effectively.

Details of the review periods and frequency of testing and training may be included in a separate Maintenance and Review document. This document specifies how and when the BCP will be reviewed and tested and the process for maintaining the plan. The intervals between tests and reviews will depend on the organisation, its complexity and rate of change. A training schedule may also be included.

The organisation should provide for the independent audit of its BCM competence and capability to identify actual and potential shortcomings. Independent audits can be conducted by competent external or internal persons.

The BCP may contain sensitive information (e.g. Executive contact numbers or location of vital records) which should be appropriately protected. Copies of the BCP should be stored in a remote location, at a sufficient distance to escape any damage from an incident at the main site. Management should ensure that copies of the BCP are up to date and protected with the same level of security as applied at the main site [ISO 27002].

Once BCM has been embedded into the organisation as an ongoing management process it enters an iterative cycle; being reviewed at regular intervals and updated when necessary.

13.2.1 Change Management

Changes to the BCP which have been identified as a result of exercising, testing, training or organisational developments cannot be made without passing through the Change Management process. What may seem to be small changes at the business unit level can have significant impacts on the BCP in other areas.

The changes must be approved by the Business Continuity Manager and if necessary go before the BC Steering Committee for final approval. The Business Continuity Manager will be responsible for issuing the changes in accordance with the organisation’s procedures for document and version control.

13.2.2 Continuous Improvement

Continuous improvement, in regard to organisational quality and performance, focuses on improving customer satisfaction through continuous and incremental improvements to processes, including the removal of unnecessary activities and variations. Business Continuity Management should therefore be included as part of the continuous improvement process to ensure that it remains effective and workable and is embraced by every member of staff at all levels within the organisation.

13.3 Develop Awareness

It is necessary to communicate the Business Continuity message to all staff so that they are informed about the key principles of Business Continuity. This will embed it into the

______________________________________________________________________ ENISA 63

Risk Management

business culture so that it becomes second nature and is part of the organisation’s core values and effective management. There are various ways in which the information can be communicated:

• Training courses • Induction training • Scenario exercises and tests • Articles in the organisation’s newsletter • Visits to WARF • Inclusion on intranet • Agenda item on team meetings

Throughout the BCM programme and in the subsequent BCM maintenance cycle, staff at all levels should be consulted about Business Continuity and their ideas, if approved, incorporated in the BCP.

______________________________________________________________________ ENISA 64

Risk Management

14 Bibliography

ANAO The Australian National Audit Office. Audit Report No. 53 2002-2003. Business Continuity Management Follow-on Audit

APRA Australian Prudential Regulatory Authority

136Hhttp://www.apra.gov.au

APS 232 Australian Prudential Regulatory Authority - APS 232, 2005, Business Continuity Management.

BASEL II Basel Committee on Banking Supervision, Risk Management Principles for Electronic Banking, May 2001 137Hwww.bis.org

BCI GPG Business Continuity Institute Good Practice Guidelines 2007 - A Management Guide to Implementing Global Good Practice in Business Continuity Management

BILL 198 3rd Session, 37th Legislature, Ontario 51 Elizabeth II 2002. Bill 198 – Chapter 22, Statutes of Ontario, 2002. An Act to Implement Budget Measures and Other Initiatives of the Government. 138Hhttp://www.ontla.on.ca/bills/billsfiles/38_Parliament/Session2/b198.pdf

BS 7799-3 British Standards Institute. BS 7799-3:2006. Information Management Systems - Part 3: Guidelines for Information Security Risk Management

BS 31100 DPC British Standards Institute. BS 31100 Draft for Public Comment – Code of Practice for Risk Management

BS 25999-1 British Standards Institute. BS 25999-1. Business Continuity Management.

CC ACT Statutory Instruments No. 2042, 2005. The Civil Contingencies Act 2004 Regulations 2005. 139Hhttp://www.coordination.gov.uk/upload/assets/www.ukresilience.info/final regs.pdf

UK Act of Parliament. The Civil Contingencies Act 2004 – Chapter 36. 140Hhttp://www.opsi.gov.uk/acts/acts2004/ukpga_20040036_e n_1 COBIT CobiT, Control Objectives for Information and related Technology, IT Governance Institute 141Hwww.isaca.org DH BCM The Definitive Handbook of Business Continuity Management Andrew Hiles (Editor), Peter Barnes (Editor)

______________________________________________________________________ ENISA 65

Risk Management

John Wiley & Sons Ltd, London - 2001 ISBN: 978-0-471-48559-9

ENISA Regulation EC no 460/2004 of the European Parliament and Regulation of the Council of 10 March 2004 establishing the European Network and Information Security Agency 142Hwww.enisa.europa.eu

ENISA RM ENISA Report - Risk Management: Implementation Principles and Inventories for Risk Management/Risk Assessment Methods and Tools, 2006 143Hhttp://www.enisa.europa.eu/rmra/files/D1_Inventory_of_M ethods_Risk_Management_Final.pdf

FEMA Federal Emergency Management Agency (FEMA) - U.S. Department of Homeland Security Emergency Management Guide for Business & Industry

144Hhttp://www.fema.gov/business/guide/index.shtm

FSA Financial Services Agency (UK). Business Continuity Management Practice Guide, 2006. 145Hwww.fsa.gov.uk

HB 221-2004 Standards Australia/Standards New Zealand. HB 221-2004, Business Continuity Management.

HB 254-2005 Standards Australia/Standards New Zealand. HB 254-2005. Handbook. Governance, Risk Management and Control Assurance

HB 292-2006 Standards Australia/Standards New Zealand. HB 292-2006. Handbook. A Practitioners Guide to Business Continuity Management.

HB 293-2006 Standards Australia/Standards New Zealand. HB 293-2006. Handbook. Executive Guide to Business Continuity Management.

EHS BCM Dominic Elliott, Brahim Herbane, Ethne Swartz Business Continuity Management: A Crisis Management Approach Routledge Editions - 2006 ISBN-13: 978-0415371087

ISO 27000 ISO/IEC 27000 family - Information technology - Security techniques - Information security management systems - Overview and vocabulary

ISO 27001 ISO/IEC 27001:2005 - Information technology - Security techniques - Information security management systems – Requirements

ISO 27002 ISO/IEC 27001:2005 - Information technology - Security techniques - Code of practice for information security management.

______________________________________________________________________ ENISA 66

Risk Management

IT Grundschutz BSI Standard 100-2: 2005 - BSI-Empfehlungen des zu Methoden, Prozessen und Verfahren sowie Vorgehensweisen und Maßnahmen mit Bezug zur Informationssicherheit

146Hwww.bsi.de ITIL Information Technology Infrastructure Library. ITIL v3; OGC – UK Office of Government Commerce

147Hwww.ogc.gov.uk

Also referred in: ISO/IEC 20000:2005, Information technology - Service management 148Hwww.iso.ch

NFPA National Fire Protection Association. NFPA 1600. Standard on Disaster/Emergency Management and Business Continuity Programs. 2007 Edition

NIST National Institute of Science and Technology. NIST SP 800- 34. Contingency Planning Guide for Information Technology Systems

PAS 77 British Standards Institute. Publicly Available Specification PAS 77: 2006. IT Service Continuity Management Code of Practice

PDD 67 Presidential Decision Directives. PDD-NSC-67 – Enduring Constitutional Government and Continuity of Government Operations (U). 21 October 1998.

149Hhttp://www.fas.org/irp/offdocs/pdd/pdd-67.htm SOX 107th Congress of USA - Sarbanes-Oxley Act of 2002, H.R. 3763. An Act to protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to the securities laws, and for other purposes, 23 January 2002 150Hhttp://www.sarbanesoxley.com/search.php?q=sarbanes+oxley+act

TR 19:2005 Spring Singapore Technical Reference. TR 19:2005. Technical Reference for Business Continuity Management

14.1 Standards under development

- International Standards Organisation. ISO/PAS 22399 – Societal Security - Guideline for Incident Preparedness and Operational Continuity Management

- Bundesamt für Sicherheit in der Informationsverarbeitung (Federal Office for Security in Information Technology). BSI Standard 100-4.

- British Standards Institute. BS 25777. IT Service Continuity.

______________________________________________________________________ ENISA 67

Risk Management

- International Standards Organisation. ISO/IEC FDIS 24762:2007(E) - Information Technology - Security Techniques - Guidelines for Information and Communications Technology Disaster Recovery Services.

______________________________________________________________________ ENISA 68

Risk Management

15 Websites

Website Background

151Hwww.thebci.org Business Continuity Institute – information on BC standards, good practice, training courses, Forums and certification 152Hwww.itil.org.uk IT Infrastructure Library – information on the various parts of the handbook 153Hwww.drj.com Disaster Recovery Journal

154Hwww.continuitycentral.com Current BC news, topics, white papers and recruitment 155Hwww.contingencyplanning.com Contingency Planning and Management

156Hwww.drii.org Disaster Recovery Institute International 157Hwww.docleaf.com Crisis management concentrating on the human aspect 158Hwww.bsi.de German Federal Office for Security in Information Technology (Bundesamt fur Sicherheit in der Informationstechnik) 159Hwww.ukresilience.info UK Government website for civil protection practitioners 160Hwww.preparingforemergencies.gov.uk UK website on preparing for emergencies, aimed at businesses, the voluntary sector and the public 161Hwww.globalcontinuity.com Global portal for Business Continuity, Disaster Recovery and Risk Management specialists. 162Hwww.continuityforum.org The Continuity Forum provides independent advice, information and support to the private and public sectors covering all aspects of BCM, Disaster Recovery, Crisis Management, Emergency Planning and Security. It is an independent NGO that specialises in providing practical information, assistance and guidance to organisations of all types that need to create effective Business Continuity Management programmes 163Hwww.nasp.org.uk National Association of Security Professionals. Providing information on worldwide security, private guarding, company guarding and close quarter protection 164Hwww.the-sia.org.uk The Security Industry Association administers the licensing of the private security industry as set out in the 165HPrivate Security Industry Act 2001. It also aims to raise standards of professionalism and skills within the

______________________________________________________________________ ENISA 69

Risk Management

Website Background

private security industry and to promote widespread use of best practice 166Hwww.fsc.gov.uk A website resource established by the UK's Tripartite Authorities (HM Treasury, the Bank of England and the Financial Services Authority) to provide a central point of information about work on continuity planning relevant to the UK's financial sector 167Hwww.epcollege.gov.uk The Emergency Planning College is part of the UK government, established within the Civil Contingencies Secretariat (CCS) of the Cabinet Office 168Hwww.bs25999.com Online resource for help and information regarding the standard for BC planning 169Hwww.itgovernance.co.uk Specialist services and solutions for IT governance, Risk Management, compliance and information security 170Hwww.securityforum.org The Information Security Forum (ISF) is the world's leading independent authority on information security 171Hwww.isfsecuritystandard.com The Standard of Good Practice for Information Security (the Standard) is the foremost authority on information security 172Hwww.mi5.gov.uk Current information on UK security threat level and portal to Preparing for the Unexpected 173Hwww.the-eps.org The Emergency Planning Society

174Hwww.fema.gov Agency of the US government tasked with Disaster Mitigation, Preparedness, Response & Recovery planning.

______________________________________________________________________ ENISA 70

APPENDICES

Risk Management

Appendix A: Business Continuity for SME essentials

A.1 Introduction

For small businesses the potential impact of the risks they face is likely to be more destructive since the majority operate in specialised markets where even a short interruption to normal business can have a disproportionate effect – totally halting output and letting customers down. In addition it is more difficult fro small firms to absorb the financial impact of business interruption, making recovery more difficult even after a return to normal operations.

A.2 Implementing Business Continuity

A.2.1 Project Management

Writing a Business Continuity Plan should be treated just like any other project and a project manager should be appointed. This ensures that the plan is written to specification, within budget and on time, all critical targets for a small business.

A.2.2 Basic Emergency procedures

The first part of an effective Business Continuity Plan is the Emergency Procedures, and small businesses should ensure that:

• Employees understand the evacuation procedures; • Employees know what to do if a fire breaks out; • Employees know what to do if a colleague is injured; • Roles and responsibilities have been assigned for evacuation and first aid; • All staff have been trained in their roles; • Alternate muster sites have been determined if it is not considered safe to remain close to the building; • An indoor emergency muster site has been identified, so staff can remain together safe, warm and dry while the next steps are decided.

A.2.3 Identify threats, assess risks and quantify impacts of loss

Business Continuity is one method of risk treatment and before it can be decided what should be included in the Business Continuity Plan, it is necessary to understand the threats that the small business faces, the risks that these threats pose and the impact of loss should the risk occur. Although these risks may be similar to those faced by larger firms, the impact can be much worse.

Some of the threats which a business faces include (but are not limited to):

• Fire/flood • Computer/telecoms failure • Key equipment failure • Personnel issues • Denial of access • Employee theft • Email viruses • Computer hacking • Loss of data • Product defects • Bomb/terrorism threat • Legal/regulatory action • Utilities failure

______________________________________________________________________ ENISA 72

Risk Management

Once the threats are understood, the risks can be identified and a risk score assigned, based upon the likelihood of their occurring and their potential impact. The risks should be recorded in a Risk Register in order of priority.

It is much more effective to manage risks proactively and to prevent them from occurring than to try to recover reactively from an unforeseen event. A prioritised list of risks allows a small business to see where their greatest risks lie and to determine where their efforts should be expended for active prevention.

A.2.4 Perform an impact assessment

The last part of this stage of the work is to identify the critical processes and to calculate how long the organisation could survive if they were not to be carried out. In this stage the following questions about the resources upon which critical processes depend are considered:

• Which buildings does the organisation work from? • Can anyone in the organisation work from another location? • Who are the critical staff? • Can anyone else do their job (internal or external)? • What is the reliance on internal and external information and data? • What are the critical systems? • What telephony system is used? What are the option if it fails? • What servers do the critical systems run from? • Where is the data stored? • How often is the data backed up? • What media is used to back up the critical information? • Where is the data backed up? • Who are the external suppliers? • What are the suppliers’ continuity arrangements?

The impact of the unavailability of any of the critical resources is to be calculated. For example, if the building were inaccessible, a system failed, critical data were lost or the telephones were to go down. The impact could be a loss of reputation, failure to provide goods or services on time thus incurring penalty charges, poor customer service, a health and safety issue or a beach of regulatory requirements.

A.2.5 Develop the recovery strategy

Once the organisation understands their key risks, knows what their critical processes are, for how long they could remain non-operational, and what would be the impact of a critical resource failing, a strategy can then be developed for dealing with continuity problems should they arise. Strategies should cover:

• Alternate working locations (this could be as simple as relocating to a Director’s house); • Access to the systems from the alternate location; • Arranging for data back ups to be carried out automatically and stored off site; • Enabling data back ups to be accessed from alternate locations; • Enabling remote working; • Cross training; • Storage of installation disks so they can be accessed if the building is unavailable; • Storing license keys, insurance details and employee information securely off site; • Identification of an Emergency Operations centre; • Priority of recovery of business processes; • Priority of recovery of essential technology; • Identification of alternate suppliers and establishing a supply contract with them;

______________________________________________________________________ ENISA 73

Risk Management

• Maintain an up to date maintenance schedule for all equipment (technology, electrical, fire extinguishers, smoke alarms, emergency lighting etc...); • Ensure that the building meets all local fire regulations; • Document all critical processes; • Archive information; • Ensure that insurance details are up-to-date and decide whether to subscribe to business-interruption insurance.

A.2.6 Create a Business Continuity Plan

Despite risk prevention measures being implemented, problems will still occur and in order to ensure that these problems can be dealt with effectively while minimising the impact to the organisation, a Business Continuity Plan (BCP) should be written.

The Business Continuity Plan should cover:

• Emergency Response procedures (life, health, safety, exit routes, evacuation, emergency notifications, muster points etc…); • Disaster Recovery (recovery and resumption of information systems hardware, software, data and network); • Business Recovery (recovery and resumption of critical business processes).

It should be written to cover the worst-case scenario of business-operations interruption. This is often loss of premises.

A checklist of items to include in the BCP is given below:

• BC Project Manager’s name and contact details • Management team who will make key decisions • Contact details to enable the team to be brought together • Nominated control centre as a meeting point • Identification of business critical processes • Skills matrix • Details of how a recovery would be phased (emergency response, recovery of critical processes, resumption of normal operations) • Telephone divert arrangements • Emergency contact number employees to obtain the latest information • Resource requirements (people, work area, technology (IT and telecoms) • Details of recovery resources • Contacts for internal and external agencies committed to supporting the recovery efforts • Address of the recovery site (this may be a reciprocal arrangement with a neighbour, a room in one of the Directors’ houses, a meeting room in a management facility) • Location of an internal shelter in case an evacuation is not possible • Contents and storage location of a disaster pack • List of key customers, suppliers, third parties and their contact details • Comprehensive team cascade list • Network diagrams and other technical information • Precautions to be taken in the event of an incident (e.g. water shut off, how to power down the servers, gas supply shut off) • Communications Plan (who will communicate with staff, customers, shareholders, the emergency services etc. and what they will say)

The organisation should work out whether the business is large enough to require recovery teams. For a business of approximately 20 employees or less, one plan should be sufficient with one team responsible for effecting recovery.

______________________________________________________________________ ENISA 74

Risk Management

An organisation of 20 to 40 staff members may use four recovery teams, which cover:

• Emergency response and damage assessment • Crisis management and administration • Information systems and voice and data • Core business and support function

A small business which has from 40 to 80 employees may use up to eight recovery teams:

• Emergency response • Damage assessment and reconstruction • Crisis management • Administration • Corporate support • Information systems • Voice and data • Core business

Taking the recovery one stage further, an organisation of up to 140 employees may use the previously mentioned eight recovery teams, but split the core business team into three additional teams or they may wish to split the Information Systems team into two teams.

Therefore the bigger the business the more recovery teams will be required and each team will have a Team Leader and a deputy. The Team Leader is responsible for developing their own team’s plan. Once the team plans are completely developed, the administrator needs to review each plan for accuracy and detail. The information gathered in the business impact assessment can be used as a reference point.

To support the emergency and recovery phases a supply kit should be created, which includes essential items in case of an emergency. This could include:

• Water • Food • First aid kit • Torches • Radio and batteries • Pay-as-you go mobile phone and charger • Tarpaulins • Cleaning supplies • Gloves (rubber and leather) • Plastic bags • Camera • Tool kit • Duct tape • Blankets • Business Continuity Plan • Critical information (on a memory stick or CD) • Paper copies of critical pro-formas and procedures

______________________________________________________________________ ENISA 75

Risk Management

A.2.7 Test the Plan

Once the plan has been agreed it should be communicated to work teams. This will expose any flaws in the plan and will also ensure all the roles and responsibilities are understood. It is worth completing a test simulation of the plan to ensure that it will run smoothly if and when it is needed.

A.2.8 Regularly update the Plan

The plan should be reviewed at least every six months. It should be checked to make sure that it includes correct contact details for the recovery site, vital records, suppliers and the team.

The plan should be distributed to everyone with assigned responsibility and these individuals should be advised to keep copies off-site. Team meetings are opportune moments to remind all employees of the process to follow.

A.3 Bibliography

• AXA Insurance UK plc. Business Continuity Guide for Small Businesses

• DRJ Business Continuity Resource Centre for the Small/Medium Sized Business. The Small and Medium Size Businesses Guide to a Successful Continuity Programme

• US Small Business Administration. Expect the Unexpected – Prepare Your Business for Disaster

• Hester, Robert F. Business Continuity for Small Businesses. 175Hwww.continuitycentral.com/feature0216.htm

• Wilson, Belinda. The Myths of Business Continuity and Disaster Recovery. 176Hwww.continuitycentral.com/feature0139.htm

______________________________________________________________________ ENISA 76

Risk Management

Appendix B: Example of Business Continuity Management Policy

B.1 Introduction

All entities of the River Bank must have detailed Business Continuity Plans in place to ensure that critical business processes can be continued in the event that a serious unplanned event occurs, which may disrupt the normal execution of those processes.

B.2 Scope

This Business Continuity Management (BCM) Policy covers the functions contained within the Bank’s Head Office campuses in Perth and forms the basis for all Business Continuity Planning activities.

B.3 BCP Drivers

• Regulation − The FSA recommend that wholesale payments, trade clearing and settlement should be recovered to 60%-80% of normal values and volumes within 4 hours, rising to 80%-100% by the next working day − Data Protection Act − Health and Safety • Customer Service − River Bank has been voted the “No. 1 Bank for Customer Service”, for the third year running • Current and emerging risks − The River Tay floods on average every 5 years and Riverside House was flooded 4 years ago − The rise in demand for mortgages has been a significant challenge both in terms of staffing, ICT and IS

B.4 BCP Objectives

In the event of a disaster, it is River Bank’s aim to meet the following objectives:

• Maintain a healthy and safe working environment to ensure staff and customers’ safety, welfare and confidence • Fulfil regulatory requirements • Maintain integrity of customer information • Continue to operate critical business processes at a level of operation that meets regulatory requirements or for non-regulated critical process at a level of operation which is acceptable to management • Provide timely availability of all key resources necessary to operate critical business processes • Maintain customer/staff/River Bank stakeholders contact and confidence and to continue to be considered the “No. 1 Bank for Customer Service”

______________________________________________________________________ ENISA 77

Risk Management

• Control of expenditure/lower extraordinary costs caused by event • Management of risk – apply a Risk Management framework to priority areas

B.5 Stakeholders

The following groups of people can be defined as the stakeholders within River Bank:

• Staff • Directors • Customers • Regulators • Shareholders

B.6 Activities

The Business Continuity Management Policy covers the following activities:

Project Description Phase

Define BCM Coordination and Management of Business Continuity Planning Framework Activities This is the ongoing process of ensuring that the Business Continuity measures are coordinated and controlled. There will be a regular review and agreement made to ensure that Business Continuity Planning measures implemented in the various River Bank locations are uniform, covering the interfaces and inter-dependencies between each location. Business Business Impact and Risk Analysis Impact This is the process for managing overall River Bank risks through the Risk Analysis Management process and identifying which of these have a Business Continuity aspect, requiring preparation, active review and management attention. The impact of each risk will be assessed, their priority assigned and the requirements determined for each of the critical processes.

BCM Business Continuity Strategy Development Approach This is the process of identifying critical business functions and the personnel, IT and infrastructure required to support these functions in an incident. It also includes identifying suitable alternative locations, from which work can continue in a incident and the identification of ‘workaround’ procedures in the absence of IT functionality. Deliver BCP Business Continuity Plan Development This is the process of documenting the Business Continuity Strategy in such a way that it is of practical use in an incident and that it fulfils business, regulatory, training and audit requirements. The plan should contain sufficient detail to allow the recovery and resumption of critical business processes and the supporting infrastructure and resources identified in the Business Continuity Planning Strategy. Test BCP Business Continuity Plan Tests This is the verification process, to ensure that the BCP actually works and that the technology can be recovered to meet business requirements

______________________________________________________________________ ENISA 78

Risk Management

Project Description Phase

Sustain Training of Staff and Maintenance and Review of BCP BCM All staff with an involvement in BCM should be trained so that they are familiar with the BCP and are confident in their roles. The BCP must be continuously monitored to ensure that changes in the way business functions are undertaken and changes in the supporting infrastructure are reflected in the Business Continuity Strategy and Plan Improvements identified as a result of testing and training will also be made to the BCP. All changes must be assessed as part of change management.

B.7 BCM Operational Framework

The Business Continuity Steering Committee (BCSC) is responsible for defining and maintaining the framework for Business Continuity Management (including policy, strategy, overall implementation, plan documentation structure – including provision of business and support unit templates – tests and training concept, review and change management concept) and for initiating tests and reviews.

The Business Continuity Manager will be responsible for day to day management of the BCM programme and delivery and implementation of the BCP.

It is the responsibility of the business units to ensure that they have enough information in their specific section of the Business Continuity Plan to enable them to recover from an incident and continue to provide a service to clients within acceptable timeframes. Each Business Unit should nominate a member of staff to be their Business Continuity Coordinator.

It is the responsibility of the support units to ensure that they have enough information in their specific section of the Business Continuity Plan, to enable them to recover the infrastructure and services required to support business recovery activities within Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).

An Incident Management Team will be established to manage Level 3 and 4 Incidents.

B.7.1 Review and Audit

The Bank’s Internal Auditor shall consider coverage and review of this policy during the course of the annual audit programme or for any ad hoc investigations.

B.8 Invocation

Incidents are defined to be one of four levels of significance. The level of an incident is initially set by the Incident Management Team (IMT). However, the Senior Management Team has full discretion over the assigned level. Typically full invocation of the BCP only occurs given a level 3 or 4 incident and is based on the RTO.

The four levels of escalation for an incident are defined in the following table.

______________________________________________________________________ ENISA 79

Risk Management

Level Description One or more of the following apply:

1 Minor incident • The incident is unlikely to affect critical business (Normal Operating operations Procedures Apply) • The incident can be dealt with and closed at an operational level by the functional unit • Senior Management Team involvement not required

2 Minor disruption to • Critical business process interrupted (expected to be critical business dealt with inside the critical process RTO) process • Senior Management Team notified (Normal Operating Procedures Apply)

3 Significant • Access is denied to the work environment, or key disruption facility, key supporting technology component or data and is expected to go beyond 24 hours • Critical business process is interrupted (may go beyond the process MAO) • Senior Management Team involvement is mandatory

4 Major disruption • Access is denied to the work environment, or key facility, key supporting technology component or data and is expected to go beyond the key resource MAO • Critical business process interrupted (expected to go beyond the process RTO) • Senior Management Team involvement is mandatory

B.9 Glossary

Definition of terms used in the Policy.

B.10 Bibliography

List of any reference material which has been referred to e.g. FSA, HM Treasury and the Bank of England Resilience Benchmarking Project.

______________________________________________________________________ ENISA 80

Risk Management

Appendix C: Application Form for methods

C.1 Product Identity Card

1. General information

Method or tool name Vendor / Publisher name Country of origin

2. Level of reference of the product

3. Identification

Define BCM Business Design BCM Deliver BCP Test BCP Sustain BCM Framework Impact Approach Programme Analysis

If Define BCM Framework method: BCM Framework Included? (-, ●..●●●) Comments activities Initiate BCM Programme Assign BCM Responsibilities Define BCM Policy Assign Incident Teams

If Business Impact Analysis method Business Impact Included? (-, ●..●●●) Comments Analysis processes Identify the organisation Assess Risks & Impacts Analyse Results Prioritise Recovery & define critical resource requirements

If Design BCM Approach method Design BCM Included? (-, ●..●●●) Comments Approach processes Design Recovery Strategy

Design Recovery Profile Design BCP

______________________________________________________________________ ENISA 81

Risk Management

If Deliver BCP method Deliver BCP Method Included? (-, ●..●●●) Comments processes Incident Response Plan Business Recovery Plan Incident Management Plan Business Resumption Plan Communications & Media Plan IT Service Continuity Plan Recovery Support Plans: • Facilities • HR • Health & Safety • Telephony

If Test BCP method Test BCP Method Included? (-, ●..●●●) Comments processes Determine type of test Write test plan Conduct Test Deliver Debrief & Test Report

If Sustain BCM Programme method Sustain BCM Included? (-, ●..●●●) Comments Programme processes Train Staff Maintain & Review BCP Develop Awareness

Brief description of the product:

4. Lifecycle

Date of the first release Date and identification of the last version

5. Useful links

Official web site User group web site Relevant web site

______________________________________________________________________ ENISA 82

Risk Management

6. Languages

Availability in European languages

7. Price

Free Not free Updating fee

C.2 Scope

1. Target organisations

Government, Large SME Commercial Non commercial agencies companies companies companies Specific sector

2. Geographical spread

Used in EU member states Used in non-EU countries

3. Level of detail

Management Operational Technical

4. License and certification scheme

Recognised licensing scheme Existing certification scheme

C.3 Users Viewpoint

1. Skills needed

To introduce To use To maintain

2. Consultancy support

Open market Company specific

3. Regulatory compliance

4. Compliance to IT standards

5. Trial before purchase

CD or download available Identification required Trial period

6. Maturity level of the Information System

It is possible to measure the I.S.S. maturity level

7. Tools supporting the method

Non commercial tools Commercial tools ______________________________________________________________________ ENISA 83

Risk Management

8. Technical integration of available tools

Tools can be integrated with other tools

9. Organisation processes integration

Method provides interfaces to other organisational processes

10. Flexible knowledge databases

Method allows use of sector adapted databases

______________________________________________________________________ ENISA 84

Risk Management

Appendix D: Application Form for Tools

D.1 Identity Card

1. General information

Tool name Vendor name Country of origin

2. Level of reference of the tool

World-wide (state World-wide (sector Regional (e.g. Local oriented) oriented) European directive)

Supported by organisation, club,…(e.g. as sponsor)

3. Brief description of the product

4. Supported functionality

BCM Framework Supported or not Comments activities Initiate BCM Programme Assign BCM Responsibilities Define BCM Policy Assign Incident Teams

If Business Impact Analysis Method Business Impact Supported or not Comments Analysis processes Identify the organisation Assess Risks & Impacts Analyse Results Prioritise Recovery & define critical resource requirements

If Design BCM Approach Method Design BCM Supported or not Comments Approach processes Design Recovery Strategy

Design Recovery Profile Design BCP

If Deliver BCP Method Deliver BCP Method Supported or not Comments ______________________________________________________________________ ENISA 85

Risk Management

processes Incident Response Plan Business Recovery Plan Incident Management Plan Business Resumption Plan Communications & Media Plan IT Requirements & Gap Analysis IT Service Continuity Plan Recovery Support Plans: • Facilities • HR • Health & Safety • Telephony

If Test BCP Method Test BCP Method Supported or not Comments processes Determine type of test Write test plan Conduct Test Deliver Debrief & Test Report

If Sustain BCM Programme Method Sustain BCM Supported or not Comments Programme processes Train Staff Maintain & Review BCP Develop Awareness

Other functionality: Name Description

Information processed Name Description

______________________________________________________________________ ENISA 86

Risk Management

5. Lifecycle

Date of first release Date and identification of the last version

6. Useful links

Official web site User group web site (optional) Relevant web site:

7. Languages

Languages available

8. Pricing and licensing models

Free Not free Maintenance fees

Sectors with free availability or discounted price

9. Trial before purchase

CD or download available Identification required Trial period(days)

10. Tool architecture

Technical component Purpose Comment Database Web server Application Server Client

D.2 Scope

1. Target organisations

Government, Large scale SME Commercial Non commercial agencies companies CIEs CIEs

Specific sector :

2. Spread

General information World-wide in many different organisations Used inside EU countries Used outside EU countries

3. Level of detail

Level Tool functions Comment Management Operational Technical

______________________________________________________________________ ENISA 87

Risk Management

4. Compliance to IT Standards

Standard Compliance notice Comment

5. Tool helps towards a certification

Certification according to standard Comments

6. Training

Course Duration Skills Expenses

D.3 Users Viewpoint

1. Skills needed (Global IT)

Skills Comments To install To use To maintain

2. Tool support

Support method Comment

3. Organisation processes integration

Role Functions

4. Interoperability with other tools

Integration Method Tools

5. Sector adapted knowledge databases supported

Database Name Contents

6. Flexibility of tool’s database

Database Name Comments

______________________________________________________________________ ENISA 88

Risk Management

Appendix E: Guidance for Business Continuity Planning tools

What should a Business Continuity Planning tool do?

A BCP solution should provide the capability to constantly update all aspects of the Business Continuity Plan of the enterprise and allow individual parts of the organisation to update and maintain their own part of the plan. From a plan governance perspective it should support monitoring of each BCP in accordance with predefined review frequencies, reporting on out-of-date and incomplete information.

Critical records

Vital records cover a spectrum of hardcopy documents and electronic files, many of which are subject to laws and legislation dictating how they must be processed, stored and protected.

A BCP solution should provide the capability to maintain a vital records inventory mapped to the processes and technologies create and maintain it.

Recovery and Continuity Plans

The ultimate purpose of any Business Continuity initiative is to create a viable plan to ensure availability of key services, together with a collection of procedures which clearly communicate the activities that should be performed in order to re-establish services to the required level. Historically this has involved generating paper or static documents.

With the increased reliance on both technology and inter-dependence inside and outside an organisation, BCPs need to be responsive to change and a BCP solution needs to support plan standardisation, maintenance and evidence of review.

Managing Recovery processes and components

Regardless of the methodology employed to create it, a BCP should consist of a number of key pieces of information:

• where to go • systems to recover • data to recover • network and infrastructure to be restored • restoration processes for systems and business activities • people to carry it out

Any planning tool should provide the capability to capture this information as well as a framework to monitor it going forward, in order to provide reasonable assurance that the plan reflects the organisation’s risk profile and that, if invoked, the plan is likely to work.

Testing

Creating plans that are subsequently forgotten is not sufficient, they must be tested regularly to confirm their effectiveness and to identify and correct problems before an actual interruption occurs. A BCP solution should provide an organisation with the capability to schedule tests, record the results and monitor remediation efforts.

Regulators and auditors need more than verbal assurance that tests have been conducted. They require proof that tests have been conducted, that test results have been evaluated, and that remedial action if required is under way and its progress monitored.

______________________________________________________________________ ENISA 89

Risk Management

Governance

With so much attention directed towards a firm’s Risk Management controls and internal governance program, a key attribute for any BCP solution is to provide the necessary capabilities to facilitate the standard and processes that collectively comprise a ‘Business Continuity Management (BCM) Framework’. This implies that all of the required features of a robust BCP framework such as risk and impact analysis, planning, plan review and plan testing are supported by the tool. Just as important, however, are features that ensure these processes are being performed and, when they are not, that the appropriate individuals are notified. These features provide transparency, auditability of the BCP together with the assurance that the organisation is in a reasonable state of readiness.

What makes a Business Continuity tool effective?

An overriding requirement of a BCP solution is that it provides an enterprise-wide framework managing a wide array of structured and unstructured information, collectively forming the organisation’s BCP. The Supplier Directory section provides detailed responses from suppliers in terms of the capabilities of their solutions. Notwithstanding these features, our experience has shown that there are five key attributes that should be present in any solution for it to be an effective tool:

Pervasive – the production of plans is subsumed within an enterprise-wide process that enforces the plan governance process

Consistent – all information related to the plan is produced and managed in the same way

Persistent – exceptions, out-of-date plans, incomplete plans are identified and clearance is monitored and reported

Unavoidable – documents and records related to the plan can only be produced via the prescribed methods and are subject to pre-defined approval cycles

Transparent – the status of any document or record and the overall governance process is visible to all members of the enterprise who have an interest or responsibility for it. The collective status of documents or records can be assessed providing a barometer of the firm’s state of readiness.

In order to deliver these key attributes, any solution must leverage a number of key technologies within its design. The basic requirements are search, workflow, version management, categorisation and mail enablement.

Search

Search tools help to gather all types of information relating to a particular subject. They help users to locate what they need on an ad hoc basis without having to rely on predefined queries.

Workflow

Workflow is generally the means by which approval and review cycles are enforced upon different types of information. By using workflow techniques, firms can ensure that changes to plans are properly authorised and are ‘fit for purpose’.

______________________________________________________________________ ENISA 90

Risk Management

Versioning provides an all important audit trail from the current form of a document to its original state. Keeping prior versions of plans provides not only an audit trail of changes but can assist in the review of changes.

Categorisation

Categorisation is the means by which unstructured information becomes usable in a structured way. There are basically two ways to achieve categorisation:

• create a relational database model and migrate existing information from various sources into the database

• create a managed document repository whereby all documents pertaining to the plan are created and maintained in the repository. Meta Data is then created to provide multiple levels of categorisation for documents which can subsequently be ‘navigated’, rather like a website.

Categorisation of unstructured content provides the basis for ensuring the content is appropriately managed against various regulations and legal requirements throughout its life. For many organisations which have invested in comprehensive, document-based plans, categorisation capabilities provide the means by which documents can be collected and ‘viewed’ along differing lines, i.e. organisationally or by business process, without undergoing complex data conversion exercises.

Mail enablement

By linking to individuals with specific plan responsibilities via their e-mail address, an application becomes truly enterprise-enabled. Individuals can be alerted and reminded to address issues arising from their plans, with each e-mail containing a URL link to the records or documents they are responsible for. Although e-mail is an application often taken for granted, tools which leverage corporate e-mail systems can lower solution deployment costs and provide a pervasive ‘nervous system’ capable of addressing the whole firm, regardless of physical location.

______________________________________________________________________ ENISA 91

Risk Management

Appendix F: Process Maps of Methods and Good Practices from around the World

______________________________________________________________________ ENISA 92

Risk Management

F.1 HB 292

F.1.1 Process Map

F.1.2 Description

Section 2 – Commencement of Business Continuity Management

The commencement step establishes the infrastructure and much of the capability required for each of the other steps of the process. Commencement is concerned with creating awareness and understanding of BCM and the skills required, gaining the commitment and support of management and staff and establishing the organisational infrastructure programme management required for successful implementation. The sections below discuss the following themes in more detail:

• Awareness and Understanding • Gaining Management Commitment • The Need for Communication and Engagement • Gaining the Commitment of Others • Establishing the Infrastructure for BCM • Development of the BC Policy • Confirmation of Processes • Resource Allocation • BCM Programme Governance

Section 3 – Assessing Risks and Developing Disruption Scenarios

Risk Assessment is a critical step in the BCM process. It provides a means of identifying and prioritising the type of events that could cause disruption to the organisation and give a broad indication of the consequences of such events and their likelihood. This provides the key inputs upon which subsequent Business Impact Analysis can be developed. If the Risk Assessment process is approached from a broader risk perspective than just BCM, it can generate additional business value.

If the BCM practitioner liaises with the risk managers much effort may be saved since a considerable amount of the Risk Assessment may already have been undertaken by others.

The topics covered in this section include:

• What is Risk? • Using Risk Assessment in BCM • Communicate and Consult • Establishing the Context

______________________________________________________________________ ENISA 93

Risk Management

• Identifying Risk • Analysing Risk • Evaluating Risk • Treating Risk

Section 4 – Conducting the Business Impact Analysis

The BIA provides an analysis of how key disruption risks could affect an organisation’s operations and what capabilities will be required to manage them. The BIA comprises eight steps:

• Developing communications for the BIA • Confirming critical business functions • Identifying resource requirements • Establishing interdependencies • Determining the disruption impacts • Identifying the Maximum Tolerable Outage Times and Recovery Objectives • Identifying alternate workarounds and processes • Confirming current preparedness

Section 5 – Developing BCM Strategies

The development of BCM strategies is concerned with determining how an organisation will react to an incident and the manner in which the different elements of this overall response will interact. Typically there are three phases to an event and each phase will have a degree of overlap with the next. HB 292 defines the three phases as:

• The emergency response phase • The continuity phase • The recovery and restoration phase

A strategy is required for each of these phases which focuses on:

• Meeting regulatory, industry and organisational requirements • Providing adequate cost benefit returns • Matching strategic objectives with the practical realities of access to capabilities and resources

Section 6 – Assessing and Collating Resource Requirements

Once the strategies have been developed, resource requirements need to be confirmed as appropriate to achieving these strategies. This step involves collating the information from across all the functions which were analysed during the previous phase. It is important to ensure that the synergies and conflicts in resource availability, access and use are identified and managed.

Section 7 – Writing the Plan

One of the most important issues in writing a plan for managing a disruption is to ensure that it is written so that it can be understood and applied by those expected to use it. A plan should be written in such a way that it can be understood by someone who has not previously seen it. This section describes:

• The framework of plans • Content of plans – generic • Content of plans – specific • Continuity plan checklist

Section 8 – Developing the Communications Strategy

______________________________________________________________________ ENISA 94

Risk Management

It is vital that communications are considered to be one of the highest priorities throughout all BCM activities, both pre and post-event. The three broad areas for which development of a communication strategy are internal and external stakeholders, incident related communications, ongoing maintenance of developed plans. This section is divided into the following sub-sections:

• Communicating during and after an incident • Developing the written communications plan • Identifying stakeholders and their needs • Using IRACI • Communications strategy checklist

Section 9 – Maintenance of BCM

Plans can get out of date very rapidly, and even after a few weeks the effectiveness and relevance of plans begins to deteriorate. Also, in order for plans to be effective the relevant people need to know how to use them for them. A regular maintenance programme is therefore needed if plans are to remain fit for purpose. This section describes the following activities to ensure that a robust maintenance programme is established:

• Understanding – training and awareness • Performance • Assurance

Section 10 – Activation and Deployment

Following a disruptive event there will be a number of plans activated which will require overall central control and co-ordination. This section of the handbook describes:

• The co-ordination and control framework • Building disaster kits • Record keeping • Activation and deployment checklist

F.1.3 Detail

Section 2 – Commencement of Business Continuity Management Responsible: Accountable: Consulted: Inputs:

Output: BCM Policy; critical business objectives; disruption potential; communication framework; management commitment; resource plan; BCM programme governance

Section 3 - Assessing Risks and Developing Disruption Scenarios

Responsible: BCM Practitioner

Accountable:

Consulted: Risk Managers Inputs: Organisational Risk Assessments Output: BCM Risk Assessment; Risk Treatment Strategy

Section 4 – Conducting the Business Impact Analysis

Responsible: BCM Manager

Accountable:

Consulted: BC Planner; Business Function Owners Inputs: Risk Assessment

______________________________________________________________________ ENISA 95

Risk Management

Output: Business Impact Assessment; critical organisational objectives and performance levels; key personnel; normal operational resource requirements and minimum resource requirements; interdependencies; areas requiring workarounds; contact details for key stakeholders

Section 5 – Develop BCM Strategies Responsible: Accountable: Consulted:

Inputs: Business Impact Assessment Output: Emergency Response Strategy; Continuity Strategy; Recovery and Restoration Strategy

Section 6 – Assessing and Collating Resources Requirements Responsible: Accountable: Consulted:

Inputs: Business Impact Assessment Output: Resource Matrix

Section 7 – Writing the Plan Responsible: Accountable: Consulted:

Inputs: Regulatory requirements; industry standards; critical objectives; critical functions; Resource Matrix Output: Tier 1 Plans; Tier 2 Plans; Tier 3 Plans

Section 8 – Develop the Communications Strategy Responsible: Accountable: Consulted:

Inputs: IRACI Tool; Identified Stakeholders; emergency strategies; continuity and restoration strategies Output: Communications Plans

Section 9 – Maintenance of BCM Responsible: Accountable:

Consulted: Staff and internal and external individuals involved in all phases of BCM Inputs: Completed plans Output: Schedule of internal and external reviews, exercises and training

Section 10 – Activation and Deployment

Responsible: Management Accountable: Incident Controller

Consulted:

Inputs: Emergency Response Plans; BC Plans; Recovery and Restoration Plans Output: Incident Control System; disaster kits; Incident Log

F.1.4 Links

The Bibliography references a number of other BC publications.

______________________________________________________________________ ENISA 96

Risk Management

F.2 HB 221

F.2.1 Process Map

F.2.2 Description

Step 1 – Commencement

The scope, objectives and outcomes for the Business Continuity program or planning project are determined.

Step 2 – Risk and Vulnerability Analysis

A comprehensive understanding of the external and internal business drivers and constraints is obtained. Risks requiring mitigation through Business Continuity Planning are identified and prioritised.

Step 3 – Conduct a Business Impact Analysis

The potential operational and financial impacts of a disruption over time are determined. Critical business functions and processes that support achievement of key business objectives are identified. The resource requirements of critical business functions and processes that will allow a minimum acceptable level of operation are defined.

Step 4 – Define Response Strategies

Emergency Response: The criteria for activation, duration and stand-down of the immediate (emergency) response are defined.

NOTE: The principle purpose of the emergency response is the preservation of life and property.

Continuity Response: The criteria for activation, duration and stand-down of the continuity response are defined.

NOTE: The principle purpose of the continuity response is the continued delivery of a minimum acceptable level of performance.

Recovery Response: The criteria for activation, duration and stand-down of the recovery response are defined.

NOTE: The principle purpose of the recovery response is the staged return to a level of normal (pre-disruption) or improved capability and performance.

Step 5 – Developing Resource and Interdependency Requirements

Resource requirements are finalised and the approach to meet requirements is determined. The range and nature of external interdependencies are defined.

Step 6 – Develop Continuity Plans for the Chosen Strategy

Specialist and Organisation Plans: Plans are developed to cover specialist and organisation requirements for continuity and recovery. ______________________________________________________________________ ENISA 97

Risk Management

Continuity Plans: Continuity plans are developed and documented in a comprehensive and simple manner which allows the organisation to respond flexibly to a wide variety of potential disruption scenarios.

An organisation may determine that each business unit has specialised BCM plans that will be enacted and that the organisation will have an overarching BCM plan to manage the activities of each business unit and to coordinate assets required for restoration and recovery activities.

Step 7 – Develop a Communication Strategy

The purposes of different types of messages are defined in advance of any disruption.

Step 8 – Training, Maintenance and Testing Plans

Training: In the event of a disruption, plans can be implemented efficiently and effectively. Those with tasks that are part of the plans are fully aware of their responsibilities. Employee and management awareness of emergency procedures and the significance of Business Continuity is enhanced. Confidence in the ability to manage a disruption is improved. Through a robust regime of plan testing, effective awareness and training can be delivered.

Maintenance: Plans are revised on a regular basis to ensure that content reflects current risks, priorities, functions, personnel responsibilities and resource requirements.

Plan Testing: Plan inadequacies are identified and corrected. The feasibility of plan components is assessed and confirmed. Resourced requirements are clarified. Confidence in the ability to manage a disruption is improved. Auditors and insurers can be provided with documented proof of plan adequacy.

Step 9 – Activation and Development of Plans

Plans are activated according to the nature of the disruption and in an appropriate authorised manner. Post activation governance requirements are identified as part of the response plan and are managed during after the response is activated and stood down.

F.2.3 Detail

Step 1 - Commencement

Responsible: Senior Management/Board – for scope, budget and resources Accountable: Project Manager – for policy and strategy Consulted: Senior Management/Board Inputs: Budgets, risks, costs Output: Scope, objectives and outcomes

Step 2 – Risk and Vulnerability Analysis Responsible: Accountable:

Consulted: Management Inputs: Annual Reports, Corporate and business unit plans, management and board minutes, internal audit reviews, existing BC Plans, media reports Output: Environmental Analysis, management interviews, internal audit reviews, analysis of key infrastructure and processes

______________________________________________________________________ ENISA 98

Risk Management

Step 3 – Conduct a Business Impact Analysis Responsible: Accountable:

Consulted: Management and teams Inputs: Critical business objectives and success factors (from Steps 1 and 2), key risk exposures (from Step 2) Output: High level process map, minimum resource requirements; Maximum Acceptable Outage time (MAO); backlog impacts; alternative workarounds

Step 4 – Define Response Strategies Responsible: Accountable: Consulted:

Inputs: Existing Emergency Response plans, Emergency Command and co-ordination plans, etc… Output: Creation of Crisis Management Team (CMT). Criteria for activation, scale back and deactivation of an integrated suite of plans: • Emergency Response • Continuity Response • Recovery Response

Step 5 – Developing Resource and Interdependency Requirements Responsible: Accountable: Consulted:

Inputs: Minimum resourcing requirements (from Step 3); vital records, staff contact lists, operating and procedure manuals, IT technical recovery plan and procedures, alternative office locations, emergency expense payment authority/delegation, IT infrastructure, telecommunications support, office and specialist equipment locations, external interdependency contact details, stakeholder expectations, alternative relationships and sources for contract requirements Output: Confirm requirements from Step 3

Step 6 - Develop Continuity Plans for the Chosen Strategy Responsible: Accountable:

Consulted: Business units Inputs: Response strategy; interdependency requirements Output: Determine requirements for specialist plans; documented continuity plans

Step 7 - Develop a Communication Strategy Responsible: Accountable:

Consulted: Stakeholders, Board, Regulators Inputs: Regulatory requirements; communication channels; content pro forma Output: Who requires what information, how it is delivered and by whom

______________________________________________________________________ ENISA 99

Risk Management

Step 8 – Training, Maintenance and Testing Plans Responsible: Accountable: Consulted:

Inputs: BIAs; tests; changes in personnel, risks, priorities and functions Output: Documented results of tests for plan improvements; basic awareness for all staff; basic training for staff with roles/responsibilities; regular maintenance cycle and audits for the BCM process, plans, testing, training and BIAs

Step 9 – Activation and Development of Plans Responsible: Accountable:

Consulted: Insurance agents, regulators, etc… Inputs: Regulations, standards, policies and procedures, document control Output: Updates to current plans

F.2.4 Links

This standard contains no links to other standards.

______________________________________________________________________ ENISA 100

Risk Management

F.3 Australian Prudential Standard APS 232

F.3.1 Process Map

F.3.2 Description

Business Continuity is a requirement for Australian financial institutions, as decided by the Australian Prudential Regulatory Authority that released this standard.

As the document is 8 pages in length, it does not go into depth on any part of the process.

F.3.3 Detail

Step a – Risk Assessment

Responsible: Board of Directors

Accountable: Consulted: Inputs:

Output: Plausible disruption scenarios and likelihood of them occurring

Step b – Business Impact Analysis

Responsible: Senior Management

Accountable: Consulted:

Inputs: Legal and regulatory requirements; revenue by product; RTO Output: Identification of all critical business functions, resources and infrastructure; impact of disruption; priorities for recovery (validated by Senior Management)

Step c – Consideration of Recovery Strategies

Responsible: Senior Management

Accountable: Consulted:

Inputs: BIA data Output: Approved resources for implementation

Step d – Business Continuity Planning

Responsible: Board of Directors

Accountable: Consulted: Inputs:

Output: Includes: Documented procedures for recovery of critical business functions

______________________________________________________________________ ENISA 101

Risk Management

Resumption plans Resources required Communication plan

Step e – Establishing Business Continuity/Crisis Management Teams Responsible: Accountable: Consulted: Inputs:

Output: Composition of Teams; invocation procedures

Step f – Review and Testing Responsible: Accountable: Consulted: Inputs:

Output: Annual review (minimum if there is no change management process in place); testing program; test results

F.3.4 Links

Risk Assessments and testing are conducted in accordance with:

• AGN 232.1 Risk Assessment and Business Continuity Management • APS 310 Auditing and Related Arrangements for Prudential Reporting

______________________________________________________________________ ENISA 102

Risk Management

F.4 BS 25999-1

F.4.1 Process Map

F.4.2 Description

British Standard 25999-1 establishes the process, principles and terminology of Business Continuity Management (BCM) and provides a basis for understanding, developing and implementing Business continuity within an organisation.

It is intended for use by anyone with responsibility for business operations or the provision of services, from top management through all levels of the organisation.

The seven steps in the Business Continuity lifecycle as defined in BS 25999-1 are as follows:

Step1: The Business Continuity Management Policy (Section 4)

It is important to develop a Business Continuity Policy to ensure:

• All BCM activities are performed in an agreed manner • BCM capability meets changing business needs • A framework for ongoing BCM is established

This is achieved by taking the following measures:

• Put the BCM programme into context • Develop the policy • Determine the scope of the BCM programme • Review audited evidence of outsourced supplier Business Continuity Plans

Step 2: BCM Programme Management (Section 5)

Programme management is at the heart of the BCM process and this section describes what should be put in place to establish and manage BCM in the organisation

• Assign responsibilities • Implement BCM in the organisation • Manage the programme on an ongoing basis

Step 3: Understanding the Organisation (Section 6)

The BCM programme must be aligned to the organisation’s objectives, obligations and statutory duties and this is achieved by understanding the critical activities and resources which support them. The steps to reach this understanding are: • Conduct Business Impact Analysis • Identify Critical Activities • Determine continuity requirements ______________________________________________________________________ ENISA 103

Risk Management

• Evaluate threats to critical activities • Determine choices (i.e. accept, transfer, change, suspend or terminate the risk or develop a Business Continuity Plan to improve the organisation’s resilience to a disruption)

Step 4: Determining Business Continuity Strategy (Section 7)

As a result of the analysis in the previous stage of the BCM programme, the organisation can choose the appropriate continuity strategies to enable it to meet its objectives. Strategies should be considered for:

• People • Premises • Technology • Information • Supplies • Stakeholders

Development of these strategies should include familiarisation with local emergency responder bodies, so that the organisation’s recovery activities take into account the civil emergency capacity of their community.

Step 5: Developing and Implementing a BCM Response (Section 8)

In this section of the standard, BS 25999-1 describes the areas to be covered in the BCM response document(s):

• Incident response structure • Roles and responsibilities • Plan invocation • Document Owner and maintainer • Task and action lists • Emergency contacts • People activities • Media response • Stakeholder management • Incident management location • Resource requirements

Step 6: Exercising, Maintaining and Reviewing BCM Arrangements (Section 9)

This stage of the lifecycle ensures that all the plans which have been written and arrangements which are in place are kept fit for purpose and up-to-date.

• Exercising − Desk check − Walkthrough − Simulation − Alternate Site − Full BCP • Maintaining BCM Arrangements • Reviewing BCM Arrangements

Step 7: Embedding BCM in the Organisation’s Culture (Section 10)

Raising and maintaining awareness of BCM on the part of the organisation’s staff is important to ensure that they are aware of BCM's importance to the organisation. This is achieved through awareness-raising activities such as articles in the organisation’s newsletter, or on the intranet, inclusion of BCM in induction training and visits to designated alternate sites.

______________________________________________________________________ ENISA 104

Risk Management

Skills training is essential for any staff member with a BCM or incident role, and different training sessions should be identified for different skill areas.

F.4.3 Detail

Section 4 – The Business Continuity Management Policy

Responsible: Top Management Accountable: Board Director or Elected Representative

Consulted:

Inputs: Relevant standards; regulations or policies; identification of key activities Output: BCM Policy

Section 5 – BCM Programme Management

Responsible: Top Management Accountable: Board Director or elected representative Consulted: Management Inputs: BCM Policy Output: Establishment of BCM Programme

Section 6 – Understanding the Organisation Responsible:

Accountable: Top Management

Consulted:

Inputs: Risk Registers Output: Critical Activities; Impacts of Loss; Recovery Time Objectives; Risk Assessment

Section 7 – Determining Business Continuity Strategy Responsible:

Accountable: Top Management

Consulted:

Inputs: Maximum Tolerable Period of Disruption; BCM Risk Register; Critical Activities; Impacts of Loss Output: Strategies (people, premises, technology, information, supplies, stakeholders)

Section 8 - Developing and Implementing a BCM Response

Responsible: Nominated person Accountable: Board Sponsor Consulted: Top Management Inputs: BCM Strategies Output: Incident Management Plan; Business Continuity Plan

Section 9 - Exercising, Maintaining and Reviewing BCM Arrangements

Responsible: Top Management

Accountable: Consulted: Inputs:

Output: Exercise programme; post exercise report; BCM Maintenance programme; reviewed BCM arrangements; documented review results

Section 10 - Embedding BCM in the Organisation’s Culture Responsible:

______________________________________________________________________ ENISA 105

Risk Management

Accountable: Consulted: Inputs:

Output: Identified and delivered BCM awareness requirements; training programme for incident and BCM personnel

F.4.4 Links

BS 25999-1 references the following publications:

• BS EN ISO 9000, quality Management Systems – Fundamentals and Vocabulary • BS ISO/IEC 20000 (both parts), Information Technology – Service Management • BS ISO/IEC 27001, Information Technology – Security Techniques – Information Security Management Systems – Requirements • Civil Contingencies Act 2004, London, TSO

______________________________________________________________________ ENISA 106

Risk Management

F.5 BCI Good Practice Guidelines

F.5.1 Process Map

F.5.2 Description

The Good Practice Guidelines define the BCM process, requirements, outcomes and methods. This will provide a step-by-step guide to an organisation for undertaking a Business Continuity Programme but does not detail the roles and responsibilities.

Methodologies for BIAs and Risk Assessments are detailed.

F.5.3 Detail

Chapter 1 – BCM Programme Management Responsible: Accountable:

Consulted: External BCM practitioners (to review current situation/gap analysis Inputs: Statutory and Regulatory responsibilities; Good Practice Guidelines; Gap analysis; identification of clearly defined roles; responsibilities and authorities to manage the BCM programme; budget Output: BCM Policy (Scope and Governance); a scope and terms of reference document for the Business Impact Analysis and Risk Assessment; organisational definition of BC; implementation and maintenance plan for the Policy; roles, responsibilities and job specifications; project plan with clear deliverables, work estimates and budgetary requirements

Chapter 2 – Understanding the Organisation Responsible: Accountable: Consulted:

Inputs: BCM Policy Output: MTPD and justification thereof; RTO; Resource Requirements Analysis (RRA); Risk Analysis

Chapter 3 – Determining BCM Strategy Responsible: Accountable: Consulted:

Inputs: BCM Policy; RTOs and RRA Output: Formation of a Business Continuity Management Strategy Team; an agreed BCM strategy for each of the organisation’s products and services; BC options for each

______________________________________________________________________ ENISA 107

Risk Management

strategy; consolidated view of Resource requirements

Chapter 4 – Developing and Implementing BCM Response Responsible: Accountable: Consulted: Inputs:

Output: Incident Management Plan; Incident Communications Plan; a Business Continuity Plan which should be ‘signed-off’ by the Executive; a documented Operational Response Plan for each business activity or department; escalation procedure to Business Continuity Team; clearly defined BCM roles within the department

Chapter 5 – Exercising, Maintaining and Reviewing Plans Responsible: Accountable:

Consulted: Training timetable Inputs: BCM Policy (outlines timetable and responsibilities for the exercise programme and audit requirements); change management Output: Timetable for an exercise programme; exercises (testing staff, plans and the recovery infrastructure); post-exercise reports; a documented BC monitoring and maintenance programme; a clearly defined and documented BCM Maintenance Report Action Plan agreed and ‘signed off’ by an appropriate senior manager; an independent BCM audit opinion report that is agreed and ‘signed-off’ by senior Management; Remedial Action Plan

Chapter 6 – Embedding BCM in the Organisation’s Culture Responsible: Accountable: Consulted:

Inputs: The BCM Policy provides the framework for supporting the need and requirement for cultural change Output: A statement of the current level of awareness and effectiveness of staff to support BCM; Training Needs Analysis

F.5.4 Links

There are no formal links but BS 25999, ISO 17799 and the FSA are referred to throughout. ISO 27001 is mentioned under the heading of BCM Awareness.

______________________________________________________________________ ENISA 108

Risk Management

F.6 PAS 77

F.6.1 Process Map

F.6.2 Description

The ITSC strategy should enable the organisation to plan for and rehearse the whole lifecycle of a major incident from the point of initial disruption, through the recovery, to abnormal service and finally to the point where normal service levels are once again guaranteed. This is agreed at the Board level and the CEO is responsible.

The ITSC strategy should be a by-product of a Business Continuity Management Plan (BCMP) but can be defined without such a plan. Where a BCMP exists, those responsible for IT service levels are likely to have contributed to the plan and already be aware of the implications of that plan on the IT strategy and direction.

It must be noted that this is a developing standard and is subject to change as it develops and is accepted as BS 25777.

F.6.3 Detail

IT Service Continuity Strategy

Responsible: CEO Accountable: Board member Consulted: Board level Inputs: • priority for key business units at given moments in time • peak loads on business • strategically important business periods e.g. reporting • periods, manufacturing deadlines etc • compliance with Business Continuity Management • Plans and objectives • investment vs. risk • impact of failure or loss • recovery time objectives • acceptable levels of downtime and performance • system changes and upgrades • new projects • interdependencies • compliance with legislation • deadline management • rehearsing and rehearsing recovery plans • data protection • data availability • plan maintenance • education and awareness programmes for all IT staff

______________________________________________________________________ ENISA 109

Risk Management

Output: High-level methods

Understanding Risks and Impacts within Your Organisation Responsible:

Accountable: Board member

Consulted:

Inputs: System resilience and availability; key suppliers and agreements; documentation; hardware and software assets; storage; back-up regimes; staff exposure; staff training; location of buildings and facilities; IT security; systems monitoring; power; data communications; archiving; IT environment and monitoring; telephony; any other relevant exposure Output: Vulnerability Assessment; RTOs for critical activities

Conducting Business Criticality and Risk Assessments Responsible:

Accountable: Board member

Consulted:

Inputs: Physical and organisational risks Output: Risk Assessments

IT Service Continuity Plan Responsible:

Accountable: Board member

Consulted:

Inputs: RTO; RPO; cost of RTO/RPO Output: Incident Management Teams; detailed recovery procedures for all IT System Components; Roles and Responsibilities; failback procedures

Rehearsing an IT Service Continuity Plan

Responsible: Service Continuity Manager Accountable: Board member Consulted: Business Continuity Coordinator; Business Continuity Steering Group; Compliance/Audit Team; Business Continuity Rehearsal Group. Inputs: Staff resources; costs; implications; knowledge of the rehearsal subject; testing strategy (method) Output: Rehearsal result; updated continuity plans

Solutions Architecture and Design Considerations Responsible:

Accountable: Board member

Consulted:

Inputs: Critical systems; critical applications; network; data and backups Output: Resilient architecture

F.6.4 Links

• ITIL (For guidance on Service Level Agreements) • BS ISO/IEC 17799:2005 (For guidance on creating Risk Assessments relating to information security) • Prince 2 (Project Management) • Project Management Institute – ‘Project Management Body of Knowledge’

______________________________________________________________________ ENISA 110

Risk Management

F.7 NIST SP 800-34

F.7.1 Process Map

F.7.2 Description

The processes to develop and maintain an effective IT contingency plan are common to all IT systems. The seven steps in the process are as follows:

Step 1 - Develop the Contingency Planning Policy Statement

Identify statutory or regulatory requirements for contingency plans Develop IT contingency planning policy statement Obtain approval of policy Publish policy

Step 2 - Conduct the Business Impact Analysis (BIA)

Identify critical IT resources Identify outage impacts and allowable outage times Develop recovery priorities

Step 3 - Identify Preventive Controls

Implement controls Maintain controls

Step 4 - Develop Recovery Strategies

Identify methods Integrate information system architecture

Step 5 - Develop an IT Contingency Plan

Document recovery strategy

Step 6 - Plan Testing, Training and Exercises

Develop test objectives Develop success criteria Document lessons learned Incorporate into the plan Train personnel

Step 7 - Plan Maintenance

Review and update plan Coordinate with internal/external organisations Control distribution Document changes

F.7.3 Detail

Step 1 - Develop the Contingency Planning Policy Statement

______________________________________________________________________ ENISA 111

Risk Management

Responsible: Senior Management Accountable: CIO

Consulted:

Inputs: System security plans, facility-level plans (OEP and COOP); agency-level plans (business resumption and CIP) Output: Contingency planning policy statement

Step 2 - Conduct the Business Impact Analysis (BIA) Responsible: Accountable:

Consulted: Contingency Planning Coordinator

Inputs:

Output: Identification of Critical IT resources; Identification of Impacts and allowable Outage times; Recovery Priorities; BIAs

Step 3 - Identify Preventive Controls Responsible: Accountable: Consulted: Inputs:

Output: Outage preventative measures

Step 4 - Develop Recovery Strategies Responsible: Accountable: Consulted:

Inputs: Options (recovery sites, SLAs, technology, backup strategies, etc) Output: Recovery strategy; an MOU, memorandum of agreement (MOA), or an SLA for an alternate site (if applicable); agreements for equipment replacement; roles and responsibilities of the various teams

Step 5 - Develop an IT Contingency Plan Responsible: Accountable: Consulted:

Inputs: BIAs, recovery strategy Output: IT Contingency Plan

Step 6 - Plan Testing, Training and Exercises Responsible: Accountable: Consulted: Inputs:

Output: Test plan of dates and test types

Step 7 - Plan Maintenance

Responsible: Contingency Planning Coordinator

Accountable: Consulted:

Inputs: Changing business requirements; technology updates, information updates; BIAs; contracts; options; hardware and software requirements; MOUs or SLAs; security requirements; contingency policies; training materials;

______________________________________________________________________ ENISA 112

Risk Management

testing scope Output: Updated plans

F.7.4 Links

Reference is made to the following:

• Continuity of Support Plan required by Office of Management and Budget (OMB) Circular A-130, Appendix III • COOP is required by Presidential Decision Directive 67 (PDD-67)

______________________________________________________________________ ENISA 113

Risk Management

F.8 FEMA 141

F.8.1 Process Map

F.8.2 Description

The document is aimed at Emergency Planners. The specific scenarios are:

• Fire, hazardous materials • Floods • Hurricanes • Tornadoes • Severe winter storms • Earthquakes • Technical emergencies

Obviously the document centres around analysis of risk, creating plans and the various aspects of responding to a large scale emergency such as:

• Incident control • Emergency Operations Centre • Communications • Life and limb • Property • Restoration • Logistics

Testing is treated as part of staff training! Plans are subject to a tabletop test exercise before final release. More tabletop exercises are part of the training as well as Walkthrough Drills, Functional Drills, Evacuation Drills and Full-scale Exercises.

An annual audit asks the question: “does the plan reflect the reality of the situation or has that changed?” There is no formal maintenance cycle, re-evaluation of Capabilities and Hazards of change control for plans.

F.8.3 Detail

Step 1 - Establish a Planning Team

Responsible: Chief Executive

Accountable:

Consulted: Management

Inputs:

Output: Establish authority; mission statement; budget and schedule

Step 2 – Analyse Capabilities and Hazards

______________________________________________________________________ ENISA 114

Risk Management

Responsible: Accountable:

Consulted: External agencies Inputs: Existing plans and policies; regulatory requirements; resource requirements for company products/services; suppliers; single points of failure in the supply chain; facilities and backup systems; risks; potential hazards; impact; recovery costs Output: Risk Assessment; Business Impact Analysis

Step 3 – Develop the Plan Responsible: Accountable:

Consulted: Government (local and state) agencies Inputs: Contact lists; maps; risk and hazardous material data rd sheets; 3 party contracts Output: Executive summary; roles and responsibilities; emergency response procedures; supporting documents; emergency call lists; training schedule; (tabletop-tested) plans.

Step 4 – Implement the Plan Responsible: Accountable: Consulted: Inputs:

Output: Change of corporate culture; awareness of staff; 12-month Training Plan; annual audit.

F.8.4 Links

There are no links from this standard.

______________________________________________________________________ ENISA 115

Risk Management

F.9 NFPA 1600

F.9.1 Process Map

NFPA 1600

F.9.2 Description

NFPA 1600 constitutes a standard for disaster and emergency management and Business Continuity programmes. It is aimed at public, not for profit and private entities. It covers the whole Business Continuity lifecycle, although Testing and Sustaining BCP are not covered in much depth. The main part of the standard is quite high level, although more detail can be found in the appendices.

Chapter 4. Programme Management

Section 4.1: Programme Administration: The programme should include Policy, goals, objectives, programme evaluation, programme plans, statutory and regulatory obligations, budget and records management Section 4.2: Programme Co-ordinator: The need for a Programme Coordinator is highlighted. Section 4.3: Advisory Committee: The role and responsibilities of the Advisory Committee are given. Section 4.4: Programme Evaluation: Performance measurements should be established and the programme periodically reviewed.

Chapter 5. Programme Elements

Section 5.1: General: The programme should cover prevention, mitigation, preparedness, response and recovery to identified hazards. ______________________________________________________________________ ENISA 116

Risk Management

Section 5.2: Laws and Authorities: Compliance with applicable regulatory and statutory obligations is required and changes should be reflected within the programme.

Section 5.3: Risk Assessment: A Risk Assessment should be conducted which covers natural hazards, human caused events and technological events. The impact of the hazards should be evaluated.

Section 5.4: Incident Prevention: A strategy should be developed which prevents incidents which threaten people, property and the environment. The strategy should be kept up to date and the hazards monitored on an ongoing basis.

Section 5.5: Mitigation: Based on the identified hazards, interim and long term actions should be developed as part of a mitigation strategy, for incidents which cannot be prevented.

Section 5.6: Resource Management and Logistics: The resource requirements to support the programme should be identified and the process of making the resources available during an incident should be documented. Resource shortfall should be detailed and plans put in place to cope with the shortfall.

Section 5.7: Mutual Aid and Assistance: The requirements for mutual aid should be determined and planned for if necessary.

Section 5.8: Planning: A process should be followed for writing Plans, which should include the following elements, objectives; internal and external roles and responsibilities; lines of authority; logistics and resource requirements; incident management; internal and external communication; strategic, emergency, prevention mitigation, recovery and continuity plans.

Section 5.9: Incident Management: An incident management system should be established, which must comply with applicable statutes or regulation.

Section 5.10: Communications and Warning: Communications systems should be established and periodically tested, to alert people impacted by the incident.

Section 5.11: Operational Procedures: Procedures should developed to respond to and recover from the consequences of the identified hazards.

Section 5.12: Facilities: A primary and secondary emergency operations centre should be established, which can support response, continuity and recovery operations.

Section 5.13: Training: A full training and education curriculum should be implemented to train personnel in management of the programme and incident management.

Section 5.14: Exercises, Evaluations and Corrective Actions: Periodic reviews should be held to evaluate the programme plans, procedures and capabilities. Exercises should be held to test elements of the plan and any deficiencies addressed.

______________________________________________________________________ ENISA 117

Risk Management

Section 5.15: Crisis Communication and Public Information:

Procedures should be written to detail how information should be communicated to internal and external audiences, including the public.

Section 5.16: Finance and Administration: Financial and administrative procedures should be in place to support the programme before, during and after an incident.

F.9.3 Detail

Section 4.1: Programme Administration Responsible: Accountable:

Consulted: Executive Inputs: Applicable authorities; regulators; legislation; codes of practice Output: BC Policy, Project Plan

Section 4.2: Programme Co-ordinator: Responsible: Accountable: Consulted: Inputs:

Output: Appointed Programme Co-ordinator

Section 4.3: Advisory Committee Responsible: Accountable: Consulted:

Inputs: Policy Output: Appointed Advisory Committee.

Section 4.4: Programme Evaluation Responsible: Accountable: Consulted: Inputs:

Output: Programme Performance Objectives

Section 5.1: General Responsible: Accountable: Consulted: Inputs: Output:

Section 5.2: Laws and Authorities Responsible: Accountable: Consulted:

Inputs: Applicable legislation; regulations; directives; policies and industry codes of practice Output: Strategy for updates to programme to reflect changes in legislation, regulations, directives, policies and industry codes of practice

______________________________________________________________________ ENISA 118

Risk Management

Section 5.3: Risk Assessment Responsible: Accountable: Consulted: Inputs:

Output: Hazard Evaluation and Impact Analysis

Section 5.4: Incident Prevention Responsible: Accountable: Consulted:

Inputs: Hazard Evaluation and Impact Analysis Output: Incident Prevention Strategy

Section 5.5: Mitigation Responsible: Accountable: Consulted:

Inputs: Hazard Evaluation; Risk Assessment; Impact Analysis; Cost Benefit Analysis Output: Mitigation Strategy

Section 5.6: Resource Management and Logistics Responsible: Accountable: Consulted:

Inputs: BC Policy, Project Plan, Hazard Evaluation, Impact Analysis Output: Resource Management Objectives

Section 5.7: Mutual Aid/Assistance Responsible: Accountable: Consulted: Inputs:

Output: Mutual Aid Agreements

Section 5.8: Planning Responsible: Accountable: Consulted:

Inputs: BC Policy Output: Strategic Plan; Emergency Operations/Response Plan; Prevention Plan; Mitigation Plan; Recovery Plan; Continuity Plan

Section 5.9: Incident Management Responsible: Accountable: Consulted: Inputs:

Output: Incident Management System; policies and procedures

Section 5.10: Communications and Warning Responsible: Accountable: Consulted:

______________________________________________________________________ ENISA 119

Risk Management

Inputs:

Output: Emergency Communications Systems; Processes and Procedures

Section 5.11: Operational Procedures Responsible: Accountable: Consulted: Inputs:

Output: Operational Procedures

Section 5.12: Facilities Responsible: Accountable: Consulted: Inputs:

Output: Established Primary and Secondary Emergency Operations Centre

Section 5.13: Facilities Responsible: Accountable: Consulted: Inputs:

Output: Training curriculum

Section 5.14: Exercises, Evaluations and Corrective Actions Responsible: Accountable: Consulted:

Inputs: Programme plans and procedures Output: Reviewed, tested, exercised and updated programme plans, procedures and capabilities

Section 5.15: Crisis Communications and Public Information Responsible: Accountable: Consulted:

Inputs: Hazard Evaluation; Impact Analysis Output: Procedures for pre-incident, incident and post incident communications

F.9.4 Links

Reference is made to the following:

NFPA 1561, Standard on Emergency Services Incident Management System, 2005 edition FEMA CAR

______________________________________________________________________ ENISA 120

Risk Management

F.10 ITIL v3

F.10.1 Process Map

F.10.2 Description

Information Technology Infrastructure Library (ITIL) is the documentation and management of consistent and comprehensive best practice for IT Service Management. Used by many hundreds of organisations around the world, a whole ITIL philosophy has grown up around the guidance contained within the ITIL books and is supported by a professional qualification scheme.

The ITIL framework has a number of modules, one of which is IT Service Continuity Management. The framework allows modules to be implemented in isolation although there are obvious links between them.

The ITSCM component does not rely on BCM being in place but is enhanced if implemented in conjunction with it.

F.10.3 Detail

Stage 1 - Initiation Responsible: Accountable: Consulted: Inputs:

Output: Scope; Terms of Reference; roles and responsibilities; resource allocation; project organisation and control structure; agreed quality and project plan

Stage 2 - Requirements and Strategy Responsible: Accountable: Consulted: Inputs:

Output: BIAs; Risk Analysis; Risk Response Measures; ITSCM recovery options

Stage 3 - Implementation Responsible: Accountable: Consulted:

Inputs: Business Continuity Plans; Change Management and Configuration Management Output: IT Service Continuity Plan; initial testing

______________________________________________________________________ ENISA 121

Risk Management

Stage 4 - Requirements and Strategy Responsible: Accountable: Consulted: Inputs:

Output: Education, awareness and training; regular review; test programme; Change Management

F.10.4 Links

The framework references are:

• ISO 27001 • Prince 2 (Project Management) • Project Management Institute – ‘Project Management Body of Knowledge’ • ITIL - Change Management and Configuration Management • ITIL – Service Operation

______________________________________________________________________ ENISA 122

Risk Management

F.11 Cobit v4

F.11.1 Process Map

F.11.2 Description

The four programmes run in parallel and overlap greatly, the four disciplines are:

Plan and Organise

PO1 Define a Strategic IT Plan PO2 Define the Information Architecture PO3 Determine Technological Direction PO4 Define the IT Processes, Organisation and Relationships PO5 Manage the IT Investment PO6 Communicate Management Aims and Direction PO7 Manage IT Human Resources PO8 Manage Quality PO9 Assess and Manage IT Risks PO10 Manage Projects

Acquire and Implement

AI1 Identify Automated Solutions AI2 Acquire and Maintain Application Software AI3 Acquire and Maintain Technology Infrastructure AI4 Enable Operation and Use AI5 Procure IT Resources AI6 Manage Changes AI7 Install and Accredit Solutions and Changes

Deliver and Support

DS1 Define and Manage Service Levels DS2 Manage Third-party Services DS3 Manage Performance and Capacity DS4 Ensure Continuous Service DS5 Ensure Systems Security DS6 Identify and Allocate Costs DS7 Educate and Train Users DS8 Manage Service Desk and Incidents DS9 Manage the Configuration DS10 Manage Problems DS11 Manage Data DS12 Manage the Physical Environment DS13 Manage Operations

Monitor and Evaluate

ME1 Monitor and Evaluate IT Performance ME2 Monitor and Evaluate Internal Control ME3 Ensure Regulatory Compliance ______________________________________________________________________ ENISA 123

Risk Management

ME4 Provide IT Governance

F.11.3 Detail

Plan and Organise

Responsible: ICT and business stakeholders Accountable: CEO, CIO Consulted: Senior management (CEO, CFO, CIO) and IT stakeholders. Inputs: Business requirements; business goals and ICT goals; IT skills matrix, HR policies; IT financials, infrastructure requirements; IT Risk Management guidelines; Postimplementation Review; process framework improvements; known errors; supplier risks; IT risk remedial action plans; report on effectiveness of IT controls; enterprise appetite for IT risks Output: Strategic IT Plan; Tactical Plans; technological standards; IT process framework documentation/framework roles and responsibilities; cost benefits IT budgets IT service portfolio IT project portfolio; IT control framework IT policies Risk Assessment IT sourcing strategy IT acquisition strategy HR policies IT training requirements; project management guidelines

Acquire and Implement

Responsible: CIO Accountable: CIO Consulted: IT management Inputs: Strategic IT Plan Tactical Plans IT service portfolio IT acquisition strategy; Business Requirements; Documentation/framework roles and responsibilities; IT control framework IT policies; IT acquisition strategy; IT risk remedial action plans; Project Management guidelines; cost benefits; required Documentation updates; Supplier catalogue; required security changes; RFCs; Problem records; SLAs Output: Business Requirements; Post-implementation Review; procurement decisions; Planned SLAs Planned OLAs; Change process description change process status reports change authorisation; physical environment requirements; User, ops, support, technical and admin. manuals; training rd material; 3 party relationship management; contracts; release configuration known errors promotion to production Software release and Distribution Plan

Deliver and Support

Responsible: CIO Head of Operations Accountable: Head of Operations Consulted: Business users IT stakeholders Inputs: Strategic IT Plan Tactical Plans IT sourcing Strategy; Documentation/framework roles and responsibilities; IT budgets; IT control framework IT policies IT training requirements; IT acquisition strategy; Risk Assessment; Planned SLAs Planned OLAs SLAs OLAs; physical environment requirements; User, ops, support, technical rd and admin manuals; training material; 3 party relationship management Contracts; change authorisation;

______________________________________________________________________ ENISA 124

Risk Management

Release configuration known errors promotion to production Software release and Distribution Plan Output: Updated service requirements updated service portfolio; IT financials; required Documentation updates; Supplier catalogue; required security changes; RFCs; Problem records; SLAs OLAs; Supplier risks; Process performance reports; Incident tickets; Backup storage and Protection Plan

Monitor and Evaluate

Responsible: CEA Accountable: Board Consulted: CFO CIO IT stakeholders Inputs: IT governance status report Strategic direction for IT; IT process framework; Documentation/framework roles and responsibilities; IT control framework IT policies; Risk Assessments; change process status reports; known errors; Process performance reports; legal and regulatory compliance requirements Output: IT risk remedial action plans; process framework improvements; report on effectiveness of IT Controls; catalogue of IT; enterprise appetite for IT risks

F.11.4 Links

This framework contains no links to other standards.

______________________________________________________________________ ENISA 125

Risk Management

F.12 BSI 100-2

F.12.1 Process Map

F.12.2 Description

The IT-Grundschutz methodology is a BSI methodology for effective IT Security Management. It defines a requirement for data protection to ensure confidentiality, integrity and availability.

It helps to develop the IT Security Concept but falls short of a full and tested Continuity Plan. The section at the end covers the full process of IT security from determining requirements, assigning responsibilities to writing and implementing plans. This is a very high-level process with no detail, training or testing.

F.12.3 Detail

Documenting Information about the IT Applications and Related Information

Responsible: Accountable: Consulted:

Inputs: Network Plan; IT Asset Register Output: IT Systems documentation; IT Applications and data documentation; room usage and security documentation.

Defining Protection Requirements (for IT Applications, Systems, Communications and Rooms)

Responsible: Accountable: Consulted:

Inputs: Potential damage of data loss; legal and regulatory requirements; financial consequences Output: Assignment table (Risk Assessment); network link criticality.

F.12.4 Links

• There are no links from this standard.

______________________________________________________________________ ENISA 126

Risk Management

F.13 TR 19

F.13.1 Process

F.13.2 Description

Section 3 – Risk Analysis and Review

This section describes a Risk Management process and provides some examples of potential areas of risk. Risks should be considered in the following categories:

• Processes • People • Infrastructure

Each risk should then be assessed and the relevant risk treatment applied. This will be:

• Risk avoidance • Risk reduction • Risk transfer • Risk acceptance

Risks that cannot be avoided, reduced, transferred or accepted should be passed to the BCM Steering Committee, who will review the outstanding risks together with the probable disaster which could ensue if the risk is not dealt with. This work will lead to a list of critical functions and the selected probable disaster shall also serve as the focus for the development of the BC Plan.

Section 4 – Business Impact Analysis

Section 4 describes how an organisation should conduct a Business Impact Analysis to assess the potential loss from a risk occurrence. It states that the following activities should be undertaken:

• Establish policies to govern the assessment of losses due to interruptions to business operations or processes and document the Minimum Business Continuity Objective of the organisation • Draw up a preliminary list of potential risks and threats for further deliberation by the BCM Steering Committee • Establish the priority of analysing the impact of risk on critical business functions • Identify the probable disasters that could disrupt the organisation’s operations and functions • Identify and analyse critical business functions • Assign knowledgeable functional area representatives to take part in the BIA • Identify and assess the probable impacts on infrastructure

______________________________________________________________________ ENISA 127

Risk Management

Section 5 – Strategy

This section of TR 19 examines the possible strategies for maintaining the operations of the organisation’s Critical Business Functions (CBFs). It suggests that the organisation may wish to adopt a composite strategy based on its CBFs interdependencies and their recovery time requirements in conjunction with the probable disasters.

The strategy should cover:

• Processes • People • Infrastructure

The strategy shall be formulated to cover:

• Revert to alternate processing capability • Arrange reciprocal arrangements, eg. With another organisation in the same industry • Establish alternate site or business facility • Arrange for alternate source of supply eg. of raw materials • Outsource to external vendor • Transfer of operation to subsidiary business units • Rebuild from scratch after disaster • Do nothing • Others

Section 6 - Business Continuity Plan

The BC Plan should cater to a minimum of three sets of activities:

• Response to an incident, emergency or disaster • Recover and resume critical business functions • Restore and return all business operations from temporary measures adopted during recovery to support business requirements after disaster

TR 19 states that the BC Plan should cover:

• Criteria for disaster declaration • Business units • Priorities for action • Emergency response • Documentation • Pre-incident preparation • Initial damage assessment • Emergency response procedures • Crisis communications • Co-ordination with external agencies • Critical items list • Hazardous materials handling • Inventory lists • IT Disaster Recovery Plan • Security and control (physical, logical and information) • Information processing, information security and information system requirements • Restoration and return after disaster • BC Plan distribution and control • Roles and responsibilities • Infrastructure

______________________________________________________________________ ENISA 128

Risk Management

• Emergency operations centre • Alternate site requirements • Contact lists

Section 7 – Tests and Exercises

This section of the Standard describes why testing and exercising should be carried out and how to implement this stage of BCM.

A schedule of tests and exercises should be established which should achieve the following objectives:

• Verify that the BCP is viable and practical • Verify that the recovery time scale and priorities can be met eg. the RTO • Verify that vendors identified in the BCP can support the recovery in a timely, efficient and effective manner • Verify that the resources identified in the BCP can be activated an accessed in a timely efficient, effective and adequate manner • Rehearse and train personnel involved in the actual recovery • Identify areas to be improved or fine tuned

Section 8 – Programme Management

This area of BCM as described in TR 19 examines the ongoing efforts and activities of the organisation to maintain the vibrancy of BCM in the organisation. Reviews should be conducted on a systematic and periodic basis or when there are significant changes to the business operations and or environment. These reviews shall cover:

• Risks and recovery strategies • Minimum Business Continuity objective • Roles and responsibilities • BCP • Vendor contracts • Training and awareness • BCM trends • Infrastructure • Facilities • Alternate site readiness

A programme structure should be established which defines:

• Roles and responsibilities • BCM Meetings • Participation in industry BCM activities

All staff should undergo BCM training and awareness programmes and receive training in the following activities:

• Evacuation and assembly • Activation of alarm • Emergency response • Reporting to the appropriate authority to handle the emergency

F.13.3 Details

Section 3 – Risk Analysis and Review

Responsible: Personnel with appropriate expertise

______________________________________________________________________ ENISA 129

Risk Management

Accountable: BCM Steering Committee

Consulted:

Inputs: Threats to the organisation Output: Risk Assessment, probable disasters

Section 4 – Business Impact Analysis

Responsible: Personnel with appropriate expertise Accountable: BCM Steering Committee

Consulted:

Inputs: Risk Assessment Output: Business Impact Analysis, Critical Business Functions (CBF), Minimum Business Continuity Objective (MBCO)

Section 5 – Strategy

Responsible: Staff with relevant skills Accountable: BCM Steering Committee

Consulted:

Inputs: CBFs, BIA Output: BCM Strategies

Section 6 – Business Continuity Plan Responsible:

Accountable: BCM Steering Committee

Consulted:

Inputs: Strategies Output: BCP to cover incident response, recover and resumption, restore and return to normal operations, establishment of Emergency Operations Centre

Section 7 – Tests and Exercises Responsible:

Accountable: BCM Steering Committee

Consulted:

Inputs: BCP, CBFs Output: Verified BCP, trained personnel

Section 8 – Programme Management Responsible:

Accountable: BCM Steering Committee Consulted: Staff Inputs: BCP, MBCO Output: Reviewed BCP Programme Management Plan

F.13.4 Links

The Bibliography references a number of other BC publications.

______________________________________________________________________ ENISA 130

Risk Management

Appendix G: Inventory of Methods

G.1 APS 232

G.1.1 Product Identity Card

Method or tool name Vendor / Publisher name Country of origin APS 232 Australian Prudential Australia Prudential Standard APS 232 Regulation Authority Business Continuity Management

9

Define BCM Business Design BCM Deliver BCP Test BCP Sustain BCM Framework Impact Approach Programme Analysis

Coverage of BCM Framework

BCM Framework Included? Comments activities (-, ●..●●●) Initiate BCM ● BCM should be part of the planning phase for Programme new business acquisition, joint ventures, outsourcing and major projects Identify the - Organisation Assign BCM and ● The standard states that the Board is Incident ultimately responsible for business continuity responsibilities and this responsibility may be delegated to a committee. Consideration should also be given to establishing a centralised BCM function. The responsibilities of the Board are not given Define BCM Policy ● A formal policy must be in place which documents the approach to BCM

Incorporating Guidance Note AGN 232.1, which provides further detail on matters ADIs should consider when addressing requirements contained within APS 232. ______________________________________________________________________ ENISA 131

Risk Management

Coverage of Business Impact Analysis

Business Impact Included? Comments Analysis processes (-, ●..●●●) Assess Risks and ● The standards states that an ADI must assess Impacts the impact of plausible disruption scenarios on all critical business functions, resources and infrastructure and must identify assess and manage potential business risks. A minimum list of scenarios is given. Financial, legal reputational, regulatory and other material consequences should be determined. Timeframes for recovery of critical business functions, resources and infrastructure must be determined. Analyse Results - Prioritise recovery ● Critical business functions, resources and and define critical infrastructure should be identified resource requirements

Coverage of BCM Approach

Design BCM Included? Comments Approach processes (-, ●..●●●) Determine Recovery - Options Agree Recovery ● The strategy must be based on the results of Strategy the BIA. If an outsourced recovery strategy is chosen, guidelines for choosing a facility are given Design BCP -

Coverage of Deliver BCP

Deliver BCP Method Included? Comments processes (-, ●..●●●) Incident Response - Plan Incident ● The minimum contents of the BCP are Management Plan suggested and the BCP must be approved by the Board Business Recovery - Plan Recovery Support - Plan Communications & ● The contents of a Communications Plan are Media Plan given and the people with whom communication should be made (e.g. regulators, service provides, market authorities) IT Service Continuity - Plan Business ● The standard states that consideration should Resumption Plan be given to the necessary requirements for a return to normal operations

______________________________________________________________________ ENISA 132

Risk Management

Coverage of Test BCP

Test BCP Method Included? Comments processes (-, ●..●●●) Determine type of ● Types of test are described test Write Test Plan ● The scenarios, objectives and procedures should be developed and clearly documented Conduct Test - Deliver Debrief and ● The need to document the results of a test are Test Report highlighted

Coverage of Sustain BCM Programme

Sustain BCM Included? Comments Programme (-, ●..●●●) processes Train Staff ● Staff with specific responsibility for the BCM programme should undertake the necessary training to ensure they can fulfill their responsibilities Maintain and Review ● The ADI’s internal auditor must also BCP periodically review the BCP and report results to the Board. APRA may request the external auditor of the ADI to provide an assessment of the BCM arrangements and senior management should review the BCP at least annually Develop Awareness ● All staff should be familiar with the relevant BCP for their business unit

Brief description of the product:

APS 232 and AGN 232.1 are brief documents which describe the required business continuity standards for authorised deposit-taking institutions to increase their resilience to business disruption. They cover most of the main points, although not in any detail and little reference is made to IT Service Continuity.

______________________________________________________________________ ENISA 133

Risk Management

Controls implemented by using this method Control Reference Location of Reference to Control BCMFRR01 APS 232 30 BCMFP01 APS 232 41, BIA01 APS 232 (Objectives), 14, 38, 39, 40, 41. AGN 232.1 2, 3, 4 BIA03 APS 232. (Objectives), 15, 16, 17, 18. AGN 232.1 4 BIACRR01 APS 232 27(b) 12, 13 BIACRR02 APS 232 13 BCMARS01 APS 232 21, 22, 23 BCMARS02 APS 232 27(e), AGN 232.1 12-21 BCMARS05 APS 27 (d) AGN 232.1 7-11 BCPDCP03 APS 232 26 BCPDCP04 APS 232 25 BCPDIM02 APS 232 24-29 BCPDIM03 APS 232 27 (c) BCPTT02 APS 232 33. AGN 232.1 33 BCPTP02 AGN 232.1 24, 25 BCPTC02 AGN 232.1 23 BCPTR02 APS 232 34 BCMST02 AGN 232.1 27 BCMSM01 APS 232 31, 32 BCMSM02 APS 232 32, 44 BCMSA01 AGN 232.1 26, 28

Date of the first release Date and identification of the last version April 2005 Prudential Standard APS 232 Business Continuity Management. April 2005

Official web site www.apra.gov.au User group web site Relevant web site http://www.apra.gov.au/Policy/loader.cfm?url=/commonspot/security /getfile.cfm&PageID=8528

Availability in European languages English

Free Not free Updating fee 9

______________________________________________________________________ ENISA 134

Risk Management

G.1.2 Scope

Government, Large SME Commercial Non commercial agencies companies companies companies 9 9 Specific sector Authorised Deposit-taking Institutions

Used in EU member states Used in non-EU countries Australia

Management 9 Operational Technical

Recognised licensing scheme APS 232 is made under section 11AF of the Banking Act 1959 Existing certification scheme No

G.1.3 Users Viewpoint

To introduce To use To maintain None None None

Open market Company specific 9 9

APS 232 is made under section 11AF of the Banking Act 1959 and an ADI must notify APRA as soon as possible and no later than 24 hours after experiencing a major disruption that has the potential to materially impact depositors

No

CD or download available Identification required Trial period Not applicable

It is possible to measure the I.S.S. No maturity level

______________________________________________________________________ ENISA 135

Risk Management

Non commercial tools Commercial tools EnVision RiskMatrix Shadow Planner Crisis Commander Impact Aware LDPRS

Tools can be integrated with other tools No

Method provides interfaces to other Corporate Governance organisational processes Risk Management

Method allows use of sector adapted N/A databases

______________________________________________________________________ ENISA 136

Risk Management

G.2 BCI Good Practice Guidelines 2008

G.2.1 Product Identity Card

Method or tool name Vendor / Publisher name Country of origin BCI Good Practice Guidelines BCI UK 2008

9 9

Define BCM Business Design BCM Deliver BCP Test BCP Sustain BCM Framework Impact Approach Programme Analysis 9 9 9 9 9 9

Coverage of BCM Framework

BCM Framework Included? Comments activities (-, ●..●●●) Initiate BCM ●●● Implementing BC in the Organisation, Project Programme Management, Ongoing BC Management and Documentation cover this area in detail. Identify the ●●● This is well covered in the GPG, under Organisation Reflecting Organisational Context and is an area not often covered in other standards. It looks at areas such as aligning BC to the organisational strategy, understanding the business plan, areas of the organisation in scope, new products, process or technology. Assign BCM and ●● This is described under Assigning Incident Responsibilities (1b.1) and highlights that a responsibilities member of the Executive should be given overall accountability for the effectiveness of the BCM capability. Detailed responsibilities of each person/team are not described. Define BCM Policy ●●● This is comprehensively covered by the sections on BCM Policy Content (1a.2) and BCM Programme Scope and Determining Choices (1a.3). These

Coverage of Business Impact Analysis

Business Impact Included? Comments Analysis processes (-, ●..●●●) Assess Risks and ●●● Business Impact Analysis, Estimating Impacts Continuity Requirements and Evaluating Threats address this part of the BCM programme in detail and describe what data to

______________________________________________________________________ ENISA 137

Risk Management

Business Impact Included? Comments Analysis processes (-, ●..●●●) collect in order to be able to determine BCM Strategy and various ways in which it may be collected. Analyse Results ● There isn’t a lot of detail about how to analyse results, but the GPG does suggest that consideration is made to how the results are to be reported as this could influence how the data is captured. It suggests presenting results in tables, graphs and charts.

Prioritise recovery ●● The GPG doesn’t state that recovery of and define critical processes should be prioritised, but does resource mention that the resources required to achieve requirements agreed service levels should be identified (2.2/7) and a set of recovery resources and services which provide for restoration of business activities within their RTO. (3.3/7)

Coverage of BCM Approach

Design BCM Included? Comments Approach processes (-, ●..●●●) Agree Recovery ●● Includes a discussion on the various types of Strategy strategies, special considerations for Call Centres, Internet/Intranet and Manufacturing, finalization of the RTO and Gap Analysis to highlight differences between existing strategies and current requirements Determine Recovery ●●● The different recovery options are described Options for each resource area e.g. Premises (budge up, displacement, third party sites), People (protection of people skills and knowledge), Technology (data centre, ship in contract) and these are compared against recovery time objectives to suggest the most viable options for certain RTOs. Threat reduction and impact mitigation is also discussed. The options for the provision of the critical resource requirements are described together with the need for cost benefit analysis Design BCP ● Chapter 4.1/1 describes 3 levels of response and the associated plans; the contents of which are discussed later in the chapter. The need for additional teams and plans are also discussed e.g. having a response team at each site and a central Incident Management Team or IMT at national level and a further strategic team at international level. It does not however discuss decisions to be taken about method of delivery, document management and storage which influence the way in which plans are written.

Coverage of Deliver BCP

______________________________________________________________________ ENISA 138

Risk Management

Deliver BCP Method Included? Comments processes (-, ●..●●●) Incident Response ● The Incident Response Plan is mentioned Plan under Section 4.4 Activity Response Plans, but there is not much detail apart from a generic contents list and general suggestions for consideration Incident ●● In the GPG the Incident Management Plan is Management Plan referred to as the Business Continuity Plan (Tactical or Silver level). This section defines the purpose of the BCP/IMP and suggested content. The Incident Management Plan referred to by the GPG is the Strategic/Gold level plan. There is a lot of detail with the strategic plan which might be considered more relevant to the tactical level plan Business Recovery ●● In the GPG the Business Recovery Plans are Plan referred to as Activity Response Plans. Suggested content is described, although no mention is made of RTO Recovery Support ●● Recovery Support Plans are also referred to as Plan Activity Response Plans and covered under the same section (4.4). As little distinction is made between Recovery Support Plans and Business Recovery Plans (Activity Response Plans) and the content list is generic, it would be easy to include unnecessary content in each of the plans Communications & ● This is included within the section on the Media Plan (GPG) Incident Management Plan, but is not particularly detailed. IT Service Continuity - Not included, apart from a bullet point Plan reference to an IT Disaster Recovery Plan Business - Not included. In the GPG any reference to Resumption Plan resumption relates to recovery of critical processes. No reference is made to longer term planning.

Coverage of Test BCP

Test BCP Method Included? Comments processes (-, ●..●●●) Determine type of ●●● The different types of test are discussed and test examples given of when and where they might be used. Write Test Plan ●●● Test Plans are not specifically referred to. Mention is made of the need to prepare a realistic and suitably detailed scenario. Details are given of the planning process and the considerations which should be made. Roles and responsibilities of the testing team are not given. Covered under 5.2/4, 5 & 6 Conduct Test ● Covered within 5.2/5 Deliver Debrief and ●● Covered within 5.2/5 Test Report

______________________________________________________________________ ENISA 139

Risk Management

Coverage of Sustain BCM Programme

Sustain BCM Included? Comments Programme (-, ●..●●●) processes Train Staff ●●● Training and awareness are discussed together under Section 6 (Embedding BCM in the organisation’s culture) and the need for staff to have an awareness of BC before being trained in particular aspects is discussed. How to identify the Training Gap is presented and how this will drive the awareness campaign. Suggested training resources are presented. A Skills Matrix is given in the Appendix. Maintain and Review ●●● The importance of maintaining the BCP is BCP stressed and the need for any changes to go through change control. The need for a maintenance schedule is introduced and the need to get the Maintenance Report and Maintenance Report Action Plan signed off by a senior manager. Develop Awareness ●●● Awareness is discussed together with training and based on the results from the Training Gap analysis, the various ways in which awareness can be raised is introduced. A section on monitoring cultural change is presented where the way in which the effectiveness of awareness campaigns and training courses are measured.

Brief description of the product:

The BCI Good Practice Guidelines 2008 are designed to complement BS 25999 (parts 1 and 2), although some sections do not go into as much detail at BS 25999-1 e.g. BCM Strategy. It provides reasons why planning activities should be carried out and ways in which they may be achieved. Each section is similarly presented with an Introduction, Precursors, Purpose, Concepts and Assumptions, Process, Methods and Techniques, Outcomes and Deliverables and Review. In some sections it lacks the detail of previous versions leaving more room for interpretation by the user

______________________________________________________________________ ENISA 140

Risk Management

Controls implemented by using this method Control Reference Location of Reference to Control BCMFI01 Section 1b.3 BCMFI02 Section 1b.3 BCMFI03 Section 1b.3 BCMFO01 Section 1a.3 BCMFO02 Section 1a.1 BCMFRR01 Section 1b.1, 1b.4 BCMFP01 Section 1a.2, 1a.3 BIA01 Section 1a.3, 2.3, BIA03 Section 2.1 BIARIM08 Section 3.2-5, BIARIM12 Section 3.1-4 BIACRR01 Section 2.2-7, 3.3 BIACRR02 Section 3.1-5 BCMARS01 Section 3.1, 3.2 BCMARS02 Section 3.1-4, 3.2-4 BCMARS03 Section 3.2-5 BCMARS04 Section 3.2-5 BCMARS05 Section 1a.4, 3.2-5 BCPDCP01 Section 4.4-5 BCPDCP02 Section 4.4-5 BCPDCP03 Section 4.4 BCPDIM01 Section 1b.6, 3.2-5, 4.2-5 BCPDIM02 Section 1b.6, 4.3 BCPDIM03 Section 4.2-6 BCPTT02 Section 5.1 BCPTP02 Section 5.2 BCPTC02 Section 5.2 BCPTR02 Section 5.2 BCMST02 Section 6.1-5, 6.2-5 BCMST03 Section 6.2-5 BCMSM01 Section 2.1-8, 2.2-8, 2.3-8, 3.1-8, 3.2-8, 3.3-8, 4.2-8, 4.3-8, 4.4- 8, 5.1-8, 5.2-8, 5.3, 5.4-8 BCMSM02 Section 5.4 BCMSM03 Section 5.4-7 BCMSA01 Section 6.0, 6.1, 6.2, 6.3

Date of the first release Date and identification of the last version 2002 BCI Good Practice Guidelines 2008

Official web site www.thebci.org User group web site www.thebci.org Relevant web site http://www.thebci.org/gpg.htm http://www.thebci.org/GPGadditional.htm (additional checklists and forms – BCI members only)

______________________________________________________________________ ENISA 141

Risk Management

Availability in European languages English German (BCI GPG 2005) Italian (BCI GPG 2005)

Free Not free Updating fee 9

G.2.2 Scope

Government, Large SME Commercial Non commercial agencies companies companies companies 9 9 9 9 9 Specific sector Applicable to all sectors

Used in EU member states 9 Used in non-EU countries 9

Management 9 Operational Technical

Recognised licensing scheme Not applicable

Existing certification scheme BCI Membership certification http://www.thebcicertificate.org/bci_gpg.htm

Certification to the BCI GPG 2008 is not available, but the Guidelines do address the key requirements for certification to BS 25999- 2 (BCM Specification). However BS 25999-2 must also be consulted

G.2.3 Users Viewpoint

To introduce To use To maintain None BCI approved training courses are available which introduce the concepts of the GPG:http://www.continuityshop.com/courses/bci.htm

Open market Company specific Readily available

The BCI Good Practice Guidelines do not confer regulatory compliance. Reference must also be made to relevant regulatory requirements.

None

______________________________________________________________________ ENISA 142

Risk Management

CD or download available Identification required Trial period Not applicable

It is possible to measure the I.S.S. maturity No level

Non commercial tools Commercial tools BCI Benchmark eBRP myCOOP LDPRS Crisis Commander enVisionERM ImpactAware

Tools can be integrated with other tools No

Method provides interfaces to other The Good Practice Guidelines have been organisational processes written to cover the main requirements of NFPA 1600, HB 221, APS 232 and FSA BCM Guide The guidelines make reference to Records Management, Change Management

Method allows use of sector adapted Not applicable databases

______________________________________________________________________ ENISA 143

Risk Management

G.3 BS 25999-1 – Business Continuity Management Code of Practice

G.3.1 Product Identity Card

Method or tool name Vendor / Publisher name Country of origin BS 25999-1 – Business British Standards Institute UK Continuity Management Code of Practice

National International Private Public / White Paper/ Handbo Guidelin Standardisati Standardisati sector governme Recommendati ok es on body on body organisati nt on on organisati /associatio on n 9 9

Define BCM Business Design BCM Deliver BCP Test BCP Sustain BCM Framework Impact Approach Programme Analysis 9 9 9 9 9 9

Coverage of BCM Framework

BCM Framework Included? Comments activities (-, ●..●●●) Initiate BCM ●●● Programme Identify the ●●● Organisation Assign BCM and ●●● Incident responsibilities Define BCM Policy ●●●

Coverage of Business Impact Analysis

Business Impact Included? Comments Analysis processes (-, ●..●●●) Assess Risks and ●●● Impacts Analyse Results ●● Prioritise recovery ●●● and define critical resource requirements

Coverage of BCM Approach

Design BCM Included? Comments Approach processes (-, ●..●●●) Agree Recovery ●●●

______________________________________________________________________ ENISA 144

Risk Management

Strategy Determine Recovery ●●● Options Design BCP ●●

Coverage of Deliver BCP

Deliver BCP Method Included? Comments processes (-, ●..●●●) Incident Response ● Plan Incident ●●● Management Plan Business Recovery ●● Plan Recovery Support ●● Plan Communications & ●●● Media Plan IT Service Continuity ● Plan Business ● Resumption Plan

Coverage of Test BCP

Test BCP Method Included? Comments processes (-, ●..●●●) Determine type of ●●● test Write Test Plan ● Conduct Test ● Deliver Debrief and ●●● Test Report

Coverage of Sustain BCM Programme

Sustain BCM Included? Comments Programme (-, ●..●●●) processes Train Staff ●● Maintain and Review ●●● BCP Develop Awareness ●●

______________________________________________________________________ ENISA 145

Risk Management

Brief description of the product: BS 25999-1 is the Business Continuity Management Code of Practice published by the British Standards Institute and forms the basis for the development of Business Continuity Plans both in the UK and worldwide. Certification to BS 25999 is gained against BS 25999-2, which is the specification and which, in addition to implementing BC Plans requires a robust Business Continuity Management System to be in place.

Controls implemented by using this method Control Reference Location of Reference to Control BCMFI01 Section 5.3 BCMFI02 Section 5.3 BCMFI03 Section 5.3 BCMFO01 Section 6.1 BCMFO02 Section 6.1 BCMFRR01 Section 5.2, Section 8.3.3 BCMFP01 Section 4 BIA01 Section 6.5, Section 6.6 BIA03 Section 6.2 BIARIM03 Section 7.5.3 BIARIM06 Section 7.6 BIARIM12 Section 7.5.2 BIACRR01 Section 6.4 BIACRR02 Section 6.3 BCMARS01 Section 7 BCMARS02 Section 7.4 BCMARS03 Section 7.5.3 BCMARS04 Section 7.5.3 BCMARS05 Section 7.7 BCPDCP02 Section 8.5 BCPDCP03 Section 8.6 BCPDCP04 Section 8.2.5 BCPDIM01 Section 7.9, 8.2, 8.3 BCPDIM02 Section 8.3, 8.4, 8.7 BCPDIM03 Section 8.5 BCPTT01 Section 9.2, Table 1, BCPTP02 Section 9.3 BCPTR02 Section 9.3.2 BCMST02 Section 10.3 BCMSM01 Section 9.4 BCMSM02 Section 9.5 BCMSM03 Section 9.5 BCMSA01 Section 10.1, 10.2

Date of the first release Date and identification of the last version November 2006 November 2006

Official web site www.bsi-global.com User group web site Relevant web site http://www.bsi-global.com/en/Shop/Publication-

______________________________________________________________________ ENISA 146

Risk Management

Detail/?pid=000000000030157563

Availability in European languages English

Free Not free Updating fee N/A £100 (£50 for members of N/A the BSI)

G.3.2 Scope

Government, Large SME Commercial Non commercial agencies companies companies companies 9 9 9 9 9 Specific sector No. Relevant to all sectors

Used in EU member states Yes Used in non-EU countries Yes

Management 9 Operational 9 Technical

Recognised licensing scheme Existing certification scheme British Standards Institute Lloyds

G.3.3 Users Viewpoint

To introduce To use To maintain www.bsi- None None global.com/bs25999online for a free demonstration

Open market Company specific 9 9

______________________________________________________________________ ENISA 147

Risk Management

Implementation of Business Continuity Plans to BS 25999, will ensure plans have been developed to good practice, but not necessarily fully compliant with regulatory requirements. Individual regulations should be checked in conjunction with BS 25999

Not fully. Implementation of the Business Impact Analysis will assist in developing plans to PAS 77, but will not ensure compliance with the full standard. Development of the full BCP to BS 25999 will partially fulfill the requirements of ISO/IEC 27001, ITIL v3.0 and CoBIT v4.0.

CD or download available Identification required Trial period www.bsi- N/A N/A global.com/bs25999online for a free demonstration

It is possible to measure the I.S.S. maturity level No

Non commercial tools Commercial tools LDPRS eBRP Shadow Planner enVisionERM Crisis Commander RecoveryPAC

Tools can be integrated with other tools No

Method provides interfaces to other organisational ISO 9001 processes PAS 77 ISO/IEC 27001

Method allows use of sector adapted databases

______________________________________________________________________ ENISA 148

Risk Management

GG..44 BS ISO/IEC 24762:2008 Information Security Technology – Security Techniques – Guidelines for Information and Communications Technology Disaster Recovery Services

G.4.1 Product Identity Card

Method or tool name Vendor / Publisher name Country of origin BS ISO/IEC 24762:2008 British Standards Institute and the UK Information Security International Standards Technology – Security Organisation Techniques – Guidelines for Information and Communications Technology Disaster Recovery Services

9 9 9

Define BCM Business Design BCM Deliver BCP Test BCP Sustain BCM Framework Impact Approach Programme Analysis 9 9 9 9 9 9

Coverage of BCM Framework

BCM Framework Included? Comments activities (-, ●..●●●) Initiate BCM - Programme Identify the - Organisation Assign BCM and ● The standard describes the staffing resource Incident required to respond to an organisation's responsibilities business continuity invocation Define BCM Policy -

______________________________________________________________________ ENISA 149

Risk Management

Coverage of Business Impact Analysis

Business Impact Included? Comments Analysis processes (-, ●..●●●) Assess Risks and ●● Chapter 6 describes the risks which should be Impacts considered when siting an ICT DR facility. It also describes some of the risk mitigation measures which should be implemented when offering DR services Analyse Results - Prioritise recovery and define critical resource requirements

Coverage of BCM Approach

Design BCM Included? Comments Approach processes (-, ●..●●●) Determine Recovery - Options Agree Recovery ● The standard assumes that the organisation’s Strategy recovery strategy is to move to a DR facility and describes how the service should be provided to meet customer requirements and offer best practice Design BCP - The standard assumes that the organisation’s BCP has been written

Coverage of Deliver BCP

Deliver BCP Method Included? Comments processes (-, ●..●●●) Incident Response ● The way in which the DR facility should Plan respond to an emergency of their own is described Incident ● The facilities which should be provided to Management Plan enable the customer to manage the incident from the DR site are described Business Recovery - Plan Recovery Support - Plan Communications & ● The facilities which should be provided to Media Plan enable the customer to communicate with their own staff and the media are described IT Service Continuity ● Reference is made to the organisation’s DR Plan Plan (IT Service Continuity Plan and Business Continuity Plan) and the method by which it should be invoked Business - Resumption Plan

Coverage of Test BCP

Test BCP Method Included? Comments processes (-, ●..●●●)

______________________________________________________________________ ENISA 150

Risk Management

Determine type of test Write Test Plan ● References are made throughout the standard about the need to test the services provided and that Test Plans should be written. Each test should be different from the last test. Conduct Test ● Suggestions are made regarding the organisation’s personnel who would be required to assist with testing at the DR site. Deliver Debrief and ● The standard highlights the need to document Test Report the results of the tests and to rectify shortcomings at the earliest possible opportunity

Coverage of Sustain BCM Programme

Sustain BCM Included? Comments Programme (-, ●..●●●) processes Train Staff ●● The need to analyse the skills required by the staff at the DR site is described, the types of training which could be undertaken, the scope and frequency of training and assessment of the training’s success are described Maintain and Review ● The standard references the need to maintain BCP and update the plans, so that the service continues to meet the organisation’s needs. Audit and self assessment are also described Develop Awareness -

Brief description of the product:

BS ISO/IEC 24762 provides guidelines on the provision of ICT disaster recovery (ICT DR) services as part of BCM. It specifies the requirements for implementing, operating, monitoring and maintaining ICT DR services and facilities, the capabilities which outsourced ICT DR service providers should possess and the practices they should follow. There is also guidance on selecting a recovery site and advice on continuous service improvement.

______________________________________________________________________ ENISA 151

Risk Management

Controls implemented by using this method Control Reference Location of Reference to Control BCMFRR01 Section 7.7.1, 7.15.4, 8.3 BIA01 Section 6.2, 9.5 BIA02 Section 5.4 BIARIM01 Section 7.5.6 BIARIM03 Section 6.6.4 BIARIM05 Section 5.7, 6.4, 6.6.1 BIARIM08 Section 6.2, 6.3, 6.4, 6.6.2, 6.6.3, 6.8, 6.10, 6.12 BIARIM09 Section 5.3.3, 6.4, 6.7.4, 6.9, 7.5 BIARIM12 Section 6.7.3 BCMARS02 Section 7, 8 BCMARS03 Section 7, 7.9, 8 BCMARS04 Section 5.3.4, 7.9, 8 BCMARS05 Section 5.5, 5.6, 7.9 BCPDCP01 Section 5.8 BCPDIM01 Section 6.10.5, 7.15 BCPDIM02 Section 5.7.5, 6.5.2, 6.11 BCPDIM03 Section 6.5.2, 6.11.3.4 BCPTT01 Section 5.10, Section 6.3.10, 6.15.4, 7.13, 7.14, 7.16.4 BCPTT02 Section 6.3.10, 6.15.4, 7.13, 7,14, 7.16.4 BCPTP01 Section 6.15.4, 7.16.4, 7.13, 7.14, 7.16.4 BCPTP02 Section 6.15.4, 7.16.4, 7.13, 7.14, 7.16.4 BCPTC01 Section 6.15.4, 7.16.4, 7.13, 7.14, 7.16.4 BCPTC02 Section 6.15.4, 7.16.4, 7.13, 7.14, 7.16.4 BCPTR01 Section 6.15.4, 7.16.4, 7.13, 7.14, 7.16.4 BCPTR02 Section 6.15.4, 7.16.4, 7.13, 7.14, 7.16.4 BCMST01 Section 5.9, 7.4.2, 7.14.4 BCMST02 Section 5.9, 7.4.2 BCMST03 Section 5.9 BCMST04 Section 5.9, 7.14.4 BCMSM01 Section 6.14.5, 7, 9, 7.16 BCMSM02 Section 9, 7.16 BCMSM03 Section 9

Date of the first release Date and identification of the last version 29 February 2008 BS ISO/IEC 24762:2008

______________________________________________________________________ ENISA 152

Risk Management

Official web site www.iso.org www.bsi-global.com User group web site Relevant web site http://www.iso.org/iso/catalogue_detail?csnum ber=41532

http://www.bsiglobal.com/en/Shop/Publication- Detail/?pid=000000000030143802

Availability in European languages English

Free Not free Updating fee N/A www.iso.org - CHF 164.00 N/A (approx Euro 101.00)

www.bsi-global.com – Non members £154.00 (approx Euro 197.00) Members £55.00 (approx Euro 98.00)

G.4.2 Scope

Government, Large SME Commercial Non commercial agencies companies companies companies 9 9 Specific sector In house and outsourced ICT DR Service Providers, organisations requiring ICT DR services and communities of organisations with reciprocal or mutual arrangements

Used in EU member states 9 Used in non-EU countries

Management 9 Operational 9 Technical

Recognised licensing scheme N/A Existing certification scheme N/A

______________________________________________________________________ ENISA 153

Risk Management

G.4.3 Users Viewpoint

To introduce To use To maintain Some technical knowledge Some technical knowledge Some technical knowledge

Open market Company specific 9 9

No

No

CD or download available Identification required Trial period Not applicable

It is possible to measure the I.S.S. No maturity level

Non commercial tools Commercial tools Crisis Commander

Tools can be integrated with other tools

Method provides interfaces to other Configuration Management organisational processes Records Management Facilities Management

Method allows use of sector adapted N/A databases

For Business Continuity invocation, Incident Management Team call out and management of the incident. ______________________________________________________________________ ENISA 154

Risk Management

GG..55 BSI 100-2. IT-Grundschutz Methodology

G.5.1 Product Identity Card

Method or tool name Vendor / Publisher name Country of origin BSI 100-2. IT-Grundschutz Bundesamt fur Sicherhiet in Germany Methodology der Informationstechnik

9

Define BCM Business Design BCM Deliver BCP Test BCP Sustain BCM Framework Impact Approach Programme Analysis 9

Coverage of BCM Framework

BCM Framework Included? Comments activities (-, ●..●●●) Initiate BCM - Programme Identify the - Organisation Assign BCM and - Incident responsibilities Define BCM Policy -

Coverage of Business Impact Analysis

Business Impact Included? Comments Analysis processes (-, ●..●●●) Assess Risks and ● Section 4.1.4 Collecting Information about the Impacts IT Applications and Related Information provides information about gathering data on the business process, IT applications and data from the users, including their assessment as to the shortest acceptable downtown for those applications. Example worksheets are given for recording the information. Section 4.1.5 looks at an analysis of the rooms which support the IT components (system). Analyse Results ● Section 4.1.2 and 4.1.3 describes the background information which is required before the data gathered during the impact analysis can be analysed. Section 4.1.4 suggests that each application should be matched with its related IT components (servers, clients, network etc). Section 4.1.6

______________________________________________________________________ ENISA 155

Risk Management

Business Impact Included? Comments Analysis processes (-, ●..●●●) explains that similar groups of components could be grouped to make analysis easier. Prioritise recovery ● Section 4.2.1 shows how to define the and define critical protection requirements based on the results resource from the risk and impact analysis and suggests requirements criteria for the normal, high and very high protection requirements based on various damage scenarios.

Coverage of BCM Approach

Design BCM Included? Comments Approach processes (-, ●..●●●) Agree Recovery - Strategy Determine Recovery - Options Design BCP -

Coverage of Deliver BCP

Deliver BCP Method Included? Comments processes (-, ●..●●●) Incident Response - Plan Incident - Management Plan Business Recovery - Plan Recovery Support - Plan Communications & - Media Plan IT Service Continuity - Plan Business - Resumption Plan

______________________________________________________________________ ENISA 156

Risk Management

Coverage of Test BCP

Test BCP Method Included? Comments processes (-, ●..●●●) Determine type of test Write Test Plan - Conduct Test - Deliver Debrief and - Test Report

Coverage of Sustain BCM Programme

Sustain BCM Included? Comments Programme (-, ●..●●●) processes Train Staff - Maintain and Review - BCP Develop Awareness -

Brief description of the product:

BSI 100-2 is aimed at IT Security and describes how to implement the IT Grundschutz methodology (Information Security Management System). As part of a contingency planning programme it is essential to ensure that Information Security has been implemented and the risk of failure has been minimised. The relevant sections of this plan describe how to gather the data on the information system and how to establish the protection requirements for the system. This information can be fed back into the BC programme to ensure that all information technology components have been considered when writing the Business and IT Continuity Service Plans.

Controls implemented by using this method Control Reference Location of Reference to Control BIA01 Section 4.1.4, 4.1.5 BIA03 Section 4.1.4, 4.1.5, 4.2.1 BIARIM08 Section 4.2.4, 4.2.5 BIARIM09 Section 4.2.1, 4.2.2, 4.2.3, BIACRR01 Section 4.1.2, Section 4.1.3, 4.2.1, 4.2.2, 4.2.3

Date of the first release Date and identification of the last version December 2005 v1.0 December 2005 v1.0

Official web site www.bsi.bund.de User group web site Relevant web site www.bsi.bund.de/gshb

______________________________________________________________________ ENISA 157

Risk Management

Availability in European languages German (2008 version) English (2005 version)

Free Not free Updating fee 9

G.5.2 Scope

Government, Large SME Commercial Non commercial agencies companies companies companies 9 9 9 9 9 Specific sector All

Used in EU member states 9 Used in non-EU countries Not widely

Management 9 Operational 9 Technical

Recognised licensing scheme Not applicable Existing certification scheme Certification to BSI 100-1 Management Systems for Information Security (ISMS)

G.5.3 Users Viewpoint

To introduce To use To maintain Some knowledge of IT Security

Open market Company specific 9

Implementation of BSI 100-2, does not confer regulatory compliance. It should be used in conjunction with the relevant industry regulatory guidelines e.g. relevant financial regulations

BSI 100-2 describes the methodology for implementing the IT Grundschutz (Information Security) management system as described in BSI 100-1, against which certification can be gained.

CD or download available Identification required Trial period

It is the 2005 version which has been reviewed as the 2008 version is not yet available in English ______________________________________________________________________ ENISA 158

Risk Management

Not applicable

It is possible to measure the I.S.S. Implementation of the IT Grundschutz maturity level methodology would assist in improving maturity scores against the Risk Management module of the CMMI-Dev v1.2.

Non commercial tools Commercial tools enVisionERM ImpactAware

Tools can be integrated with other tools Not applicable

Method provides interfaces to other Organisational Risk Management organisational processes Information Security Management System Continuity Planning Configuration Management

Method allows use of sector adapted Not applicable databases

______________________________________________________________________ ENISA 159

Risk Management

GG..66 CObIT 4.0

G.6.1 Product Identity Card

Method or tool name Vendor / Publisher name Country of origin CObIT 4.0 IT Governance Institute USA

9 9

Define BCM Business Design BCM Deliver BCP Test BCP Sustain BCM Framework Impact Approach Programme Analysis 9 9 9 9 9 9

Coverage of BCM Framework

BCM Framework Included? Comments activities (-, ●..●●●) Initiate BCM ●● As a control document, there is a whole Programme section devoted to project management and the steps which should be taken to ensure that all aspects of the ICT function are delivered efficiently and effectively Identify the ● CObIT states that IT Governance is the Organisation responsibility of the executive and the board of directors and consists of the leadership, organisational structures and processes that ensure that the enterprise’s IT sustains and extends the organisation’s strategies and objectives Assign BCM and ● The whole document stresses the need to Incident assign roles and responsibilities. Section responsibilities DS4.1 specifically mentions the need to adopt an organisational structure for continuity management covering the roles, tasks and responsibilities of external and internal service and Section 4.2 mentions that the IT Continuity Plans (ITSC Plans) should cover roles and responsibilities. Define BCM Policy ● The IT Strategy could be considered to be similar in nature and purpose to the BCM Policy

______________________________________________________________________ ENISA 160

Risk Management

Coverage of Business Impact Analysis

Business Impact Included? Comments Analysis processes (-, ●..●●●) Assess Risks and ● Risk is mentioned throughout the document. Impacts Section ME4.5, stresses its importance as part of IT Governance, the need to involve the business and assess the impact of risks on the business. Various risk mitigation controls are mentioned such as protection of the IT assets, protection of data and information and back ups. Analyse Results - Prioritise recovery ● Section PO1 describes the need to develop an and define critical IT strategic plan which is achieved by resource engaging with the business and identifying requirements where the business is critically dependent on IT and mediate between imperatives of the business and the technology so agreed priorities can be established.

Coverage of BCM Approach

Design BCM Included? Comments Approach processes (-, ●..●●●) Determine Recovery - Options Agree Recovery ● The need for an IT Strategy rather than a Strategy recovery strategy is discussed, although mention is made of third party recovery facilities Design BCP -

Coverage of Deliver BCP

Deliver BCP Method Included? Comments processes (-, ●..●●●) Incident Response - Plan Incident - Management Plan Business Recovery - Plan Recovery Support - Plan Communications & ● A brief mention is made of customer and Media Plan stakeholder communication during recovery. IT Service Continuity ● Section DS4 covers IT Continuity – the plans, Plan resources, recovery, maintenance, testing and training . Business - Resumption Plan

Coverage of Test BCP

Test BCP Method Included? Comments processes (-, ●..●●●) Determine type of - ______________________________________________________________________ ENISA 161

Risk Management

test Write Test Plan ● DS4.5 refers to IT Continuity testing rather than pre- and post-release testing. Conduct Test ● References are made throughout the document to testing, but Section DS4.5 specifically mentions IT Continuity Testing Deliver Debrief and ● It is necessary to document the results of all Test Report tests. This is mentioned throughout the document, but IT Continuity testing reports are briefly mentioned in Section 4.5

Coverage of Sustain BCM Programme

Sustain BCM Included? Comments Programme (-, ●..●●●) processes Train Staff ● It is imperative that all staff are competent to carry out their roles in order to minimise errors and subsequent possible outages. This is mentioned throughout the document, but specific mention is made of IT Continuity training in DS4.6 Maintain and Review ● All IT documentation must be kept up to date BCP to minimise errors. This forms an important part of governance and is addressed throughout the document, particularly under Ensure Continuous Service (DS4) and Monitor and Evaluate (ME1) Develop Awareness -

Brief description of the product:

The Control Objectives for Information and related Technology (COBIT) is a set of best practices (framework) for information technology (IT) management created by the Information Systems Audit and Control Association (ISACA), and the IT Governance Institute (ITGI) in 1992. COBIT provides managers, auditors, and IT users with a set of generally accepted measures, indicators, processes and best practices to assist them in maximising the benefits derived through the use of information technology and developing appropriate IT governance and control in a company. Whilst not specifically about IT Service Continuity or Business Continuity, the application of the controls should lead to towards an organisation which recognises the benefits of information technology and understands and manages the associated risks such as increasing regulatory compliance and critical dependences of many business processes on IT.

Controls implemented by using this method Control Reference Location of Reference to Control BCMFI01 PO1.5, PO1.6, PO10.7, PO10.10, PO10.11, PO10.12 BCMFI02 PO1.6, PO10.2, PO10.6, PO10.7, PO10.8, PO10.9 BCMFI03 PO10.13, PO10.14 BCMFO01 PO4.1, PO4.4, PO4.5 BCMFO02 PO1, PO1.4 BCMFRR01 PO1.6, PO4.2, PO4.3, PO4.6, PO4.8, DS4.1, DS4.2 BCMFP01 PO10.5, ME3.1, ME4.1 BIA01 PO1, PO9, DS2.3, ME4.5 BIA03 PO1.2, PO4.13, PO7.5, DS2.1, DS4.1, DS4.3, DS11.2

______________________________________________________________________ ENISA 162

Risk Management

Control Reference Location of Reference to Control BIARIM01 DS5.5, DS13.3, BIARIM02 DS5.5 BIARIM05 DS5.11, DS11.4 BIARIM06 DS11.5 BIARIM08 DS12 BIARIM09 DS5.10, DS13.4 BIACRR02 PO1 BCMARS02 DS4.8 BCMARS03 DS4.8 BCMARS04 DS4.9 BCMARS05 PO4.14, PO4.15, AI5.2, AI5.6, DS2.2, DS2.3 BCPDCP01 DS4.2, DS4.8, DS5.6, DS8.3, DS8.4, DS10.1 BCPDIM03 DS4.8 BCPDIM04 DS8.5 BCPDIM05 DS4.10 BCPTT01 DS4.5 BCPTP01 AI7.2, AI7.3, DS4.1, DS4.5 BCPTC01 AI7.4, AI7.5, AI7.6, AI7.7 BCPTR01 AI7.5, AI7.7, AI7.9, AI7.12, DS4.5 BCMST01 PO7.2, AI4.4, DS4.6, ME4.4 BCMST04 DS4.6 BCMSM01 DS2.4, DS4.4, DS4.9, DS13.5, ME1.1, ME1.2, ME1.3, ME3.3 BCMSM02 ME1.4, ME1.5, ME2, ME3.5 BCMSM03 ME1.6, ME2.7, ME3.4

Date of the first release Date and identification of the last version 1996 CObIT 4.1 2007 (CObIT 4.0 released in December 2005 – (4.1 differs from 4.0 with: significantly different to previous versions) − simplified descriptions of "Goals"

− cascading of processes and (bidirectional) relations between the Business, the IT Goals, and the IT Processes)

Official web site www.isaca.org User group web site http://www.controlit.org/ http://www.isaca.org/Template.cfm?Section=COBIT_ User_Convention4&Template=/TaggedPage/TaggedPa geDisplay.cfm&TPLID=14&ContentID=17514

Relevant web site http://cobitcampus3.isaca.org/isaca/index.aspx http://isaca.brighttalk.com/ http://www.isaca.org/Template.cfm?Section=COBIT_ Online&Template=/ContentManagement/ContentDispl ay.cfm&ContentID=15633

______________________________________________________________________ ENISA 163

Risk Management

Availability in European languages

Free Not free Updating fee 9

G.6.2 Scope

Government, Large SME Commercial Non commercial agencies companies companies companies 9 9 9 Specific sector No

Used in EU member states Worldwide Used in non-EU countries

Management 9 Operational Technical

Recognised licensing scheme No Existing certification scheme Measurable maturity levels

Need to register on the ISACA website ______________________________________________________________________ ENISA 164

Risk Management

G.6.3 Users Viewpoint

To introduce To use To maintain IT Knowledge IT Knowledge IT Knowledge

Open market Company specific 9 9

CObIT would contribute towards regulatory compliance, but does not confer it in its own right

Adoption of CObIT would assist greatly in complying with many of the IT standards.

CD or download available Identification required Trial period Download Yes Name and contact details

It is possible to measure the I.S.S. Yes – CoBIT itself is a set of control objectives maturity level for an IT system and provides a system of measuring maturity levels.

Non commercial tools Commercial tools Continuity Software Recover Guard

Tools can be integrated with other tools No

Method provides interfaces to other Quality Management organisational processes Corporate and IT Governance Continuous Improvement Customer Focus Project Management (e.g. PRINCE 2) Change Management Configuration Management

Method allows use of sector adapted No databases

Referenced in Section AI6 – Change Management Reference in Section DS9 – Manage the Configuration ______________________________________________________________________ ENISA 165

Risk Management

G.7 FEMA 141. Emergency Management Guide for Business and Industry

G.7.1 Product Identity Card

Method or tool name Vendor / Publisher name Country of origin FEMA 141. Emergency Federal Emergency United States of America Management Guide for Management Agency Business and Industry

9 9

Define BCM Business Design BCM Deliver BCP Test BCP Sustain BCM Framework Impact Approach Programme Analysis 9 9 9 9 9 9

BCM Framework Included? Comments activities (-, ●..●●●) Initiate BCM ● Section 1/1 suggests that a mission statement Programme should be issued and a Schedule and Budget should be assigned. Identify the ● The need to identify critical products, services Organisation and operations is mentioned, but not in any detail Assign BCM and ●● The Guidelines state the importance of Incident establishing a planning team for implementing responsibilities the plan and in Section 1/2 details the personnel required to form the emergency (incident) team and the outside agencies who should be included in the planning process Define BCM Policy - Not covered in these Guidelines

Coverage of Business Impact Analysis

Business Impact Included? Comments Analysis processes (-, ●..●●●) Assess Risks and ● The risk and impact assessment are conducted Impacts as part of a vulnerability analysis, which assesses the probability and impact of various emergency scenarios. Whilst this is not pure BCM, it ensures protection for personnel and other resources, whilst not necessarily restoring critical business activities

Supported by a number of private companies and associations representing business and industry ______________________________________________________________________ ENISA 166

Risk Management

Analyse Results - Not included in these Guidelines Prioritise recovery ● The scores resulting from the Vulnerability and define critical Analysis will give relative priority for various resource risk scenarios, but do not address critical requirements business activities and their critical resource requirements

Coverage of BCM Approach

Design BCM Included? Comments Approach processes (-, ●..●●●) Agree Recovery - Strategy Determine Recovery - Options Design BCP -

Coverage of Deliver BCP

Deliver BCP Method Included? Comments processes (-, ●..●●●) Incident Response ●●● This is covered in some depth in these Plan guidelines. The IRP is introduced in Section 1 and described in much more detail in Section 2. Section 2 covers the Emergency Management Group, Incident Command System, Emergency Operations Centre (EOC), Security, Communications, Safety, Property (Resource) Protection Incident ● The sections on Recovery and Restoration and Management Plan Continuity of Management within Section 2 cover some of the requirements of an Incident Management Plan, but it is not detailed enough for true Business Continuity requirements. The information regarding Incident Command and the EOC are also relevant. The Administrative actions are detailed within the Administration and Logistics section. Business Recovery - A brief mention is made of the need to Plan establish priorities for resuming operations, but there is no detail Recovery Support ● The section on Property Protection details Plan many of the actions normally found in the Facilities Recovery Plan together with the actions under Logistics (including transportation, provision of utility maps, food, shelter facilities). Resuming Operations covers some of the post incident actions of the Facilities/Property team. Security actions have a brief mention Communications & ●●● Details are given about communicating with Media Plan personnel, the community, the media, the emergency services, first responders and the utility companies. Methods of communication are discussed and back up communication systems

______________________________________________________________________ ENISA 167

Risk Management

IT Service Continuity - Plan Business - A brief mention is made of the need to Resumption Plan establish priorities for resuming operations, but there is no detail

Coverage of Test BCP

Test BCP Method Included? Comments processes (-, ●..●●●) Determine type of ●● Testing (or exercising) is discussed under the test Training section. The different types of test are detailed and their function Write Test Plan - Conduct Test - Deliver Debrief and ● This isn’t covered in any detail, but the Test Report Guidelines do mention that a review should be conducted after each training (and exercising) activity

Coverage of Sustain BCM Programme

Sustain BCM Included? Comments Programme (-, ●..●●●) processes Train Staff ●● A Training Drills and Exercises Schedule Matrix is contained within the Appendix, with an entry for each of the different types of training which personnel may need to attend. Maintain and Review ●● The importance of keeping the plan up to date BCP is described and the areas which are likely to need updating. The need to follow change management procedures is not mentioned Develop Awareness ●●● Section 1/4 suggests how to integrate the plan into company operations and the steps to take to make staff aware of the plan and what their role is.

Brief description of the product:

FEMA 141 is predominantly aimed at the development of an incident (emergency) response or management plan and thus does not cover the continuity arrangements for the critical activities within the organisation. However, good communications and incident management are key components for a successful recovery and these elements are covered in depth in these guidelines.

Controls implemented by using this method Control Reference Location of Reference to Control BCMFI01 Section 1 – Step 1 BCMFO01 Section 1 – Step 2 BCMFRR01 Section 1 – Step 1 BIA02 Section 1 – Step 2 BIA03 Section 1 – Step 2 BIARIM05 Section 2 – Property Protection BIARIM08 Section 2 – Property Protection Section 2 – Fire, Hazardous Materials

______________________________________________________________________ ENISA 168

Risk Management

Incident, Floods and Flash Floods, Hurricanes, Tornadoes, Server Winter Storms, Earthquakes and Technological Emergencies

BIACRR01 Section 1 – Step 2, Section 1 – Step 3 BCPDCP02 Section 1 – Step 3 Section 2 – Administration and Logistics Section 2 – Fire, Hazardous Materials Incident, Floods and Flash Floods, Hurricanes, Tornadoes, Server Winter Storms and Earthquakes

BCPDIM01 Section 1 – Step 3 Section 2 – Life Safety BCPDIM02 Section 2 - Direction and Control Section 2 – Life Safety Section 2 – Recovery and Restoration Section 2 – Administration and Logistics BCPDIM03 Section 2 – Communications Section 2 – Community Outreach BCMST02 Section 1 – Step 4 BCMST03 Section 1 – Step 3, Section 1 – Step 4, Section 2 – Life Safety BCMSM01 Section 1 – Step 4 BCMSM02 Section 1 – Step 4

Date of the first release Date and identification of the last version October 1993 October 1993

Official web site http://www.fema.gov/business/guide/index.sht m User group web site Not applicable Relevant web site http://www.business.gov/guides/emergencypreparedness/

Availability in European languages English

Free Not free Updating fee 9

G.7.2 Scope

Government, Large SME Commercial Non commercial agencies companies companies companies 9 9 9 9 9 Specific sector Applicable to all sectors

Used in EU member states No

______________________________________________________________________ ENISA 169

Risk Management

Used in non-EU countries United States of America

Management 9 Operational Technical

Recognised licensing scheme Not applicable Existing certification scheme Not applicable

G.7.3 Users Viewpoint

To introduce To use To maintain None None None

Open market Company specific Readily available

Implementation of FEMA 141, does not confer regulatory compliance. It should be used in conjunction with the relevant industry regulatory guidelines e.g. relevant financial regulations

Not applicable

CD or download available Identification required Trial period Not applicable Not applicable Not applicable

It is possible to measure the I.S.S. maturity No level

______________________________________________________________________ ENISA 170

Risk Management

Non commercial tools Commercial tools Crisis Commander eBRP (parts) LDPRS (parts)

Tools can be integrated with other tools Not usually

Method provides interfaces to other Regulatory requirements as detailed by the organisational processes Occupational Safety and Health Administration (OHSA) and the Environmental Protection Agency (EPA)

Method allows use of sector adapted No databases

______________________________________________________________________ ENISA 171

Risk Management

GG..88 FSA BC Management Practice Guide

G.8.1 Product Identity Card

Method or tool name Vendor / Publisher name Country of origin FSA BC Management Practice Financial Services Authority UK Guide

9 9

Define BCM Business Design BCM Deliver BCP Test BCP Sustain BCM Framework Impact Approach Programme Analysis 9 9 9 9 9

Coverage of BCM Framework

BCM Framework Included? Comments activities (-, ●..●●●) Initiate BCM - Programme Identify the - Organisation Assign BCM and ● The Crisis Management Team has a clear and Incident formal structure. Alternates exist for all roles responsibilities Define BCM Policy -

Coverage of Business Impact Analysis

Business Impact Included? Comments Analysis processes (-, ●..●●●) Assess Risks and ● The need for annual risk assessments is Impacts mentioned. A fully detailed impact analysis on the loss of IT has been performed to identify which of the organisation’s IT systems and infrastructure are the most business critical Analyse Results - Prioritise recovery and define critical resource requirements

Coverage of BCM Approach

Design BCM Included? Comments Approach processes (-, ●..●●●) Agree Recovery - Strategy Determine Recovery - ______________________________________________________________________ ENISA 172

Risk Management

Options Design BCP ● Web based plans are accessible anywhere, but all key staff also carry quick reference cards. Alternatively a mix of paper, reference cards and or electronic and or web based is accessible at all times

Coverage of Deliver BCP

Deliver BCP Method Included? Comments processes (-, ●..●●●) Incident Response ● Plans reflect consultation of local emergency Plan services’ response plans and include reference materials Incident ● The crisis team is invoked following certain Management Plan agreed disruptive circumstances Business Recovery ● A BCP reflecting identified risks exists for all Plan departments Recovery Support ● Staff welfare plans are in place to ensure that Plan staff welfare needs are met Communications & ● The crisis management communication plan Media Plan covers internal and external communications with staff, peer organisations, the media and other stakeholders IT Service Continuity ●● IT restoration plans address restoration of IT Plan systems according to business conditions and the time needed to recover IT at all critical sites Business Resumption Plan

Coverage of Test BCP

Test BCP Method Included? Comments processes (-, ●..●●●) Determine type of ● The testing schedule is current and published test within the organisation Write Test Plan ● Pre test documentation is available before testing Conduct Test - Deliver Debrief and ● After the test reports are completed with clear Test Report actions and owners.

______________________________________________________________________ ENISA 173

Risk Management

Coverage of Sustain BCM Programme

Sustain BCM Included? Comments Programme (-, ●..●●●) processes Train Staff ● The team must be competent in all areas defined by the BCI. Most staff at all grades and contractors have received business continuity training Maintain and Review ● Plans are subject to internal and external BCP audit. Business Continuity appears on the Board’s agenda at least twice per year. Business Continuity planning appears on the Risk and Audit Committees’ agendas at least every quarter. Business Continuity is part of a formal change control process and are updated after testing or major changes Develop Awareness ●● Most staff are aware of the organisation’s business continuity strategy and of the roles,. Responsibilities and organisation of the business continuity team

Brief description of the product:

The Financial Services Authority Business Continuity Management Guide is aimed at financial organisations and is more of a guide to inform organisations about what should be included in their plans rather than a guide to tell them how to plan. There are some quite specific references to recovery timescales, which may not be relevant to non financial organisations. The section on ICT recovery is detailed and suggestions are made regarding protection of the information system, recovery options and the monitoring of the system. It is a useful set of guidelines to use when auditing financial organisations’ plans. It is suggested that this method should be used in conjunction with a non sector specific standard such as BS 25999-1 or HB 292.

______________________________________________________________________ ENISA 174

Risk Management

Controls implemented by using this method Control Reference Location of Reference to Control BCMFRR01 B1.4, B2.1, B2.4 BIA01 A1.1 BIA03 C1.1, C1.2 BIARIM01 C1.5 BIARIM03 C1.5 BIARIM04 C1.3, BIARIM05 C1.8, A2.4 BIARIM06 C1.7 BIARIM07 C1.6 BIARIM08 C1.9, D1.2, D1.3, D1.4 BIARIM09 C1.8 BIARIM10 C1.7 BIARIM12 C1.6 BIARIM13 C1.6 BIACRR01 A1.2, A2.4, C1.1 BIACRR02 C1.2 BCMARS02 B2.5 BCMARS03 C1.3, C1.10 BCMARS04 C1.7, C1.10 BCPDCP01 C.1 IT BCPDCP02 E2.2 BCPDCP03 A1.2 BCPDIM01 D1.5, D1.6, D1.7 BCPDIM02 B Corporate Crisis Management BCPDIM03 B3.1, B3.2, E2.1 BCPTT01 C1.12, C2.3 BCPTT02 A4.3, D1.7 BCPTP01 C1.12, C2.3 BCPTP02 A4.3, A4.4, C1.12,D1.7 BCPTC01 C1.12 BCPTC02 A4.3, E1.6 BCPTR02 A4.4 BCMST02 A3.1 BCMST03 E1.1, E1.2 BCMSM01 A4.1, A4.2, A1.2, C1.11 BCMSM02 A4.1 BCMSM03 A4.2, C1.11 BCMSA01 E1.1

Date of the first release Date and identification of the last version November 2006 FSA Business Continuity Practice Guide. November 2006

______________________________________________________________________ ENISA 175

Risk Management

Official web site www.fsa.gov.uk User group web site Relevant web site http://www.fsa.gov.uk/pubs/other/bcm_guide.pdf

Availability in European languages

Free Not free Updating fee 9

G.8.2 Scope

Government, Large SME Commercial Non commercial agencies companies companies companies 9 Specific sector Financial

Used in EU member states UK Used in non-EU countries No

Management 9 Operational 9 Technical

Recognised licensing scheme No Existing certification scheme No

______________________________________________________________________ ENISA 176

Risk Management

G.8.3 Users Viewpoint

To introduce To use To maintain Knowledge of Business Knowledge of Business Knowledge of Business Continuity and IT Service Continuity and IT Service Continuity and IT Service Continuity Continuity Continuity

Open market Company specific 9

The FSA BCM Practice Guide is not guidance on FSA rules, but it aims to provide guidance for regulated organisations on Business Continuity Planning

Implementation of the FSA BCM Practice Guide may assist with partial compliance with ISO 27002 and PAS 77.

CD or download available Identification required Trial period Not applicable

It is possible to measure the I.S.S. Implementation of the FSA BCM Practice Guide maturity level may assist with the risk management module of CMMI

Non commercial tools Commercial tools envisionERM myCOOP Crisis Commander LDPRS RiskMatrix

Tools can be integrated with other tools No

Method provides interfaces to other Change management organisational processes Configuration and release management Risk management

Method allows use of sector adapted Not applicable databases

______________________________________________________________________ ENISA 177

Risk Management

GG..99 HB 292-2006 A Practitioners Guide to Business Continuity Management

G.9.1 Product Identity Card

Method or tool name Vendor / Publisher name Country of origin HB 292-2006 Standards Australia Australia A Practitioners Guide to Business Continuity Management

9 9

Define BCM Business Design BCM Deliver BCP Test BCP Sustain BCM Framework Impact Approach Programme Analysis 9 9 9 9 9 9

Coverage of BCM Framework

BCM Framework Included? Comments activities (-, ●..●●●) Initiate BCM ●●● Programme Identify the ●●● Found under Confirmation of Processes Organisation (Section 2.9) Assign BCM and ●●● Incident responsibilities Define BCM Policy ●●●

Coverage of Business Impact Analysis

Business Impact Included? Comments Analysis processes (-, ●..●●●) Assess Risks and ●●● The whole of Chapter 3 is dedicated to the Impacts analysis of risk in a clear and detailed manner. Examples and templates are provided throughout the chapter and also in Appendix B, C, D, E and L (Workbook). Business Impact Analysis is discussed throughout the whole of Section 4 and is again very detailed. Examples and templates are provided throughout the chapter and blank templates are provided in Appendix J (Workbook) Analyse Results ●● See Chapter 6 Prioritise recovery ●●● This is discussed in Chapter 6 and also in and define critical Appendix G resource

______________________________________________________________________ ENISA 178

Risk Management

requirements

Coverage of BCM Approach

Design BCM Included? Comments Approach processes (-, ●..●●●) Agree Recovery ●● A comprehensive section, but does not go into Strategy detail on the various strategies for each resource category (e.g. personnel, ICT, premises….) Determine Recovery ●●● Template 5.1 provides a good methodology for Options determining the recovery options Design BCP ●●● Discusses the various levels of planning and the contents of the Business Continuity Plan(s)

Coverage of Deliver BCP

Deliver BCP Method Included? Comments processes (-, ●..●●●) Incident Response - Out of scope of this Guide Plan Incident ●●● The description of what to include within the Management Plan IMP is contained within Chapter 7, Activation and Deployment of the plans (including an example of an Incident Control System) is described in Chapter 10 and examples of the consolidated resource mapping and operational requirements are in Appendix G Business Recovery ● These are alluded to as Tier 2 Plans and the Plan Guide mentions a generic list of contents for BRPs Recovery Support - Recovery Support Plans (e.g. HR, Facilities, Plan HSE) are not described Communications & ●●● Extremely detailed information on preparing a Media Plan Communications Strategy, writing a Communications Plan, the issues which are encountered whilst developing the plan and a description of how perception affects the way in which information is processed IT Service Continuity - Not detailed within this Guide Plan Business ● This is mentioned in Section 7.3.1, but not Resumption Plan described in any detail

Coverage of Test BCP

Test BCP Method Included? Comments processes (-, ●..●●●) Determine type of ●●● A lot of detail is given in Chapter 9 about the test various types of tests Write Test Plan ●●● This is implied under Section 9.2.6 and Template 9.1 Exercise Template is an example of a Test Plan Conduct Test ●● This is mentioned under Section 9.2.6, but not in very much detail

BS 25999 contains a very detailed section on BC Strategy development ______________________________________________________________________ ENISA 179

Risk Management

Deliver Debrief and ●● Mentioned under Section 9.2.6, but it does not Test Report refer to a written Test Report, which should always be delivered

Coverage of Sustain BCM Programme

Sustain BCM Included? Comments Programme (-, ●..●●●) processes Train Staff ●●● An example programme of theoretical training is included in Table 19 Maintain and Review ●●● This is covered in Section 9.3 Performance BCP Develop Awareness ●● Within Chapter 2, the Guide stresses the importance of gaining commitment and engagement within the organisation and Chapter 9 mentions the importance of making staff aware of BCM and what their role may be.

Brief description of the product:

HB 292: 2006 is a very detailed Handbook describing all the elements required to develop, implement and maintain a Business Continuity programme. It is well illustrated with diagrams, examples and templates.

______________________________________________________________________ ENISA 180

Risk Management

Controls implemented by using this method Control Reference Location of Reference to Control BCMFI01 Chapter 2 BCMFI02 Chapter 2 BCMFI03 Chapter 2 BCMFRR01 Chapter 2 BCMFRR02 Chapter 2 BCMFO01 Appendix L BCMFO02 Chapter 2 BCMFP01 Chapter 2 BIA01 Chapter 3, Appendix B, D, L BIA02 Chapter 3 , Appendix E BIA03 Chapter 4, Appendix C BIACRR01 Chapter 6, Appendix G BCMARS01 Chapter 5, Appendix L BCPDCP04 Chapter 7, BCPDIM01 Chapter 7, 10 BCPDIM02 Chapter 7, 10 BCPDIM03 Chapter 8, Appendix A BCPDIM04 Chapter 10 BCPDIM05 Chapter 10 BCPTT02 Chapter 9 BCPTP02 Appendix L BCPTC02 Chapter 9 BCPTR02 Chapter 9 BCMST02 Chapter 9 BCMSM02 Chapter 9 BCMSA01 Chapter 9

Date of the first release Date and identification of the last version January 2006 HB 221: 2004 was the precursor to HB 292

Official web site www.standards.org.au User group web site Relevant web site www.sai-global.com

Availability in European languages English

Free Not free Updating fee Aus D 103.00 Not applicable

______________________________________________________________________ ENISA 181

Risk Management

G.9.2 Scope

Government, Large SME Commercial Non commercial agencies companies companies companies 9 9 9 9 9 Specific sector Applicable to all sectors

Used in EU member states No Used in non-EU countries Australia and New Zealand

Management 9 Operational 9 Technical

Recognised licensing scheme Not applicable Existing certification scheme Not applicable

It does provide a contents list for a BCP for an SME, but it would be fairly difficult to apply this standard to an SME ______________________________________________________________________ ENISA 182

Risk Management

G.9.3 Users Viewpoint

To introduce To use To maintain None None None

Open market Company specific Readily available

Implementation of HB 292, does not confer regulatory compliance. HB 292 should be used in conjunction with the relevant industry regulatory guidelines e.g. relevant financial regulations

Not applicable

CD or download available Identification required Trial period http://www.saiglobal.com/P ID is required to purchase Not applicable DFTemp/Previews/OSH/as/ the Handbook misc/handbook/HB292- 2006.pdf

It is possible to measure the I.S.S. maturity No level

Non commercial tools Commercial tools All commercially available BCM tools (e.g. LDPRS, eBRP, Crisis Commander….)

Tools can be integrated with other tools Not usually

Method provides interfaces to other Australian Emergency Manuals Series: organisational processes Part V The Management of Training. Manual 2: Managing Exercises (Emergency Management Australia 2001)

Method allows use of sector adapted No databases

______________________________________________________________________ ENISA 183

Risk Management

GG..1100 HB 221:2004.. Business Continuity Management

G.10.1 Product Identity Card

Method or tool name Vendor / Publisher name Country of origin HB 221:2004.. Business Standards Australia and Australia and New Zealand Continuity Management Standards New Zealand

9 9

Define BCM Business Design BCM Deliver BCP Test BCP Sustain BCM Framework Impact Approach Programme Analysis 9 9 9 9 9 9

Coverage of BCM Framework

BCM Framework Included? Comments activities (-, ●..●●●) Initiate BCM ● Programme Identify the ● It is suggested that BCM can start with a Organisation single business unit as a trial Assign BCM and ● The need for management commitment is Incident stressed responsibilities Define BCM Policy ● This is not referred to as such, but the outcomes described in Step 1, constitute a BCM Policy

Coverage of Business Impact Analysis

Business Impact Included? Comments Analysis processes (-, ●..●●●) Assess Risks and ●●● The need to consider existing organisational Impacts documentation is highlighted as well as the need to conduct an environmental analysis. Examples and Templates are provided. Analyse Results - This is not described Prioritise recovery ●● A useful Template is provided and define critical resource requirements

______________________________________________________________________ ENISA 184

Risk Management

Coverage of BCM Approach

Design BCM Included? Comments Approach processes (-, ●..●●●) Determine Recovery - Options for recovery are not discussed Options Agree Recovery ●● Reference is made to response strategies, but Strategy this section is more about determining what should be in the Plans. A template for strategy development is included Design BCP - Not included

Coverage of Deliver BCP

Deliver BCP Method Included? Comments processes (-, ●..●●●) Incident Response ● Plan Incident ●●● A minimum standard for the contents of plan Management Plan are provided, together with an example layout for a plan Business Recovery ● Alluded to, but not covered in depth Plan Recovery Support ● Alluded to, but not covered in depth Plan Communications & ●● A template for the development of the Media Plan communications’ messages is included IT Service Continuity - Plan Business ● Alluded to, but not covered in depth Resumption Plan

Coverage of Test BCP

Test BCP Method Included? Comments processes (-, ●..●●●) Determine type of ●● The different types of test or exercise are test discussed Write Test Plan ●● An example Test Plan is provided Conduct Test - No details are given about how to conduct a test and the roles involved Deliver Debrief and ● The need to conduct a debrief and document Test Report the outputs from the test is mentioned

______________________________________________________________________ ENISA 185

Risk Management

Coverage of Sustain BCM Programme

Sustain BCM Included? Comments Programme (-, ●..●●●) processes Train Staff ● A example Training Plan is provided, but HB 221 does not include any detail about Skills Matrices or Training Schedules Maintain and Review ● A BCM Checklist is included. However it is BCP quite high level. Develop Awareness ● The need to provide basic awareness material to advise staff of the broad nature of business continuity is mentioned

Brief description of the product:

HB 221:2004 covers all of the main elements of Business Continuity Planning and provides some useful examples, templates and checklists. However it is not in great depth and reference to other more detailed methods might be required.

______________________________________________________________________ ENISA 186

Risk Management

Controls implemented by using this method Control Reference Location of Reference to Control BCMFI01 Section 2.1 - Step 1 BCMFI02 Section 2.1 - Step 1 BCMFI03 Section 2.1 - Step 1 BCMFO01 Section 2.1 - Step 1 BCMFO02 Section 2.1 - Step 1 BCMFRR01 Section 2.1 - Step 1 Section 2.1 – Step 4 BCMFP01 Section 2.1 - Step 1 BIA01 Section 2.1 - Step 2 BIA02 Section 2.1 - Step 2 BIA03 Section 2.1 - Step 3, Table 1, Table 2, Table 3 Section 2.2 – Template 1, Template 2 BIACRR01 Section 2.1 - Step 3, Step 5 Section 2.2 – Template 5 BIACRR02 Section 2.1 - Step 3 BCMARS01 Section 2.1 – Step 4 Section 2.2 – Template 3, Template 4 BCPDCP02 Section 2.1 – Step 6 Section 2.2 – Template 6 BCPDCP03 Section 2.1 – Step 6 Section 2.2 – Template 6 BCPDCP04 Section 2.1 – Step 4 BCPDIM01 Section 2.1 – Step 4 BCPDIM02 Section 2.1 – Step 4, Step 6, Step 9 Section 2.2 – Template 6, Template 8, Template 9 BCPDIM03 Section 2.1 – Step 7 Section 2.2 – Template 7 BCPDIM04 Section 2.1, Step 9 BCPDIM05 Section 2.1, Step 9 BCPTT02 Section 2.1 – Step 8, Table 4 BCPTP02 Section 2.1 – Step 8 Section 2.2 – Template 10 BCPTR02 Section 2.1 – Step 8 BCMST03 Section 2.1 – Step 8 Section 2.2 – Template 10 BCMST04 BCMSM01 Section 2.1 – Step 8, Figure 3 BCMSM02 Section 2.1 – Step 8 Section 2.2 – Template 11 BCMSA01 Section 2.1 – Step 8

Date of the first release Date and identification of the last version 2003 HB 221:2004

______________________________________________________________________ ENISA 187

Risk Management

6. Useful links Official web site http://www.standards.org.au/ User group web site Relevant web site http://www.saiglobal.com/shop/script/Details.a sp?docn=AS0733762506AT http://www.riskmanagement.com.au/Default.a spx?tabid=168

Availability in European languages English

Free Not free Updating fee Aus $49.50 (pdf) N/A

G.10.2 Scope

Government, Large SME Commercial Non commercial agencies companies companies companies 9 9 9 9 9 Specific sector All sectors

Used in EU member states Some use Used in non-EU countries Predominantly used in Australia and New Zealand

Management 9 Operational Technical

Recognised licensing scheme Existing certification scheme

______________________________________________________________________ ENISA 188

Risk Management

G.10.3 Users Viewpoint

To introduce To use To maintain None None None

Open market Company specific 9

Implementation of HB 221, does not confer regulatory compliance. HB 221 should be used in conjunction with the relevant industry regulatory guidelines e.g. relevant financial regulations

Implementation of BCM to HB 221:2004 will allow users to comply with the BCM section of ISO 27002.

CD or download available Identification required Trial period Not applicable

It is possible to measure the I.S.S. No maturity level

Non commercial tools Commercial tools RiskMatrix myCOOP Crisis Commander enVisionERM Shadow Planner LDPRS

Tools can be integrated with other tools No

Method provides interfaces to other Risk Management (aligned with AS/NZS organisational processes 4360:2004 Risk Management) Corporate Governance

Method allows use of sector adapted Not applicable databases

______________________________________________________________________ ENISA 189

Risk Management

G.11 ISO/PAS 22399:2007 Societal Security – Guideline for Incident Preparedness and Operational Continuity Management

G.11.1 Product Identity Card

Method or tool name Vendor / Publisher name Country of origin ISO/PAS 22399:2007 International Standards Switzerland Societal Security – Guideline Organisation for Incident Preparedness and Operational Continuity Management

National International Private Public / White Paper/ Handbo Guidelin Standardisati Standardisati sector governme Recommendati ok es on body on body organisati nt on on organisati /associatio on n 9 9

Define BCM Business Design BCM Deliver BCP Test BCP Sustain BCM Framework Impact Approach Programme Analysis

Coverage of BCM Framework

BCM Framework Included? Comments activities (-, ●..●●●) Initiate BCM ●● The project team develop and implement the Programme policy and strategy for the programme. The programme should be measurable and consistent with the policy. Timeframes and responsibilities should be identified Identify the ● The standard identifies the need to determine Organisation critical operational objectives and activities as identified in strategies, business plans, policy and mission statements, risk management plans and management tools such SWOT analysis. Assign BCM and ● ISO/PAS 22399 stresses the importance of Incident driving the programme from the top of the responsibilities organisation, with principal managers endorsing and promoting it. Section 7.1 introduces the resources, roles, responsibilities and authority Define BCM Policy ●● The scope of the IPOCM (Incident Preparedness/Operational Continuity Programme) should be defined and documented and the relationships with stakeholders and other organisations should

______________________________________________________________________ ENISA 190

Risk Management

be considered. The organisation should also develop a IPOCM Policy. Relevant legal and regulatory requirements should be adhered to

Coverage of Business Impact Analysis

Business Impact Included? Comments Analysis processes (-, ●..●●●) Assess Risks and ●●● Risk Assessment should be conducted to Impacts identify the organisation’s risks and threats, their likelihood and impact. Naturally occurring, human technology and business related events should be considered. The areas which should be considered during the impact analysis are given and include welfare of stakeholders, health and safety, property, infrastructure and delivery of services. Organisations also need to investigate the cost and resources required to restore critical functionality. Annex A provides more detail on how to conduct an impact analysis. Analyse Results ● The results from the threat and hazard identification and risk assessment are analysed to determine the prevention and mitigation programme, which should take benefits and costs into account Prioritise recovery ● The minimum resource requirements should and define critical be included in the incident (emergency) resource response plan. Details of these are given in requirements Annex B.

Coverage of BCM Approach

Design BCM Included? Comments Approach processes (-, ●..●●●) Determine Recovery ● Examples of Recovery Options are given in Options Annex C C.3 and these include process transfer, mutual aid, temporary workaround, change/suspend/terminate, insure. Agree Recovery - Strategy Design BCP -

______________________________________________________________________ ENISA 191

Risk Management

Coverage of Deliver BCP

Deliver BCP Method Included? Comments processes (-, ●..●●●) Incident Response ●● The purpose and contents of an incident Plan (emergency) response plan are outlined and the importance of preserving life and property is stressed. Incident ●● The purpose and contents of the Incident Management Plan Management Plan (Operational Continuity Management Plan) are outlined. Annex C provides a list of items which should be in the plan, including actions, trigger points, responsibilities and ICT and data requirements. Business Recovery ●● The content of these is based on that for the Plan Incident Management Plan. The standard states that large organisations might require separate documents for each of their critical operation areas/functions. Recovery Support ●● The content of these is based on that for the Plan Incident Management Plan. The standard states that large organisations might require separate documents for each of their critical operation areas/functions Communications & ●● The organisation should establish, implement Media Plan and maintain procedures for disseminating information before, during and after a disruption. This could be to internal and external stakeholders, the public, emergency services and anyone else potentially affected by the incident IT Service Continuity - Plan Business ●● The purpose of the Business Resumption Resumption Plan (Recovery Management) Plan is to detail the actions required for a staged return to normal pre incident activity. The standard describes the elements which should be included in the plan.

______________________________________________________________________ ENISA 192

Risk Management

Coverage of Test BCP

Test BCP Method Included? Comments processes (-, ●..●●●) Determine type of ● The different types of test are mentioned and test the areas which should be tested (e.g. staff plans, communication plans) Write Test Plan ● Test Plans are briefly mentioned – “exercises should be based on realistic scenarios which are carefully planned and agreed with stakeholders….” Conduct Test - Details of how to conduct tests are not given Deliver Debrief and ● The need to write a post-exercise report is Test Report mentioned, which contains recommendations to improve IPOCM arrangements

Coverage of Sustain BCM Programme

Sustain BCM Included? Comments Programme (-, ●..●●●) processes Train Staff ●● The objective of training is to create awareness and enhance the skills required to develop implement, maintain and execute the IPOCM programme Maintain and Review ●●● IPOCM plans should be evaluated periodically BCP and changes reflected in the procedures. In addition a clearly defined and documented IPOCM maintenance programme should be established. Proactive monitoring should be carried out to check the conformity and effectiveness of the programme, internal audits and self assessments should be conducted. Top management should review the organisation’s IPOCM system at planned intervals to ensure its continuing suitability, adequacy and effectiveness. Develop Awareness ●●● The standard states that IPOCM should be owned by everyone in the organisation and that staff should understand why IPOCM is being introduced. Annex D lists the elements which should be present to successfully embed the culture of IPOCM

Brief description of the product:

ISO/PAS 22399:2007 has been based upon the BS 25999-1, HB 221:2004 and NFPA 1600:2004 standards and as such contains the familiar elements of business continuity management. However it does introduce the completely new term Incident Preparedness and Operational Continuity Culture. It is particularly strong in the areas of top management engagement, maintenance, review, audit, reporting and corrective action planning.

Controls implemented by using this method Control Location of Reference Reference to Control BCMFI01 Project Plans Section 5.6, 6.7.1

______________________________________________________________________ ENISA 193

Risk Management

Control Location of Reference Reference to Control BCMFO02 Organisation strategy Section 5.2 BCMFRR01 BCM and Incident Teams Section 5.3, 5.6, 6.2, 7.1 BCMFP01 BCM Policy Section 5.2, 5.4, 5.5 BIA01 Risk Assessment Section 6.5 BIA02 Vulnerability scanning Section 6.5 BIA03 Impact Assessment Section 6.6, Annex A BIACRR01 Critical Resource Requirements Matrix Annex B BCMARS01 Business Continuity Strategy Annex C C.3 BCPDCP02 Recovery Support Planning Section 6.7.5, Annex C C.1, C.2 BCPDCP03 Business Recovery Planning Section 6.7.5, Annex C C.1, C.2 BCPDCP04 Business Resumption Planning Section 6.7.3, 6.7.6 BCPDIM01 Incident Response Planning Section 6.7.3, 6.7.4, Annex B BCPDIM02 Incident Management Planning Section 6.7.3, 6.7.5, Annex C C.1, C.2 BCPDIM03 Incident communication procedures and Section 7.4 scripts BCPTT02 Business Continuity Test Schedule 8.3 BCPTP02 Business Continuity Test Plan 8.3 BCPTR02 Business Continuity Test and Exercise Report 8.3 BCMST02 Business Continuity Skills Matrix Section 7.3 BCMST03 Business Continuity Training Schedule Section 7.3 BCMSM01 Maintenance and Review Schedule Section 4, 8.1, 8.2, 8.5 BCMSM02 Audit and Review Results Section 8.1, 8.2, 8.5, 8.6, 9.0 BCMSM03 Corrective Action Plan Section 8.4 BCMSA01 Awareness Campaign Section 7.2, Annex D

Date of the first release Date and identification of the last version 2007 ISO/PAS 22399:2007

Official web site www.iso.org User group web site http://www.22399.info/ Relevant web site http://www.iso.org/iso/catalogue_detail?csnu mber=50295

Availability in European languages English

Free Not free Updating fee CHF 120.00 N/A

G.11.2 Scope

Government, Large SME Commercial Non commercial agencies companies companies companies 9 9 9 9 9 Specific sector Applicable to all sectors ______________________________________________________________________ ENISA 194

Risk Management

Used in EU member states United Kingdom Used in non-EU countries Australia, Israel, Japan and the United States

Management 9 Operational Technical

Recognised licensing scheme No Existing certification scheme No

G.11.3 Users Viewpoint

To introduce To use To maintain An understanding of BCM An understanding of BCM An understanding of BCM

Open market Company specific 9

Implementation of ISO/PAS 22399, does not confer regulatory compliance. It should be used in conjunction with the relevant industry regulatory guidelines e.g. relevant health and safety and financial regulations.

No

CD or download available Identification required Trial period Not applicable

It is possible to measure the I.S.S. Implementation of this standard may assist maturity level towards complying with the risk management requirements of CMMI

Non commercial tools Commercial tools Crisis Commander LDPRS enVision myCOOP Shadow Planner ImpactAware eBRP

______________________________________________________________________ ENISA 195

Risk Management

8. Technical integration of available tools Tools can be integrated with other tools No

Method provides interfaces to other Corporate Governance organisational processes Change Management Records Management Continuous Improvement Programme Operational Control

Method allows use of sector adapted N/A databases

______________________________________________________________________ ENISA 196

Risk Management

G.12 ITIL v2

G.12.1 Product Identity Card

Method or tool name Vendor / Publisher name Country of origin ITIL v2 Office of Government UK Commerce

9

Define BCM Business Design BCM Deliver BCP Test BCP Sustain BCM Framework Impact Approach Programme Analysis 9 9 9 9 9 9

Coverage of BCM Framework

BCM Framework Included? Comments activities (-, ●..●●●) Initiate BCM ● This methodology is aimed at IT Service Programme Continuity Management. Stage 1 assumes the existence of Business Continuity within the organization. A policy for the management intention and objectives defines the role of ITSCM and its interface with BCM. If no such program exists then it covers such tasks as undertaking a Risk Analysis and Business Impact Analysis and determination of the command and control structure required to support a business interruption. Identify the ●● Terms of reference and scope taking into Organisation account the responsibilities of all staff in the organization. Assign BCM and ● Responsibilities are identified for individuals Incident and teams for ITSCM Disaster Recovery only. responsibilities Define BCM Policy - This is out with the scope of this method.

______________________________________________________________________ ENISA 197

Risk Management

Coverage of Business Impact Analysis

Business Impact Included? Comments Analysis processes (-, ●..●●●) Assess Risks and ●● Risk Analysis is performed purely on IT –“The Impacts driver is the likelihood that a disaster or other serious service disruption will actually occur. This is an assessment of the level of threat and the extent to which an organization is vulnerable to that threat”. Analyse Results ●●● Using a cyclic methodology (Identify, Assess, Plan, Implement) risks and managed in the Issue Log, Risk management Plan, Risk Management Process Guide, Risk Management Policy, Risk Register. Prioritise recovery - No prioritization is determined for recovery and define critical (even of IT assets). resource requirements

Coverage of BCM Approach

Design BCM Included? Comments Approach processes (-, ●..●●●) Agree Recovery ● ITSCM Recovery strategy is developed. Strategy Determine Recovery ● ITSCM Recovery options are identified. Options Design BCP - This is out with the scope of this method.

Coverage of Deliver BCP

Deliver BCP Method Included? Comments processes (-, ●..●●●) Incident Response ● One of the plans “that will need to be Plan integrated with the main BCP”. Incident ● One of the plans “that will need to be Management Plan integrated with the main BCP”. Business Recovery ● This is out with the scope of this method. ITIL Plan will provide Service Continuity plans for IT systems supporting the business processes. Recovery Support - This is out with the scope of this method. Plan Communications & - This is out with the scope of this method. Media Plan IT Service Continuity ●●● This method is purely the creation, Plan maintenance and testing of these plans. Business - This is out with the scope of this method. Resumption Plan

Coverage of Test BCP

Test BCP Method Included? Comments processes (-, ●..●●●) Determine type of ●●● The four types described are : test Walk-through tests Full tests Partial tests ______________________________________________________________________ ENISA 198

Risk Management

Test BCP Method Included? Comments processes (-, ●..●●●) Scenario tests Write Test Plan - Despite a section on testing which includes types of testing, the need to test all plans after a major change and the need to align with BCP, here is no mention of an actual test plan. Conduct Test ●● The type, frequency and need for testing is clearly defined but there is no detail on issues arising. Deliver Debrief and - Omitted from this version of the methodology. Test Report

Coverage of Sustain BCM Programme

Sustain BCM Included? Comments Programme (-, ●..●●●) processes Train Staff ● Education, awareness and training for service continuity-specific items. Maintain and Review ●● Regular reviews. BCP Develop Awareness ●● Education, awareness and training for service continuity-specific items.

Brief description of the method:

Service Continuity Management is - keeping a level of availability despite part of the IT system failing over and recovering those components using agreed (and exercised) plans and processes in order to return to normal availability. It is the Process responsible for managing Risks that could seriously affect IT Services. ITSCM ensures that the IT Service provider can always provide minimum agreed Service levels, by reducing the Risk to an acceptable level and Planning for the Recovery of IT Services. ITSCM should be designed to support Business Continuity Management.

______________________________________________________________________ ENISA 199

Risk Management

Controls implemented by using this method Control Reference Location of Reference to Control BCMFI01 Section 4.5.5.1 BCMFI02 Section 4.5.5.1 BCMFO01 Section 4.5.5.1 BCMFRR01 Section 4.5.5.1, 4.5.5.3 BCMFP01 Section 4.5.5.1 BIA01 Section 4.5.5.2 BIA03 Section 4.5.5.2, Figure 4.22 BIARIM01 Section 4.5.5.2 BIARIM03 Section 4.5.5.2 BIARIM04 Section 4.5.5.2 BIARIM05 Section 4.5.5.2 BIARIM08 Section 4.5.5.2 BIARIM12 Section 4.5.5.2 BIARIM13 Section 4.5.5.2 BIACRR01 Section 4.5.5.2 BIACRR02 Section 4.5.5.2 BCMARS01 Section 4.5.5.2 BCMARS03 Section 4.5.5.2, Figure 4.25 BCMARS04 Section 4.5.5.2 BCPDCP01 Section 4.5.5.3 BCPDCP02 Section 4.5.5.3 BCPDCP03 Section 4.5.5.3 BCPDIM01 Section 4.5.5.3 BCPDIM02 Section 4.5.5.4 BCPDIM03 Section 4.5.5.3 BCPTT01 Section 4.5.5.4 BCPTP01 Section 4.5.5.3 BCPTP02 Section 4.5.5.3 BCMSM01 Section 4.5.5.4, 4.5.7 BCMSM02 Section 4.5.7

Date of the first release Date and identification of the last version Developed in the 1980s ITIL v3 May 2007

Official web site www.itil.org.uk User group web site www.itilcommunity.com Relevant web site www.itil-itsm-world.com

Availability in European languages English

Free Not free Updating fee 9

______________________________________________________________________ ENISA 200

Risk Management

G.12.2 Scope

Government, Large SME Commercial Non commercial agencies companies companies companies 9 9 9 9 9 Specific sector ITIL is exclusively for use within the IT department of an organisation.

Used in EU member states Widespread Used in non-EU countries Widespread

Management Operational 9 Technical

Recognised licensing scheme None Existing certification scheme

G.12.3 Users Viewpoint

To introduce To use To maintain ITIL knowledge ITIL knowledge ITIL knowledge

Open market Company specific Readily available

ITIL accreditation is readily available. As a set of concepts and techniques for managing IT infrastructure, development and operations there is no regulatory control, its usage is elective and good practice.

ITIL is a set of methodologies covering different aspects of IT Management. The methodologies applied to an individual organization are implemented and tailored to their requirements.

CD or download available Identification required Trial period Not Applicable Not Applicable Not Applicable

It is possible to measure the I.S.S. maturity level Not Applicable

Non commercial tools Commercial tools Many e.g. ITIL Template kit from www.itgovernance.co.uk

Tools can be integrated with other tools Many tools support ITIL e.g. Tivoli

______________________________________________________________________ ENISA 201

Risk Management

Method provides The toolkit covers a number of IT disciplines: interfaces to other The IT Service Management sets organisational processes 1. Service Delivery 2. Service Support Other operational guidance 3. ICT Infrastructure Management 4. Security Management 5. The Business Perspective 6. Application Management 7. Software Asset Management To assist with the implementation of ITIL practices a further book was published providing guidance on implementation (mainly of Service Management): 8. Planning to Implement Service Management

ITIL v2 makes reference to the need to ensure that documents are controlled under Change and Configuration Management. Other process mentioned are: Problem Management Availability Management Service Level Management Capacity Management Information Security Management

Method allows use of sector adapted databases Not Applicable

______________________________________________________________________ ENISA 202

Risk Management

GG..1133 ITIL v3

G.13.1 Product Identity Card

Method or tool name Vendor / Publisher name Country of origin ITIL v3 Office of Government UK Commerce

9

Define BCM Business Design BCM Deliver BCP Test BCP Sustain BCM Framework Impact Approach Programme Analysis 9 9 9 9 9 9

Coverage of BCM Framework

BCM Framework Included? Comments activities (-, ●..●●●) Initiate BCM ● This methodology is aimed at IT Service Programme Continuity Management. Stage 1 consists of the following: Policy Setting Specify Terms of Reference and Scope Allocate Resources Define project Org & control structure Agree Project and Quality plans Identify the ●● Specify terms of reference and scope — Organisation this includes defining the scope and responsibilities of managers and staff in the organisation, and the method of working. Assign BCM and ●● Management roles and responsibilities are Incident discussed in depth. Unlike v2 this includes BC responsibilities Managers responsibility for ITSCM. Responsibilities at all levels of the organization are detailed for both Normal operations and Invocation. Define BCM Policy - This is out with the scope of this method.

______________________________________________________________________ ENISA 203

Risk Management

Coverage of Business Impact Analysis

Business Impact Included? Comments Analysis processes (-, ●..●●●) Assess Risks and ●● Risk Analysis is performed purely on IT. This Impacts is performed by: Identifying risks Assess threat and vulnerability levels Assess the levels of risk Analyse Results ●●● The risk analysis is then used to determine appropriate countermeasures or risk reduction measures to manage the risks.

ITSCM needs to consider and assess potential risks and reduction measures across the whole Infrastructure.

This is then fed back into the Business Continuity Strategy. Prioritise recovery ●● The risk assessment helps determine the and define critical Continuity Options. These include resource consideration of the relative service recovery requirements priorities and the changes in relative service priority for the time day, day of the week, and monthly and annual variations.

Coverage of BCM Approach

Design BCM Included? Comments Approach processes (-, ●..●●●) Agree Recovery ● ITSCM Recovery strategy is developed. Strategy Determine Recovery ● ITSCM Recovery options are identified. The Options business recovery objectives are taken into account. Design BCP ● The Recovery Strategy is an input to the Business Continuity Strategy.

______________________________________________________________________ ENISA 204

Risk Management

Coverage of Deliver BCP

Deliver BCP Method Included? Comments processes (-, ●..●●●) Incident Response ● Included in the high level coordination plan. Plan Incident ● Included in the high level coordination plan. Management Plan Business Recovery - This is out with the scope of this method. Plan Recovery Support ● The detailed ITSCM plans will provide IT Plan resilience. Communications & ● This is out with the scope of this method but Media Plan some details are covered in the high level coordination plan. IT Service Continuity ●●● These plans are developed by this Plan methodology. Business - This is out with the scope of this method. Resumption Plan

Coverage of Test BCP

Test BCP Method Included? Comments processes (-, ●..●●●) Determine type of ●●● The types described are : test Performance Functional Operational Acceptance Validation of data integrity and consistency. Write Test Plan ● The only mention of the test plan is that “Maintain a comprehensive IT testing schedule” is one of the responsibilities of the ITSCM Manager, however it does state that “following the initial testing it is necessary to establish a programme of regular testing to ensure that the critical components of the strategy are tested at least annually or as directed by senior management or audit. It is important that any changes to the IT Infrastructure are included in the strategy, implemented in an appropriate fashion and tested to ensure that they function correctly within the overall provision of IT Services.” Conduct Test ● What little there was in v2 has been reduced, somewhat, in v3. Deliver Debrief and - Omitted from this version of the methodology. Test Report

______________________________________________________________________ ENISA 205

Risk Management

Coverage of Sustain BCM Programme

Sustain BCM Included? Comments Programme (-, ●..●●●) processes Train Staff ●● Education and awareness for service continuity-specific items is more detailed in v3 than previous versions. This is an on-going process. Maintain and Review ●● Regular reviews. BCP Develop Awareness ●● Awareness for service continuity-specific items has been enhanced over v2. There are now a series of measures to ensure the continued awareness and BC status in order to keep staff informed and map any changes.

Brief description of the method:

IT Service Continuity Management (ITSCM) is one of the components in the ITIL Service Delivery area. Also known as Disaster Recovery Planning, Disaster Contingency Planning or just Disaster Recovery, it provides a framework for developing IT infrastructure recovery plans in support of Business Continuity Management (BCM) plans and timeframes. Service Continuity Management is - keeping a level of availability despite part of the IT system failing over and recovering those components using agreed (and exercised) plans and processes in order to return to normal availability. It is the Process responsible for managing Risks that could seriously affect IT Services. ITSCM ensures that the IT Service provider can always provide minimum agreed Service levels, by reducing the Risk to an acceptable level and Planning for the Recovery of IT Services.

______________________________________________________________________ ENISA 206

Risk Management

Controls implemented by using this method Control Reference Location of Reference to Control BCMFI01 Annex 7B BCMFRR01 Section 7.3.3, 7.4, Annex 7A BCMFP01 Section 7.2, 7.3.1 BIA01 Section 7.3.2 BIA02 Section 7.3.4 BIA03 Section 7.3.2 BIARIM03 Section 7.3.3 BIARIM04 Section 7.3.1 BIARIM05 Section 7.3.3 BIARIM06 Section 7.3.3 BIARIM07 Section 7.3.1 BIARIM08 Section 7.3.3 BIACRR02 Section 7.3.3 BCMARS01 Section 7.3.1, 7.3.4 BCMARS03 Section 7.3.1 BCMARS04 Section 7.3.3 BCMARS05 Section 7.3.3 BCPDCP01 Section 7.3.3, Annex 7C BCPDCP02 Section 7.3.3, Annex 7C BCPDCP03 Section 7.3.3, Annex 7C BCPDIM01 Section 7.3.3 BCPDIM02 Section 7.3.3, 7.3.5, Annex 7C BCPDIM03 Section 7.3.3 BCPTT01 Section 7.3.4, 7.5.3 BCPTP01 Section 7.3.3 BCMST01 Section 7.3.4 BCMSM01 Section 7.3.4 BCMSA01 Section 7.3.4, 7.5

Date of the first release Date and identification of the last version Developed in the 1980s ITIL v3 May 2007

Official web site www.itil.org.uk User group web site www.itilcommunity.com Relevant web site www.itil-itsm-world.com www.itsmwatch.com/itil www.itil.org/de/ www.itil-toolkit.com

______________________________________________________________________ ENISA 207

Risk Management

Availability in European languages English, Danish, Spanish, French, German, Italian, Swedish

Free Not free Updating fee 9

G.13.2 Scope

Government, Large SME Commercial Non commercial agencies companies companies companies 9 9 9 9 9 Specific sector ITIL is exclusively for use within the IT department of an organisation.

Used in EU member states Widespread Used in non-EU countries Widespread

Management Operational 9 Technical

Recognised licensing scheme Certification is managed by the ITIL Certification Management Board (ICMB) Existing certification scheme

G.13.3 Users Viewpoint

To introduce To use To maintain ITIL knowledge ITIL knowledge ITIL knowledge

Open market Company specific Readily available

ITIL accreditation is readily available. As a set of concepts and techniques for managing IT infrastructure, development and operations there is no regulatory control, its usage is elective and good practice.

ITIL is a set of methodologies covering different aspects of IT Management. The methodologies applied to an individual organization are implemented and tailored to their requirements.

______________________________________________________________________ ENISA 208

Risk Management

CD or download available Identification required Trial period Not Applicable Not Applicable Not Applicable

It is possible to measure the I.S.S. Not Applicable maturity level

Non commercial tools Commercial tools Many e.g. ITIL Template kit from www.itgovernance.co.uk

Tools can be integrated with other tools Many tools support ITIL e.g. Tivoli

Method provides interfaces to other The toolkit is detailed in five volumes: organisational processes Service Strategy Service Design Service Transition Service Operation Continual Service Improvement

ITIL v3 makes reference to the need to ensure that documents are controlled under Change Management. Also mentioned is Information Security Management

Method allows use of sector adapted Not Applicable databases

______________________________________________________________________ ENISA 209

Risk Management

G.14 NFPA 1600. Standard on Disaster/Emergency Management and Business Continuity Programmes

G.14.1 Product Identity Card

Method or tool name Vendor / Publisher name Country of origin NFPA 1600. Standard on National Fire Protection United States of America Disaster/Emergency Association. Management and Business Approved by the American Continuity Programmes National Standards Institute

9 9

Define BCM Business Design BCM Deliver BCP Test BCP Sustain BCM Framework Impact Approach Programme Analysis 9 9 9 9 9 9

Coverage of BCM Framework

BCM Framework Included? Comments activities (-, ●..●●●) Initiate BCM ● Programme Identify the - Organisation Assign BCM and ● The incident roles are defined under the Incident planning section. Responsibilities are not responsibilities defined Define BCM Policy ●

Coverage of Business Impact Analysis

Business Impact Included? Comments Analysis processes (-, ●..●●●) Assess Risks and ●● Impacts Analyse Results - Prioritise recovery ●● Resource requirements are fairly well and define critical documented, but are more biased towards the resource resources required to manage a civil requirements emergency rather than organisational resources.

Coverage of BCM Approach

Design BCM Included? Comments Approach processes (-, ●..●●●) Agree Recovery ● Strategy ______________________________________________________________________ ENISA 210

Risk Management

Determine Recovery - Options Design BCP ●

Coverage of Deliver BCP

Deliver BCP Method Included? Comments processes (-, ●..●●●) Incident Response ●● Plan Incident ●● There is a lot of detail regarding management Management Plan of an incident, but not a great deal on how the critical activities are recovered Business Recovery - Plan Recovery Support ● Some reference is made to Facilities related Plan actions, but not everything which would be expected for Business Continuity (eg transportation, catering, accommodation) Communications & ●● Media Plan IT Service Continuity - Plan Business - Resumption Plan

Coverage of Test BCP

Test BCP Method Included? Comments processes (-, ●..●●●) Determine type of ● test Write Test Plan - Conduct Test ● Deliver Debrief and ● Test Report

Coverage of Sustain BCM Programme

Sustain BCM Included? Comments Programme (-, ●..●●●) processes Train Staff ●● Maintain and Review ● There is a lot of detail on the Corrective Action BCP Programme to address shortfalls found as a result of testing. However ongoing maintenance and review is not referred to Develop Awareness ● This is alluded to, but not discussed in any detail

Brief description of the product:

The Standard does address the elements of Business Continuity Planning, but it has a strong focus on emergency management and multi agency collaboration. The recommendations for setting up and managing an Incident Room (EOC) are quite detailed, but there is not much detail on how to get the organisation back up and running. The standard is quite hard to use as the mandatory statements are in one section and the recommendations about implementing the requirements are in the appendix, which makes

______________________________________________________________________ ENISA 211

Risk Management

using the standard difficult (incident management is detailed across Section 5, Annex A and Annex E).

Controls implemented by using this method Control Reference Location of Reference to Control BCMFRR01 Section 5.8.2.2, 5.9, Appendix A4.1(1), Appendix 4.2, 4.3 BIA01 Section 5.3, Appendix A5.3 BIA03 Section 5.3.3. A3.3.6, Appendix 4.1(2) BIARIM03 Appendix A5.10.3 BIARIM08 Section 5.4, 5.5 BIARIM11 Appendix A5.10.3 BIACRR01 Section 5.8.2.4, Appendix A5.6 BIACRR02 Appendix A5.3.3(3) BCMARS01 Section 5.8.3.1, 5.8.3.3, Appendix 5.8.3.7 BCMARS02 Appendix A5.8.3.8(5) BCMARS04 Appendix A5.8.3.8(5) BCPDCP03 Section 5.8.3.7 BCPDIM01 Section 5.8.3.4, 5.11, 5.12, Appendix A5.11, A5.12.1 BCPDIM02 Section 5.8.3.7, 5.11, 5.12, Appendix A5.8.3.8, A5.9.1, A5.9.3 BCPDIM03 Section 5.10, 5.15, Appendix A5.15.1, A5.15.2, BCPDIM04 Appendix A5.14.4 BCPDIM05 Section 5.14.2 BCPTT02 Appendix A5.14.3 BCPTP02 Section 5.14.3 BCMST01 Section 5.13 BCMST03 Section 5.13 BCMSM01 Section 5.14 BCMSM03 Appendix A5.14.4

Date of the first release Date and identification of the last version 1995 20 December 2006 (2007 Edition)

Official web site www.nfpa.org User group web site Relevant web sites http://www.emforum.org/eiip/VFRE/intro.htm http://www.davislogic.com/NFPA1600.htm http://www.nasttpo.org/NFPA1600.htm http://www.disaster-resource.com/articles/05p_062.shtml http://www.continuitycentral.com/news03001.htm

Availability in European languages English

Free Not free Updating fee 9

______________________________________________________________________ ENISA 212

Risk Management

G.14.2 Scope

Government, Large SME Commercial Non commercial agencies companies companies companies 9 9 9 9 9 Specific sector No

Used in EU member states On a limited basis Used in non-EU countries Yes

Management Medium Operational Medium Technical Low

Recognised licensing scheme No Existing certification scheme No – adherence is voluntary, but reference could be made to the standard if incident becomes a legal issue. NFPA 1600 is used as the basis for assessment against NEMA’s Emergency Management Accreditation Programme

G.14.3 Users Viewpoint

To introduce To use To maintain http://www.nfpa.org/catalo Understanding of Business Understanding of Business g/product.asp?catalog%5Fn Continuity and Emergency Continuity and Emergency ame=NFPA+Catalog&pid=I Management Management M160007&link%5Ftype=sea rch&order%5Fsrc=A647&src =nfpa For a guide on implementing NFPA 1600

Open market Company specific 9

Adoption of NFPA 1600 in the USA is voluntary, but reference to it could be made if a lawsuit follows an incident. NEMA use the standard as a basis for their Emergency Management Accreditation Programme. Adoption of NFPA 1600 does not confer regulatory compliance. Organisations should still comply with their relevant industry regulatory requirements in addition to NFPA 1600.

None

CD or download available Identification required Trial period N/A – standard is free N/A N/A

______________________________________________________________________ ENISA 213

Risk Management

It is possible to measure the I.S.S. No maturity level

Non commercial tools Commercial tools Crisis Commander Frontworks Risk Matrix enVisionERM LDPRS BIA Professional

Tools can be integrated with other tools No

Method provides interfaces to other FEMA 141 organisational processes DRII Professional Practices for Business Continuity Planners Emergency Response Management Continuous Improvement Programme Risk Management

Method allows use of sector adapted No databases

______________________________________________________________________ ENISA 214

Risk Management

GG..1155 NIST 800-34 Contingency Planning Guide for Information Technology Systems

G.15.1 Product Identity Card

Method or tool name Vendor / Publisher name Country of origin NIST 800-34 Contingency National Institute of United States of America Planning Guide for Standards and Technology Information Technology Systems

9 9 Yes Can be For federal used on a organisations voluntary which basis process sensitive information.

Define BCM Business Design BCM Deliver BCP Test BCP Sustain BCM Framework Impact Approach Programme Analysis 9 9 9 9 9 9

Coverage of BCM Framework

BCM Framework Included? Comments activities (-, ●..●●●) Initiate BCM ● Initiation is touched upon, but more in relation Programme to contingency arrangements for a system under development or acquisition Identify the ● Organisation Assign BCM and ●● Discussed under Recovery Strategies. BCM Incident roles are discussed in the Planning Process responsibilities section Define BCM Policy ●●

______________________________________________________________________ ENISA 215

Risk Management

Coverage of Business Impact Analysis

Business Impact Included? Comments Analysis processes (-, ●..●●●) Assess Risks and ●●● Example templates are provided in Appendix B Impacts Analyse Results ●● Further reference is made to this within Appendix B Prioritise recovery ●● Also see Appendix B and define critical resource requirements

Coverage of BCM Approach

Design BCM Included? Comments Approach processes (-, ●..●●●) Agree Recovery ●●● Strategy Determine Recovery ●● Options Design BCP ●● Example template given in Appendix A, although template does not contain Action Lists, invocation, incident structure or responsibilities

Coverage of Deliver BCP

Deliver BCP Method Included? Comments processes (-, ●..●●●) Incident Response ●●● The Contingency Plan Development section Plan concentrates on the arrangements for assessing the damage to the IT components rather than any human aspects of Incident Response. Personnel considerations are found in Appendix D Incident ● Reference is made to the CIO or the Management Plan Contingency Planning Co-ordinator leading the recovery and bringing in the relevant recovery teams (eg server, mainframe, LAN), but no mention is made of the other roles which may be required e.g. administration, facilities, logistics, internal and external communications Business Recovery - Plan Recovery Support - Plan Communications & ●● Found in Appendix D Media Plan IT Service Continuity ●●● One of the suggested plans is the BCM suite of Plan plans is the IT Service Continuity Plan. NIST 800-34 addresses this well Business - Resumption Plan

______________________________________________________________________ ENISA 216

Risk Management

Coverage of Test BCP

Test BCP Method Included? Comments processes (-, ●..●●●) Determine type of ●● test Write Test Plan ●● Conduct Test ● Deliver Debrief and ● Test Report

Coverage of Sustain BCM Programme

Sustain BCM Included? Comments Programme (-, ●..●●●) processes Train Staff ● Maintain and Review ●●● BCP Develop Awareness -

Brief description of the product:

NIST 800-34 is a fairly comprehensive guide which could be used in the development of a BCP, however it is much more focused on IT Service Continuity. It is a clear, easy to read, and navigable document which provides examples and templates.

______________________________________________________________________ ENISA 217

Risk Management

Controls implemented by using this method Control Reference Location of Reference to Control BCMFRR01 Chapter 3 BCMFP01 Chapter 3 BIA03 Chapter 3 BIARIM03 Chapter 5 BIARIM04 Chapter 5 BIARIM05 Chapter 3 BIARIM06 Chapter 3, Chapter 5 BIARIM07 Chapter 5 BIARIM08 Chapter 3 BIARIM09 Chapter 3 BIARIM10 Chapter 5 BIARIM11 Chapter 5 BIARIM14 Chapter 5 BCMARS01 Chapter 3 BCMARS02 Chapter 3 BCMARS03 Chapter 3 BCMARS04 Chapter 3, Chapter 5 BCPDCP01 Chapter 4 BCPDCP04 Chapter 4 BCPDIM02 Chapter 4 BCPDIM03 Appendix D BCPTT01 Chapter 3 BCPTP01 Chapter 3 BCPTR01 Chapter 3 BCMST01 Chapter 3 BCMST04 Chapter 3 BCMSM01 Chapter 3 BCMSM03 Chapter 3

Date of the first release Date and identification of the last version 11 June 2002 11 June 2002

Official web site http://csrc.nist.gov/index.html User group web site http://csrc.nist.gov/publications/CSD_DocsGuide.pdf Relevant web site http://www2.cs.uidaho.edu/~krings/HICSS36/STSSS01.ppt# 256,1,NIST Computer Security Efforts http://csrc.nist.gov/publications/PubsTC.html#Contingency% 20Planning

Availability in European languages English

______________________________________________________________________ ENISA 218

Risk Management

Free Not free Updating fee 9

G.15.2 Scope

Government, Large SME Commercial Non commercial agencies companies companies companies 9 Can be used on a voluntary basis Specific sector Federal organisations who process sensitive information

Used in EU member states Not as well known Used in non-EU countries Widespread in the USA

Management 9 Operational 9 Technical 9

Recognised licensing scheme None Existing certification scheme None

G.15.3 Users Viewpoint

To introduce To use To maintain None None None

Open market Company specific Readily available Yes

Consistent with the requirements for the Office of Management and Budget (OMB) Circular A-130 Appendix III. Complies with statutory responsibilities under the Computer Security Act of 1987 and Information Technology Management Reform Act of 1996. If being implemented outwith Federal organisations, other regulatory requirements (e.g. financial) should be checked

Compliance with NIST 800-34 will assist with compliance with other standards (e.g. PAS 77, ISO 17799).

CD or download available Identification required Trial period Not applicable Not applicable Not applicable

______________________________________________________________________ ENISA 219

Risk Management

It is possible to measure the I.S.S. maturity level Not applicable

Non commercial tools Commercial tools LDRPS BIA Professional eBRP and other available BC Planning tools will support the development of the BCP

Tools can be integrated with other tools No

Method provides interfaces to other IT Service Continuity organisational processes Software Development lifecycle Incident Management Configuration and Release Management Records Management

Method allows use of sector adapted Not applicable databases

______________________________________________________________________ ENISA 220

Risk Management

G.16 Pas 77: 2006 IT Service Continuity Management

G.16.1 Product Identity Card

Method or tool name Vendor / Publisher name Country of origin Pas 77: 2006 IT Service British Standards Institute UK Continuity Management

9

Define BCM Business Design BCM Deliver BCP Test BCP Sustain BCM Framework Impact Approach Programme Analysis 9 9 9 9 9

Coverage of BCM Framework

BCM Framework Included? Comments activities (-, ●..●●●) Initiate BCM - Not included in this standard Programme Identify the ● Under the section on ITSC Strategy the need Organisation to understand the business requirements, agreeing service levels and aligning development of the ITSC Plan with the Corporate Strategy and business goals is emphasized

Assign BCM and ●● The role of the Board and the Executive are Incident stressed in setting business priorities and the responsibilities defining of the impact of loss or failure, in order to determine the key priorities for improving infrastructure resilience. The 3 tier incident management structure is discussed and the need to involve members of the Risk and Business Continuity Teams when constructing, rehearsing and invoking ITSC Plans Define BCM Policy - Not included in this standard

______________________________________________________________________ ENISA 221

Risk Management

Coverage of Business Impact Analysis

Business Impact Included? Comments Analysis processes (-, ●..●●●) Assess Risks and ●●● Section 6 describes the importance of Impacts conducting a business criticality and risk assessment to identify critical activities and the degree to which they are dependent upon IT. The RTOs should also be defined. The key points to consider whilst conducting a vulnerability assessment are introduced and templates for risk assessment are included in Annex A. Section 7 describes how to conduct a criticality assessment of the business processes and then to assign the required IT resource to the critical processes. Annex F gives information about resilience measures which can be adopted. Analyse Results ● The analysis of the results from the risk assessment are discussed and the possible risk responses. Determination of the cost benefit analysis for each risk response should be performed so that decisions can be made as to which responses are adopted. Prioritise recovery ● For the implementation of each response the and define critical RTO and required resources need to be taken resource into consideration. (See Appendix A of the requirements standard)

Coverage of BCM Approach

Design BCM Included? Comments Approach processes (-, ●..●●●) Determine Recovery ●● Dependent upon the risks and impacts, cost Options benefit analysis, RTOs and RPOs the IT model to facilitate ITSC can be chosen. Chapter 11 presents the different options available when buying continuity services from a third party Agree Recovery ●● Annex B, C and D give details about Strategy Architecture consideration, Virtualisation and Site Models Design BCP ● Reference is made to the need to consider how the plan will be distributed and used when working out how to deliver the plan.

______________________________________________________________________ ENISA 222

Risk Management

Coverage of Deliver BCP

Deliver BCP Method Included? Comments processes (-, ●..●●●) Incident Response - Incident Response in the emergency and Plan business continuity context is not discussed in this standard Incident ●● Section 8.4.3 and 8.4.4 describe invocation of Management Plan the IT Service Continuity procedures and the Problem Assessment Business Recovery - As PAS 77 is focused on the procedures for Plan protection and recovery of the IT system, details are not included about recovery of the actual department(s) itself Recovery Support - As PAS 77 is focused on the procedures for Plan protection and recovery of the IT system, details are not included about the procedures other support departments will invoke to assist ICT get back up and running Communications & - Not included Media Plan IT Service Continuity ●●● The focus of PAS 77 is the development of an Plan IT Service Continuity Plan Business - Not included in this standard Resumption Plan

Coverage of Test BCP

Test BCP Method Included? Comments processes (-, ●..●●●) Determine type of ●●● The different types of test are described test together with the roles and responsibilities of the different parties involved Write Test Plan ●●● The contents of the Test Plan are described with a description of the principles to be considered when planning a test Conduct Test ● Under Section 5.5 which discusses the roles and responsibilities “Learning Lessons” describes what should be recorded during a rehearsal or a real invocation Deliver Debrief and ● The need to report on the outcomes of the Test Report rehearsals is mentioned, but not in any depth

______________________________________________________________________ ENISA 223

Risk Management

Coverage of Sustain BCM Programme

Sustain BCM Included? Comments Programme (-, ●..●●●) processes Train Staff - Not discussed in this standard Maintain and Review - Not discussed in this standard BCP Develop Awareness - Not discussed in this standard

Brief description of the product:

PAS 77 introduces IT Service Continuity Management which contains elements of Business Continuity Planning and which if used in conjunction with Business Continuity Planning methods will ensure that an organisation has robust Business and IT Continuity Plans. These plans will make the organisational technically and operationally more resilient and improve its ability to recover not just the business but the supporting IT in line with business requirements.

Controls implemented by using this method Control Reference Location of Reference to Control BCMFRR01 Chapter 5 BCMFO01 Chapter 5 BIA01 Section 6 BIA02 Annex A BIA03 Section 6 BIACRR01 Annex A BIARIM04 Annex F BIARIM06 Annex F BIARIM10 Annex F BIARIM11 Annex F BIARIM12 Section 10 BIARIM13 Section 10 BIACRR01 Appendix A BCMARS01 Annex B, C & D BCMARS02 Chapter 11 BCMARS03 Chapter 11 BCMARS04 Chapter 11 BCPDCP01 Chapter 8 BCPIM02 Chapter 5 BCPTT01 Chapter 9 BCPTP01 Chapter 9 BCPTC01 Chapter 9 BCPTR01 Chapter 9

Date of the first release Date and identification of the last version 11 August 2006 11 August 2006

______________________________________________________________________ ENISA 224

Risk Management

Official web site www.bsi-global.com User group web site Relevant web site http://www.bsiglobal.com/en/Shop/Publication- Detail/?pid=000000000030141858

Availability in European nguages English

Free Not free Updating fee £49

G.16.2 Scope

Government, Large SME Commercial Non commercial agencies companies companies companies 9 9 9 9 9 Specific sector None

Used in EU member states Yes Used in non-EU countries

Management 9 Operational 9 Technical 9

Recognised licensing scheme No Existing certification scheme No

G.16.3 Users Viewpoint

To introduce To use To maintain Background in IT Introductory Background in IT Background in IT training course: http://www.bsiglobal.com/en/Shop/Training-Detail- Pages/Implementing-PAS-77/

Open market Company specific 9

______________________________________________________________________ ENISA 225

Risk Management

Implementation of HB 292, does not confer regulatory compliance. HB 292 should be used in conjunction with the relevant industry regulatory guidelines e.g. relevant financial regulations

PAS 77 is hoped to be re-issued as BS 27999 sometime in 2008. It is not yet known whether certification to BS 27999 could be gained. Implementation of PAS 77 will assist in complying with parts of ISO 27002

CD or download available Identification required Trial period Not applicable

It is possible to measure the I.S.S. Conforming to PAS 77 will assist with the Risk maturity level Management requirements for CMMI.

Non commercial tools Commercial tools RiskMatrix (parts of) Shadow Planner (parts of) envision ERM myCOOP (parts of) Crisis Commander (parts of)

Tools can be integrated with other tools No

Method provides interfaces to other Full Business Continuity Planning organisational processes Change and Release Management Configuration Management

Method allows use of sector adapted Not applicable databases

______________________________________________________________________ ENISA 226

Risk Management

Appendix H: Inventory of Tools

H.1 BCP4me

H.1.1 Identity Card

Tool name Vendor name Country of origin BCP4me CBD-e Ltd UK

World-wide (state World-wide (sector Regional (e.g. Local oriented) oriented) European Directive) United Kingdom Has the development of the tool been No sponsored by a professional or trade association?

BCP4me.com is a web based software capability driven by templates and suggested activities and preventions that a business might need. It is a secure dot net application compatible with all current browsers developed in Europe, initially for the UK market.

What business continuity planning activities does the tool support? Does it provide support for a specific aspect of Business Continuity Planning or is it designed as a “full lifecycle” tool covering the following activities Define BCM Framework Tools which support the definition of scope, Yes objectives and deliverables of the BCM project, identifying the key business areas and gathering key information of risks and tolerances to exposure. Conduct Business Provide support for activities related to Yes Impact Analysis Risk analysis, dependency-modeling techniques, establishing recovery requirements and targets for both critical business enablers (such as information technology systems and infrastructure) and business activities Design BCM Approach Tools that assist with identification, costing No and selection of recovery options. Deliver BCP Tools that assist with organizing, compiling Yes or generating documents that form part of the overall business continuity plan. This may include (but is not limited to): Incident Response Plans; Business Recovery Plans; IT Service Continuity and Recovery Plans; Communications matrices; Templates for incident management activities Test BCP Tools that assist with the preparation of No plan exercises, recording of results, logging and follow-up of remedial activities

______________________________________________________________________ ENISA 227

Risk Management

What business continuity planning activities does the tool support? Does it provide support for a specific aspect of Business Continuity Planning or is it designed as a “full lifecycle” tool covering the following activities Sustain the BCM Tools that support governance of the BCM No programme programme by providing support for assurance and oversight of plan relevance, staff competencies, assurance reviews and matrices related to preparedness and capability Automated Call Out and Tools that automatically send out phone No Notification calls, emails and faxes to call out key personnel and provide the means for recording information back from them.

If tool is designed to support ”Define BCM Framework”

BCM Framework Supported or not Comments activities Initiate BCM No Programme Identify the No organisation Assign BCM and Yes Responsibilities can be assigned to entries Incident on the Action Plans Responsibilities Define BCM Policy Yes Separate Policy documents can be attached

If tool is designed to support “Conduct Business Impact Analysis”

Business Impact Supported or not Comments Analysis processes Assess Risks and Partially Provides Risk Assessment and mitigation Impacts functionality. Analyse results No Prioritise recovery No and define critical resource requirements (including dependency analysis)

If tool is designed to support “Design BCM Approach”

Design BCM Supported or not Comments Approach processes Design Recovery No Strategy

Determine the No Recovery Options Design BCP No

If tool is designed to support “Deliver BCP”

______________________________________________________________________ ENISA 228

Risk Management

Deliver BCP Method Supported or not Comments processes Incident Response Partially Could be assembled as part of the Denial of Plan Access Action Plan. Alternatively it could be attached as a Policy or Procedure Incident Partially Can be assembled as part of the Denial of Management Plan Access of Loss of IT or Communications Action Plans. Alternatively it can be attached as a Policy or Procedure. Business Recovery No Plan Recovery Support No Plans Communications and Partially Could be assembled as part of the Denial of Media Plan Access Action Plan. Alternatively it could be attached as a Policy or Procedure Business Partially Could be assembled as part of the Denial of Resumption Plan Access Action Plan. Alternatively it could be attached as a Policy or Procedure IT Service Continuity Yes There is the capability to assemble an Plan Action Plan for loss of IT and Communications

If tools supports scheduling, performance and follow up of plan exercises

Test BCP Method Supported or not Comments processes Determine type of No Not currently supported test Write Test Plan Partially BCP4me has the capability of launching one of the 3 Action Plans (Denial of Access, Loss of Key Person or Loss of IT and Communications) and tracking progress against each of the actions. This can be carried out as a test or if BC is invoked Conduct Test Partially BCP4me has the capability of launching one of the 3 Action Plans (Denial of Access, Loss of Key Person or Loss of IT and Communications) and tracking progress against each of the actions. This can be carried out as a test or if BC is invoked Deliver Debrief and Partially A Adobe Acrobat file is created which gives Test Report the status of each of the actions (RAG) and shows how long each action took to complete

If tools supports Sustain BCM Programme activities

Sustain BCM Supported or not Comments Programme processes Train Staff No Maintain and Review No BCP Develop Awareness No

______________________________________________________________________ ENISA 229

Risk Management

Other functionality: Name Description Ease of Use BCP4me simple to understand and easy to use. This ensures a good uptake of the system

Control Reference Comments BCMFRR01 Contact details for different groups of people available BIA01 Risk Assessment module to identify probability and impact scores BCPDIM02 Part of Action Plans BCPDIM03 Part of Action Plans BCPTP02 Can run through the Action Plans as a Test BCPTC02 Can run through the Action Plans as a Test BCPTR02 A report can be produced showing the results and times taken to complete actions

Date of first release Date and identification of the last version 2008 2008

Official web site www.bcp4me.com User group web site (optional) Relevant web site: www.CBD-e.com

Languages available English

Free Not free Maintenance fees £199 - £49 dependent upon Included in subscription number of users Sectors with free availability or discounted price None

CD or download available Identification required Trial period(days)

Technical component Purpose Comment Database Model and information Hosted By CBP-e Ltd storage Web server Model and information Hosted By CBP-e Ltd Access Application Server Model and information Hosted By CBP-e Ltd review Client Model and information Deployed to client from our maintenance hosted environment

______________________________________________________________________ ENISA 230

Risk Management

H.1.2 Scope

Government, International SME Commercial Non commercial agencies organisations organisations organisations Yes Specific sector :

General information Used inside EU countries UK Used outside EU countries

Standard Compliance notice Comment BS 25999-1:2006 Risk Assessment Probability and impact HB 292:2006 scores, preventative HB221:2004 measures TR19:2005 BCI GPG:2008 BS 25999-1:2006 Business Continuity Plans Action Plans for loss of HB 292:2006 premises, key staff and ICT. HB221:2004 TR19:2005 BCI GPG:2008

Certification according to standard Comments BS 25999-1 Partial compliance only *relates to “BCM Lifecycle” tools only

Course Duration Skills Expenses Online explanatory notes N/A N/A N/A available, plus an online help facility

______________________________________________________________________ ENISA 231

Risk Management

H.1.3 Users Viewpoint

Skills Comments To install None – web based product which is easy to use To use None – web based product which is easy to use To maintain None – web based product which is easy to use

Support method Comment Online Support No Email Support Yes Dedicated Account Manager Yes

Database Name Contents No

Database Name Comments Hosted web based solution. Not applicable.

______________________________________________________________________ ENISA 232

Risk Management

H.2 Crisis Commander

H.2.1 Identity Card

Tool name Vendor name Country of origin Crisis Commander Svensk Krisledning AB Sweden

World-wide (state World-wide (sector Regional (e.g. Local oriented) oriented) European Directive) Yes Has the development of the tool been No sponsored by a professional or trade association?

Crisis Commander is an Incident Management Program which can be used during an incident or crisis to monitor and control the logs, plans and decisions that are made. It can initiate the incident and notify the Incident Management team members and other required personnel via telephone e-mail, and mobile phone. The software can also be used outwith an incident as a general notification tool or as a training aid to submit and control documents. Meeting logs can also be kept for BC meetings and training.

What business continuity planning activities does the tool support? Does it provide support for a specific aspect of Business Continuity Planning or is it designed as a “full lifecycle” tool covering the following activities Define BCM Framework Tools which support the definition of scope, Yes objectives and deliverables of the BCM project, identifying the key business areas and gathering key information of risks and tolerances to exposure. Conduct Business Provide support for activities related to Yes Impact Analysis Risk analysis, dependency-modeling techniques, establishing recovery requirements and targets for both critical business enablers (such as information technology systems and infrastructure) and business activities Design BCM Approach Tools that assist with identification, costing No and selection of recovery options. Deliver BCP Tools that assist with organizing, compiling Yes or generating documents that form part of the overall business continuity plan. This may include (but is not limited to): Incident Response Plans; Business Recovery Plans; IT Service Continuity and Recovery Plans; Communications matrices; Templates for incident management activities Test BCP Tools that assist with the preparation of Yes plan exercises, recording of results, logging

______________________________________________________________________ ENISA 233

Risk Management

What business continuity planning activities does the tool support? Does it provide support for a specific aspect of Business Continuity Planning or is it designed as a “full lifecycle” tool covering the following activities and follow-up of remedial activities Sustain the BCM Tools that support governance of the BCM Yes programme programme by providing support for assurance and oversight of plan relevance, staff competencies, assurance reviews and matrics related to prepareness and capability Automated Call Out and Tools that automatically send out phone Yes Notification calls, emails and faxes to call out key personnel and provide the means for recording information back from them.

If tool is designed to support ”Define BCM Framework”

BCM Framework Supported or not Comments activities Initiate BCM No Programme Identify the No organisation Assign BCM and Yes Any team can be created as long as the Incident personnel profiles are contained within the Responsibilities database Define BCM Policy No

If tool is designed to support “Conduct Business Impact Analysis”

Business Impact Supported or not Comments Analysis processes Assess Risks and Partially Any document can be attached so Impacts theoretically any risk document can be attached to the system Analyse results No Prioritise recovery Partially It does not analyse and prioritise BIA data, and define critical but once an Incident resource Management/Response Plan is invoked requirements resource requirements can be defined and (including prioritised dependency analysis)

If tool is designed to support “Design BCM Approach”

Design BCM Supported or not Comments Approach processes Determine the No Recovery Options Design Recovery No Strategy Design BCP No

______________________________________________________________________ ENISA 234

Risk Management

If tool is designed to support “Deliver BCP”

Deliver BCP Method Supported or not Comments processes Incident Response Partially Any document can be attached to the Plan continuity invocation section so any or all of these plans can be delivered via the software. Crisis Commander also comes loaded with a range of templates Incident Yes Any document can be attached to the Management Plan continuity invocation section so any or all of these plans can be delivered via the software. Crisis Commander’s strength is its call out facility and incident management and monitoring functionality Business Recovery Partially Any document can be attached to the Plan continuity invocation section so any or all of these plans can be delivered via the software Recovery Support Partially Any document can be attached to the Plans continuity invocation section so any or all of these plans can be delivered via the software Communications and Partially Any document can be attached to the Media Plan continuity invocation section so any or all of these plans can be delivered via the software Business Partially Any document can be attached to the Resumption Plan continuity invocation section so any or all of these plans can be delivered via the software IT Service Continuity Partially Any document can be attached to the Plan continuity invocation section so any or all of these plans can be delivered via the software

If tools supports scheduling, performance and follow up of plan exercises

Test BCP Method Supported or not Comments processes Determine type of Partially As an incident management tool, Crisis test Commander can set an IM exercise and the parameters can be defined Write Test Plan No Conduct Test Yes By its nature Crisis Commander can run a mock incident as well as a real incident Deliver Debrief and Partially Log files and documents can be extracted to Test Report allow them to be added to any report

If tools supports Sustain BCM Programme activities

Sustain BCM Supported or not Comments Programme processes Train Staff Partially Any type of management plan can be create in Crisis Commander Maintain and Review Yes A maintenance schedule can be created BCP within Crisis Commander. All scheduled

______________________________________________________________________ ENISA 235

Risk Management

update reminders are automatically emailed to the designated individual weekly until the files have been updated. The system also escalates reminders automatically to a designated admin if files are not updated within 3 weeks of the first reminder. Develop Awareness No

Other functionality:

Name Description Mission Control Centre Mission Control Centre for handling of crises across large organisations. The Mission Control Centre (MCC), along with a multisystem Crisis Commander configuration, allows large organisations to manage and coordinate crisis response to multiple crises simultaneously. The MCC provides a “Dashboard” to give upper level management an overview of all incidents at once, and allows admin users to check status or login to any system in the configuration. Built in emergency web page Each Crisis Commander system comes with a built-in crisis home page outside the client´s IT-environment, enabling the CMT to inform and update staff and the public. These crisis home pages are typically used as a communications tool during an incident and require minimal computer literacy to update. Advance Emergency Notification System Crisis Commander Alert is an add-on module intended for the emergency notification of all CMT personnel, other Emergency Response and Recovery teams, employees, vendors and any other contact list. CC Alert distributes voice messages to any land line or mobile phone in the world. SMS messages, E-mail and fax messages are supplementary alert modes. SMS and E-mail are the Basic notification modes included in all Crisis Commander systems.

Bulletin Board for the IMT The Crisis Commander Forum is typically used as an IMT bulletin board. The Forum is also use to co-ordinate activities during large incidents and training exercises Built in system for distributing plans within The Mission Control Centre module enables a group BCPs, documents, contact lists and meeting agendas to be shared and sent between all systems within a group Support Document Templates • Damage and accident reports

• Instructions for switchboard personnel and security guards

• Primary and secondary Emergency Operations Centre equipment and locations

• Crisis poster for the Emergency

______________________________________________________________________ ENISA 236

Risk Management Name Description Operations Centre • Alarm routines • Mobilization routines • Credit card sized templates for alarm and mobilization instructions • Work descriptions for the Crisis Management Team • Insurance information • Press release • Alternative invoicing and salary methods • Anti virus resources • Backup and restore routines • Offsite storage and IT security archiving • How to inform next of kin and staff • Psychosocial first aid • Crisis support • Definitions of the content and storage location for an emergency box • Instructions and advice on handling the media during a crisis • Crisis Definitions Continuity Plan Templates (examples) • Pandemic Outbreak • Serious Accident • Mobilisation • IT Disaster (internal and external hot site) • Loss of premises • Media Crisis • Virus Outbreak

______________________________________________________________________ ENISA 237

Risk Management

Controls implemented by using this method Control Reference Location of Reference to Control BCMFRR01 Can input contact details for various groups of people BCMARS02 A template is provided for IT recovery at internal or external hot sites BCMARS03 A template is provided for IT recovery at internal or external hot sites BCMARS04 A template is provided for IT recovery at internal or external hot sites BCPDCP01 A template is provided for IT recovery at internal or external hot sites BCPDCP02 Supported through Crisis Commander support document templates BCPDCP03 Can be supported through the development of action plans with appointed owners. Alternatively separate plans can be appended. BCPDIM01 An Incident Response Plan could be appended and action plans and owners built within the system with automatic notification to the responsible person(s). A loss of premises template is provided BCPDIM02 An Incident Management Plan can be appended and action plans and owners can be built within the system with automatic notification to the responsible person(s). A loss of premises template is provided BCPDIM03 Crisis Commander is a communication tool for use by anyone involved in managing an incident. BCPDIM04 Action logs and times are recorded against the tasks in the incident action plan BCPDIM05 The action logs can be reported upon BCPTC02 The whole incident management process can be run through as a test BCPTR02 Via the action logs a report of the test can be generated BCMST03 Can set up the system to train personnel via action plans, notifications, BCMSM01 An update schedule can be added to all plans, contact lists, documents and other items. Automatic notifications are sent out BCMSM02 Can check the progress of plan maintenance through the automatic notification system

Date of first release Date and identification of the last version 2004 2008

Official web site www.crisiscommander.com User group web site (optional) Relevant web site: www.crisiscommander.com

Languages available English, Swedish, Norwegian, Danish and German

______________________________________________________________________ ENISA 238

Risk Management

Free Not free Maintenance fees Variable subscription model Part of subscription fee Sectors with free availability or discounted price Pricing based on platform services, user accounts and sector.

CD or download available Identification required Trial period(days) http://www.crisiscommande User name and password 48 hours (must complete r.com/ Hosting and required for extended demo the guided online live demo Security – Download and page first) Demo Room

Technical component Purpose Comment Database Model and information Hosted By Crisis storage Commander Web server Model and information Hosted By Crisis Access Commander Application Server Model and information Hosted By Crisis review Commander Client Model and information Deployed to client from our maintenance hosted environment

______________________________________________________________________ ENISA 239

Risk Management

H.2.2 Scope

Government, International SME Commercial Non commercial agencies organisations organisations organisations Yes Yes Yes Yes Yes Specific sector : Cross sector

General information World wide Used inside EU countries UK, Scandinavia, Germany, Austria, Switzerland, Denmark Used outside EU countries USA, Saudi Arabia

Standard Compliance notice Comment BS25999-1 Partial compliance Will assist in achieving the requirements for communicating in a crisis, setting up teams and implementation of a management system HB 292 Partial compliance Will assist in achieving the requirements for communicating in a crisis, setting up teams and implementation of a management system

Certification according to standard Comments Not applicable *relates to “BCM Lifecycle” tools only

Course Duration Skills Expenses Online Variable Web Access Part of Subscription

______________________________________________________________________ ENISA 240

Risk Management

H.2.3 Users Viewpoint

Skills Comments To install None – web based product, hosted by the supplier To use None – web based product, hosted by the supplier To maintain None – web based product, hosted by the supplier

Support method Comment Online Support Email Support Dedicated Account Manager

Database Name Contents No

Database Name Comments Hosted Solution. Not applicable.

______________________________________________________________________ ENISA 241

Risk Management

H.3 envisionERM

H.3.1 Identity Card

Tool name Vendor name Country of origin envisionERM SDPL Partnership UK

World-wide (state World-wide (sector Regional (e.g. Local oriented) oriented) European Directive) Yes Yes Yes Yes Has the development of the tool been No sponsored by a professional or trade association?

enVisionERM is an integrated Business Continuity and Risk Management solution that provides risk identification, definition of risk management approaches and risk governance and assurance capabilities . It supports the definition of different types of business risk (availability, fraud, errors and omissions, regulatory compliance failures) and the development of risk management processes. Full support for the BCMS lifecycle is provided including: • Risk assessment

• Impact Analysis

• Identification of Critical Resource Requirements (critical dependencies)

• Specify preventative controls for maintaining critical resource availability

• Gap Analysis of recovery capabilities vs. business requirements

• Development of recovery strategies

• Plan testing and tracking of follow up issues

• Continuous monitoring of organizational “preparedness and capability”

What business continuity planning activities does the tool support? Does it provide support for a specific aspect of Business Continuity Planning or is it designed as a “full lifecycle” tool covering the following activities Define BCM Framework Tools which support the enVisionERM allows the BCM definition of scope, programme to be defined by objectives and deliverables providing a comprehensive of the BCM project, approach to defining the identifying the key business risk sources, exposure areas and gathering key thresholds and structuring information of risks and risk evaluations by, tolerances to exposure. organisation hierarchy, business activity or product

______________________________________________________________________ ENISA 242

Risk Management

What business continuity planning activities does the tool support? Does it provide support for a specific aspect of Business Continuity Planning or is it designed as a “full lifecycle” tool covering the following activities Conduct Business Impact Provide support for Critical Resource Analysis activities related to Risk Requirements (CRR) analysis, dependency- (dependencies) can be modelling techniques, mapped to business establishing recovery activities and products. requirements and targets CRRs can be user defined for both Critical Resource and can include IT systems, Requirements (such as equipment or any other information technology category of critical resource systems and infrastructure) required. and business activities Design BCM Approach Tools that assist with enVisionERM supports the identification, costing and selection of risk selection of recovery Management treatments options. including Mitigate, Accept, Transfer and Contingency Arrangements Deliver BCP Tools that assist with enVisionBCM supports the organizing, compiling or generation of any type of generating documents that supporting plans and form part of the overall provides templates for business continuity plan. many. This may include (but is not limited to): Incident Response Plans; Business Recovery Plans; IT Service Continuity and Recovery Plans; Communications matrices; Templates for incident management activities Test BCP Tools that assist with the enVisionERM provides preparation of plan support for defining, exercises, recording of arranging and scheduling results, logging and follow- plan exercises. Follow up up of remedial activities actions can be logged and update / progress are produced automatically Sustain the BCM Tools that support enVisionERM provides the programme governance of the BCM facility to monitor programme by providing performance of plan support for assurance and reviews, performance of oversight of plan relevance, tests, clearance of action staff competencies, items and define and assurance reviews and monitor competencies and matrices related to training for BCM roles. preparedness and capability

______________________________________________________________________ ENISA 243

Risk Management

What business continuity planning activities does the tool support? Does it provide support for a specific aspect of Business Continuity Planning or is it designed as a “full lifecycle” tool covering the following activities Automated Call Out and Tools that automatically enVisionBCM is not a Notification send out phone calls, emails notification solution. Basic and faxes to call SMS alerting is supported. out key personnel and provide the means for recording information back from them.

If tool is designed to support ”Define BCM Framework”

BCM Framework Supported or not Comments activities Initiate BCM Yes enVisionERM allows the BCM programme to Programme be defined by providing a comprehensive risk identification approach. Identify the Yes The organisation, business activities, organisation services and products can be defined Assign BCM Yes BCM roles, responsibilities and competency Responsibilities requirements can be established Define BCM Policy Yes The organisations’ assurance and oversight policy can be reflected in the system’s parameters. Template documents also provide a BCM policy template Assign Incident Yes Any number of teams, each with different Teams roles can be assigned. Individuals may belong to multiple teams

If tool is designed to support “Conduct Business Impact Analysis”

Business Impact Supported or not Comments Analysis processes Assess Risks and Yes Key areas, products and services can be Impacts identified Analyse Results Yes Identify recovery priorities and potential gaps between recovery requirements and current capabilities. Prioritise recovery Yes Critical Resource Requirements can be and define critical defined and categorised according to user resource preference (IT Systems, equipment, requirements materials etc.). Additional categories can be (including identify added as required. Critical Resource and evaluate Requirements can be mapped to business dependencies) activities or products.

______________________________________________________________________ ENISA 244

Risk Management

If tool is designed to support “Design BCM Approach”

Design BCM Supported or not Comments Approach processes Determine the Yes Recovery Options Design Recovery Yes enVisionERM supports the creation and Strategy documentation of preventative (resilience) measures in addition to recovery procedures. Design the BCP Yes

If tool is designed to support “Deliver BCP”

Deliver BCP Method Supported or not Comments processes Incident Response Yes Multiple types of plan can be created. Each Plan plan can have a number of sections which can be built up using pre-defined templates within the system Incident Yes Multiple types of plan can be created. Each Management Plan plan can have a number of sections which can be built up using pre-defined templates within the system Business Recovery Yes Multiple types of plan can be created. Each Plan plan can have a number of sections which can be built up using pre-defined templates within the system Recovery Support Yes See above as many plans as required can Plan be created using predefined, user editable templates if required. Communications & Yes Multiple types of plan can be created. Each Media Plan plan can have a number of sections which can be built up using pre-defined templates within the system IT Service Continuity Yes Risks and related preventative / resilience Plan measures can be documented and referenced Business Yes Multiple types of plan can be created. Each Resumption Plan plan can have a number of sections which can be built up using pre-defined templates within the system

If tools supports scheduling, performance and follow up of plan exercises

Test BCP Method Supported or not Comments processes Determine type of Yes System allows different testing levels to be test specified when creating a “Test Design” Write Test Plan Yes Yes – test plan can be built up section-bysection Conduct Test Yes Yes, log actual results/outcome against desired outcome in “Test Design” Deliver Debrief and Yes Yes. Also log, track and resolve follow up Test Report actions

______________________________________________________________________ ENISA 245

Risk Management

If tools supports sustain BCM Programme activities

Sustain BCM Supported or not Comments Programme processes Train Staff No Training module allows training needs, based on role to be defined. Maintain and Review Yes Status of all plans is constantly monitored BCP and reported on Develop Awareness Yes BCM “Culture” e-audit is a scheduled enhancement due for release in 2008

Other functionality:

Name Description

______________________________________________________________________ ENISA 246

Risk Management

Controls implemented by using this tool Control Reference Comment BCMFI03 Some support – gap analysis for critical dependencies BCMFO01 Yes BCMFRR01 Yes BCMFP01 Yes BIA01 Yes BIA02 Yes BIA03 Yes BIACRR01 Yes BIACRR02 Yes BCMARS01 Yes BCMARS02 Yes BCMARS03 Yes BCMARS04 Yes BCMARS05 Yes BCPDCP01 Yes BCPDCP02 Yes BCPDCP03 Yes BCPDCP04 Yes BCPDIM01 Yes BCPDIM02 Yes BCPDIM03 Yes BCPDIM04 Yes BCPTT01 Yes BCPTT02 Yes BCPTP01 Yes BCPTP02 Yes BCPTC01 Yes BCPTC02 Yes BCPTR01 Yes BCPTR02 Yes BCMST01 Yes BCMST02 Yes BCMST03 Yes BCMST04 Yes BCMSM01 Yes BCMSM02 Yes BCMSM03 Yes BCMSA01 Yes

Date of first release Date and identification of the last version 2006 April 2008

______________________________________________________________________ ENISA 247

Risk Management

Official web site www.sdplsolutions.com User group web site (optional) Relevant web site: www.glenabbot.co.uk

Languages available English

Free Not Free Maintenance Fees Price on application Sectors with free availability of discounted prices None

CD or download available Identification required Trial period(days) Web based pilots available Normally 30

Technical component Purpose Comment Database IBM Domino Web server IBM Domino Application Server IBM Domino Client N/A – Browser based

______________________________________________________________________ ENISA 248

Risk Management

H.3.2 Scope

Government, International SME Commercial Non commercial agencies organisations organisations organisations Yes Yes Yes Yes Yes Specific sector : All Sectors

General information World-wide in many different organisations Used inside EU countries Yes Used outside EU countries Yes

Standard Compliance notice Comment BS 25999 HB 292 HB 221 TR 19

Certification according to standard Comments BS 25999-2 enVisionERM can assist with certification to BS 25999-2 by providing a management system which manages documents, tracks changes, holds maintenance and test schedules and provides reminders about review cycles *relates to “BCM Lifecycle” tools only

Course Duration Skills Expenses Provided as part of implementation services

______________________________________________________________________ ENISA 249

Risk Management

H.3.3 Users Viewpoint

Skills Comments To install Basic IT user skills To use Basic IT user skills To maintain Basic IT user skills

Support method Comment e-mail / telephone

Database Name Contents No

Database Name Comments IBM Lotus Notes or any ODBC compliance database

______________________________________________________________________ ENISA 250

Risk Management

H.4 ImpactAware

H.4.1 Identity Card

Tool name Vendor name Country of origin ImpactAware Texonet Ltd Scotland

World-wide (state World-wide (sector Regional (e.g. Local oriented) oriented) European Directive) United Kingdom Has the development of the tool been No sponsored by a professional or trade association?

ImpactAware has been designed to allow business continuity planning to be devolved to non-practitioners and to allow any organisation to quickly and easily compile a robust Business Continuity Plan in line with best practice.

What business continuity planning activities does the tool support? Does it provide support for a specific aspect of Business Continuity Planning or is it designed as a “full lifecycle” tool covering the following activities Define BCM Framework Tools which support the definition of scope, Yes objectives and deliverables of the BCM project, identifying the key business areas and gathering key information of risks and tolerances to exposure. Conduct Business Provide support for activities related to Yes Impact Analysis Risk analysis, dependency-modeling techniques, establishing recovery requirements and targets for both critical business enablers (such as information technology systems and infrastructure) and business activities Design BCM Approach Tools that assist with identification, costing No and selection of recovery options. Deliver BCP Tools that assist with organizing, compiling Yes or generating documents that form part of the overall business continuity plan. This may include (but is not limited to): Incident Response Plans; Business Recovery Plans; IT Service Continuity and Recovery Plans; Communications matrices; Templates for incident management activities Test BCP Tools that assist with the preparation of No plan exercises, recording of results, logging and follow-up of remedial activities Sustain the BCM Tools that support governance of the BCM No programme programme by providing support for

______________________________________________________________________ ENISA 251

Risk Management

What business continuity planning activities does the tool support? Does it provide support for a specific aspect of Business Continuity Planning or is it designed as a “full lifecycle” tool covering the following activities assurance and oversight of plan relevance, staff competencies, assurance reviews and matrics related to prepareness and capability Automated Call Out and Tools that automatically send out phone No Notification calls, emails and faxes to call out key personnel and provide the means for recording information back from them.

If tool is designed to support ”Define BCM Framework”

BCM Framework Supported or not Comments activities Initiate BCM No Programme Identify the Yes The end user can quickly build up a organisation dependency model of their organization and its core activities. Assign BCM and Yes Responsibilities for key areas within the Incident business can be assigned to individuals as Responsibilities well as deputies. There are also areas that can allow more context sensitive responsibilities, such as building managers. Define BCM Policy Yes Due to the differences in organizational approaches to policy definition we are not prescriptive, but do allow organizations to attach their own policy documents.

If tool is designed to support “Conduct Business Impact Analysis”

Business Impact Supported or not Comments Analysis processes Assess Risks and Yes Provides instant Impact assessments Impacts Analyse results Yes Impact Assessment derived from Dependency Model Prioritise recovery Yes Derived from internal Dependency Model and define critical resource requirements (including dependency analysis)

______________________________________________________________________ ENISA 252

Risk Management

If tool is designed to support “Design BCM Approach”

Design BCM Supported or not Comments Approach processes Design Recovery Yes Derived from Dependency Model Strategy

Determine the Yes Derived from Dependency Model recovery options Design BCP

If tool is designed to support “Deliver BCP”

Deliver BCP Method Supported or not Comments processes Incident Response Partially Can be attached to specific organizational Plan units or resources and managed within the review process. These can be automatically linked into other plans. Incident Partially Can be attached to specific organizational Management Plan units or resources and managed within the review process. These can be automatically linked into other plans. Business Recovery Yes Generates 3 specific types of plan based on Plan either Location, Organisation or Activity. These are automatically maintained by the platform. Recovery Support Partially Can be attached to specific organizational Plans units or resources and managed within the review process. These can be automatically linked into other plans. Communications and Partially Can be attached to specific organizational Media Plan units or resources and managed within the review process. These can be automatically linked into other plans. Business Partially Can be attached to specific organizational Resumption Plan units or resources and managed within the review process. These can be automatically linked into other plans. IT Service Continuity Partially Can be attached to specific organizational Plan units or resources and managed within the review process. These can be automatically linked into other plans.

If tools supports scheduling, performance and follow up of plan exercises

Test BCP Method Supported or not Comments processes Determine type of No Not currently supported test Write Test Plan No Not Currently supported Conduct Test No Not Currently supported Deliver Debrief and No Not Currently supported Test Report

______________________________________________________________________ ENISA 253

Risk Management

If tools supports Sustain BCM Programme activities

Sustain BCM Supported or not Comments Programme processes Train Staff Yes Online resources including text, audio and video. Maintain and Review Yes Built in review notification and status. BCP Develop Awareness Yes Online community, to be announced October 2008

Other functionality:

Name Description Dependency Modelling Dependency modelling is a technique that allows you to relate one business asset to another. From this we can automate a significant portion of plan production. Dashboard Dashboard providing instant cues on next actions and areas that require investigation. Online Battlebox We hold your critical business continuity information online within our own resilient production environment. This can be accessed from anywhere in the world. All you need is a PC or laptop and an internet connection. Ease of Use One of the key requirements for our software service is that it should be simple to understand and easy to use. This helps make the time commitment from practitioners as small as possible. Deployment and Update Our solution has been developed as a lean client that installs in less than 60 seconds. We regularly update our offering with new features for our subscription clients. Reporting Access reporting directly through built in reports (PDF, Word, HTML) or customize using Crystal or Microsoft Excel. Document Attachment Files may be attached to the system and any file relating to a particular stage or task can be appended in the relevant place e.g. evacuation plans, HR procedures, press releases.

Controls implemented by using this tool Control Reference Location of Reference to Control BCMFO01 Yes. Structures can be compiled BCMFO02 Partially. If the tool is kept up to date it should be aligned with organisational strategy BCMFRR01 Yes. These are all defined within the contacts BCMFP01 Yes BIA03 Yes. The data on RTOs, resource requirements and activities can be collected, stored and analysed

______________________________________________________________________ ENISA 254

Risk Management

Control Reference Location of Reference to Control BIACRR01 Yes. The data is held on a database and can be analysed and collated to suit requirements BIACRR02 Yes. The critical activities can be defined and organised in order of priority BCMARS01 Yes BCPDCP01 Yes. The critical activities can be mapped onto the technological resource requirements and dependencies. BCPDCP02 Yes BCPDCP03 Yes BCPDIM02 The system can populate a template with the resource requirements and prioritised critical activities. The other information regarding invocation and incident management would need to be added BCMSM01 Yes

Date of first release Date and identification of the last version th th 5 April 2007 8 July 2008

Official web site www.impactaware.com User group web site To be announced October 2008 (optional) Relevant web site:

Languages available English

Free Not free Maintenance fees Variable subscription model Part of subscription fee Sectors with free availability or discounted price Pricing based on platform services, user accounts and sector.

CD or download available Identification required Trial period(days) Download available Yes, organisation name and 30 user name and email address

Technical component Purpose Comment Database Model and information Hosted By Texonet storage Web server Model and information Hosted By Texonet Access Application Server Model and information Hosted By Texonet review Client Model and information Deployed to client from our maintenance hosted environment

______________________________________________________________________ ENISA 255

Risk Management

H.4.2 Scope

Government, International SME Commercial Non commercial agencies organisations organisations organisations Yes Yes No Yes Yes Specific sector : None – relevant to all

General information Used inside EU UK countries Used outside EU countries

Standard Compliance notice Comment BS 25999-1 Partial Assists with data capture for impact analysis and resource requirements. Analyses data and populates reports HB 292 Partial Assists with data capture for impact analysis and resource requirements. Analyses data and populates reports

Certification according to standard Comments No *relates to “BCM Lifecycle” tools only

Course Duration Skills Expenses Online Variable Web Access Part of Subscription

H.4.3 Users Viewpoint

Skills Comments To install Hosted service, install requires web browser and/or Java 5 on client. Install of client application from web page. To use Requires minimal online training To maintain Requires minimal online training

Support method Comment Online Support Online tutorials, Frequently Asked Questions, Video Guides, Troubleshooting Guides Email Support Email access to Support Team Dedicated Account Manager Direct phone access to dedicated account manager

______________________________________________________________________ ENISA 256

Risk Management

Database Name Contents No

Database Name Comments Hosted Solution. Not applicable.

______________________________________________________________________ ENISA 257

Risk Management

H.5 LDRPS (Living Disaster Recovery Planning System)

H.5.1 Identity Card

Tool name Vendor name Country of origin LDRPS (Living Disaster Strohl Systems USA Recovery Planning System)

World-wide (state World-wide (sector Regional (e.g. Local oriented) oriented) European Directive) Yes Has the development of the tool been No sponsored by a professional or trade association?

Provides a detailed picture of financial and operational vulnerabilities, impacts, and recovery strategies. It enables companies to develop strategies to minimize their exposure to risk and possible interruptions. NotiFind enables users contact key personnel in a time of crisis, deliver critical messages, and receive important updates as they occur

What business continuity planning activities does the tool support? Does it provide support for a specific aspect of Business Continuity Planning or is it designed as a “full lifecycle” tool covering the following activities Define BCM Framework Tools which support the definition of scope, Supported objectives and deliverables of the BCM project, identifying the key business areas and gathering key information of risks and tolerances to exposure. Conduct Business Provide support for activities related to Supported (BIA Impact Analysis Risk analysis, dependency-modeling Professional techniques, establishing recovery module required) requirements and targets for both critical business enablers (such as information technology systems and infrastructure) and business activities Design BCM Approach Tools that assist with identification, costing Supported and selection of recovery options. Deliver BCP Tools that assist with organizing, compiling Supported or generating documents that form part of the overall business continuity plan. This may include (but is not limited to): Incident Response Plans; Business Recovery Plans; IT Service Continuity and Recovery Plans; Communications matrices; Templates for incident management activities Test BCP Tools that assist with the preparation of Supported plan exercises, recording of results, logging

______________________________________________________________________ ENISA 258

Risk Management

What business continuity planning activities does the tool support? Does it provide support for a specific aspect of Business Continuity Planning or is it designed as a “full lifecycle” tool covering the following activities and follow-up of remedial activities Sustain the BCM Tools that support governance of the BCM Supported programme programme by providing support for assurance and oversight of plan relevance, staff competencies, assurance reviews and matrices related to preparedness and capability Automated Call Out and Tools that automatically send out phone Supported Notification calls, emails and faxes to call (Notifind module out key personnel and provide the means required) for recording information back from them.

If tool is designed to support ”Define BCM Framework”

BCM Framework Supported or not Comments activities Initiate BCM Yes Programme Identify the Yes organisation Assign BCM Yes Responsibilities Define BCM Policy Yes Assign Incident Yes Teams

If tool is designed to support “Conduct Business Impact Analysis”

Business Impact Supported or not Comments Analysis processes Assess Risks and Yes Impacts Identify and Yes Evaluate Dependencies Analyse Results Yes Prioritise Recovery Yes and define critical resource requirements

If tool is designed to support “Design BCM Approach”

Design BCM Supported or not Comments Approach processes Design Recovery Yes Strategy

Determine recovery Yes priorities and timeline

______________________________________________________________________ ENISA 259

Risk Management

If tool is designed to support “Deliver BCP”

Deliver BCP Method Supported or not Comments processes Incident Response Yes Plan Incident Yes Management Plan Business Recovery Yes Plan Recovery Support Yes Plans Communications and Yes Media Plan Business Yes Resumption Plan IT Service Continuity Yes Plan

If tools supports scheduling, performance and follow up of plan exercises

Test BCP Method Supported or not Comments processes Determine type of Yes test Write test plan Yes Conduct Test Yes Deliver Debrief and Yes Test Report

If tools supports sustain BCM Programme activities

Sustain BCM Supported or not Comments Programme processes Train Staff No Maintain and Review Yes BCP Develop Awareness No

Other functionality:

Name Description Notifind Emergency notification system which uses different means of communication to contact employees, suppliers or other critical personnel BIA Professional Conducts Business Impact Analysis surveys Incident Manager Online command centre which enables organisations to respond to an incident without everyone needing to be in the same room.

______________________________________________________________________ ENISA 260

Risk Management

Controls implemented by using this method Control Reference Comments BCMFI03 Plan Assistant tracks how far along the users are with building their plans. Information can be extracted into most commonly used project management tools BCMFO01 All levels of the (global) organisational structure can be defined BCMFRR01 Identified through the call lists. BCMFP01 Part of the building plans stage – allows policies and procedures to be written which can be included in the plans. Sample policies and procedures are within the system BIA03 Conducted via the BIA Professional tool, or the inbuilt BIA Lite. Data is available to use within the plans BIACRR01 The dependency modelling tool assists with assessing critical requirements and displays results on a dependency map BIACRR02 Via the reporting function BCMARS01 Strategy templates are provided within the system BCPDCP01 The Plan Navigator can assist with ITSC planning, through the Application Recovery module BCPDCP02 The Plan Navigator can assist with Recovery Support Planning through the Business Process Recovery module. Site Event Management would assist with site related activities BCPDCP03 The Plan Navigator can assist with Recovery Support Planning through the Business Process Recovery module. BCPDCP04 Can establish a Business Restoration phase BCPDIM01 The Plan Navigator can assist with Incident Response planning via the Corporate Crisis Management module BCPDIM02 The Plan Navigator can assist with Incident Management planning via the Corporate Crisis Management module BCPDIM03 Notifind contacts employees, suppliers or other critical personnel BCPTC02 Can test plans using the Incident Manager module BCMSM01 Available via Plan Approval and LDRPS scheduling

Date of first release Date and identification of the last version 1983 LDRPS 10 2008

Official web site www.strohlsystems.com User group web site (optional) There are world wide regional user groups http://www.strohlsystems.com/Events/RUG s/default.asp. Relevant web site:

Languages available English

Free Not free Maintenance fees Price on application Sectors with free availability or discounted price

______________________________________________________________________ ENISA 261

Risk Management

CD or download available Identification required Trial period(days) Yes Not supplied

Technical component Purpose Comment Database SQL Server/Oracle Web server ? Application Server ? Client Browser based

H.5.2 Scope

Government, International SME Commercial Non commercial agencies organisations organisations organisations Yes Yes Yes Yes Yes Specific sector : All Sectors

General information World wide in many organisations Used inside EU countries Yes Used outside EU countries Yes

Standard Compliance notice Comment BS 25999-1 Using LDRPS won’t provide full compliance with BS 25999-1, but it will achieve a high percentage

Certification according to standard Comments BS25999-2 Using LDRPS will provide help towards certification to BS 25999-2, but not all requirements will be covered. When setting up the tool it would be important to check the requirements of BS 25999-2 first and configure the system to meet the requirements *relates to “BCM Lifecycle” tools only

______________________________________________________________________ ENISA 262

Risk Management

Course Duration Skills Expenses Online training One hour course. None None http://www.recoverychronicles.com/MediaPR Offer is for a /eNewsletter/March2008/600/Article.asp?ID limited duration =74&ArticleID=600&FromNews=true (as at Aug 2008) training Customised on line training or on customer As per None POA site requirements Education seminars Dependent upon None POA seminar Trade shows, regional and international Dependent upon None POA events and webinars all available to LDRPS event users http://www.strohlsystems.com/Events/Inter nationalEvents/default.asp

H.5.3 Users Viewpoint

Skills Comments To install Basic IT user skills To use Basic IT user skills To maintain Basic IT user skills

Support method Comment Online help 24x7 Customer Support

Database Name Contents No

______________________________________________________________________ ENISA 263

Risk Management

Database Name Comments ODBC compliant databases

______________________________________________________________________ ENISA 264

Risk Management

HH..66 my COOP™

H.6.1 Identity Card

Tool name Vendor name Country of origin my COOP™ COOP Systems, Inc. U.S.

World-wide (state World-wide (sector Regional (e.g. Local oriented) oriented) European Directive) Yes Has the development of the tool been Design in line with BCI and DRII sponsored by a professional or trade Professional Practices. association?

Complete BCM package unifying all the Professional Practices, including BIA/Risk, Planning, Incident Command and Notification processes, in one instance that covers the enterprise.

What business continuity planning activities does the tool support? Does it provide support for a specific aspect of Business Continuity Planning or is it designed as a “full lifecycle” tool covering the following activities Define BCM Framework Tools which support the Yes, tightly integrated to definition of scope, the rest of the package. objectives and deliverables of the BCM project, identifying the key business areas and gathering key information of risks and tolerances to exposure. Conduct Business Impact Provide support for Yes, tightly integrated to Analysis activities related to Risk the rest of the package. analysis, dependencymodeling techniques, establishing recovery requirements and targets for both critical business enablers (such as information technology systems and infrastructure) and business activities Design BCM Approach Tools that assist with Yes, tightly integrated to identification, costing and the rest of the package. selection of recovery options.

______________________________________________________________________ ENISA 265

Risk Management

What business continuity planning activities does the tool support? Does it provide support for a specific aspect of Business Continuity Planning or is it designed as a “full lifecycle” tool covering the following activities Deliver BCP Tools that assist with Yes, tightly integrated to organizing, compiling or the rest of the package. generating documents that form part of the overall business continuity plan. This may include (but is not limited to): Incident Response Plans; Business Recovery Plans; IT Service Continuity and Recovery Plans; Communications matrices; Templates for incident management activities Test BCP Tools that assist with the Yes, tightly integrated to preparation of plan the rest of the package. exercises, recording of results, logging and followup of remedial activities Sustain the BCM Tools that support Yes, tightly integrated to programme governance of the BCM the rest of the package. programme by providing support for assurance and oversight of plan relevance, staff competencies, assurance reviews and matrics related to prepareness and capability rd Automated Call Out and Tools that automatically Yes, tightly integrated to 3 Notification send out phone calls, emails party notification systems. and faxes to call out key personnel and provide the means for recording information back from them.

If tool is designed to support ”Define BCM Framework”

BCM Framework Supported or not Comments activities Initiate BCM Yes Quick set-up of overall programme using Programme object classes to rapidly construct organizational hierarchy. Identify the Yes Quick set-up of overall programme using organisation object classes to rapidly construct organizational hierarchy. Assign BCM and Yes Use existing rosters to make and track Incident assignments. Responsibilities Define BCM Policy Yes Policy statements easily propagated across planning areas.

______________________________________________________________________ ENISA 266

Risk Management

If tool is designed to support “Conduct Business Impact Analysis”

Business Impact Supported or not Comments Analysis processes Assess Risks and Yes Rapidly construct surveys to collect risk and Impacts BIA information across the enterprise. Analyse Results Yes Use eleven filter types to analyze results.

Prioritise recovery Yes Use BIA process and eleven filter types to and define critical analyze results. resource requirements

If tool is designed to support “Design BCM Approach”

Design BCM Supported or not Comments Approach processes Determine Recovery Yes Using template libraries Options Agree Recovery Yes Using template libraries Strategy

Design BCP Yes Part of set of generic templates

If tool is designed to support “Deliver BCP”

Deliver BCP Method Supported or not Comments processes Incident Response Yes Incident checklist Plan Incident Yes Recovery Dashboard Management Plan Business Recovery Yes Part of set of generic templates Plan Recovery Support Yes Part of set of generic templates Plans Communications and Yes Part of set of generic templates Media Plan IT Service Continuity Yes Part of set of generic templates Plan Business Yes Part of set of generic templates Resumption Plan

If tools supports scheduling, performance and follow up of plan exercises

Test BCP Method Supported or not Comments processes Determine type of Yes Uses existing test procedures test Write test plan Yes Uses existing test procedures Conduct Test Yes Uses Incident Command Deliver Debrief and Yes Uses after-action tracking Test Report

______________________________________________________________________ ENISA 267

Risk Management

If tools supports sustain BCM Programme activities

Sustain BCM Supported or not Comments Programme processes Train Staff Yes Uses training calendar Maintain and Review Yes Uses Task Management BCP Develop Awareness Yes Uses training calendar

Other functionality:

Name Description Process modelling Technology modelling Integrated mapping Workflow

Controls implemented by using this tool. Control Reference Comments BCMFI01 These are established in Program Initiation BCMFRR01 Team members can be imported from Outlook Contacts BIA01 A 20-part risk assessment questionnaire is included in the program BIA03 Using existing questionnaires, new surveys can be constructed which can be distributed throughout the organisation. BIACRR01 The data can be analysed in dynamic tables or the data can be exported to Word and the results can be displayed graphically BIACRR02 The data can be analysed in dynamic tables or the data can be exported to Word and the results can be displayed graphically BCPDCP01 Existing Microsoft content can be used and templates suitable for public and private sector organisations are available BCPDCP02 Existing Microsoft content can be used and templates suitable for public and private sector organisations are available BCPDCP03 Existing Microsoft content can be used and templates suitable for public and private sector organisations are available BCPDCP04 Existing Microsoft content can be used and templates suitable for public and private sector organisations are available BCPDCP02 Able to use existing Microsoft plans and templates for private and public sector organisations are available. Data required centrally (e.g. contacts, assets, incident checklists can be rolled up to HQ databases for central reporting BCPDCP03 Able to use existing Microsoft plans and templates of private and public sector are available. Data required centrally (e.g. contacts, assets, incident checklists can be rolled up to HQ databases for central reporting BCPDIM02 Incident tasks can be set up for any team involved in incident management and PDA access allows the team members to be in different locations. BCPDIM03 Teams are notified by email that an incident has occurred. BCPDIM04 Resolution of each task is tracked BCPDIM05 Progress on incident task resolution can be viewed graphically

______________________________________________________________________ ENISA 268

Risk Management

Control Reference Comments BCPTC02 The system can be used to run an exercise and the results can be monitored on the system BCMST03 The training schedule can be managed through a calendar view and training and awareness sessions on the system can be run. These training and awareness sessions can be tracked so progress can be monitored BCMSM01 Maintenance tasks are rolled up for central viewing by the Administrator and assignees are alerted that they have a review to do. BCMSM02 The progress of maintenance and review can be monitored through the Gantt, pie and bar charts BCMSA01 There are free guest accounts which allow access for familiarisation or training purposes

Date of first release Date and identification of the last version 2002 6.1, April 2008

Official web site www.coop-systems.com User group web site (optional) Relevant web site:

Languages available English All languages in the world

Free Not free Maintenance fees Perpetual Percentage Sectors with free availability or discounted price None

CD or download available Identification required Trial period(days) Yes Yes Two weeks

Technical component Purpose Comment MS Windows Server operating system high availability design MS IIS web server high availability design MS SQL Server database high availability design MS Active Directory authentication

H.6.2 Scope

Government, International SME Commercial Non commercial agencies organisations organisations organisations Yes Yes Yes Yes Yes Specific sector :

______________________________________________________________________ ENISA 269

Risk Management

General information World-wide in many different organisations Used inside EU countries Used outside EU countries

Standard Compliance notice Comment BS 25999-1 Reference should be made to BS 25999-1 to ensure all requirements are covered in the planning process HB 292 Reference should be made to HB 292 to ensure all requirements are covered in the planning process

Certification according to standard Comments BS 25999-2 The tool will assist in obtaining certification to BS 25999-2. Reference should be made to the standard to ensure all requirements are covered in preparation for the certification. *relates to “BCM Lifecycle” tools only

Course Duration Skills Expenses myCOOP use Up to client BCM background Daily rate

H.6.3 Users Viewpoint

Skills Comments To install - - N/A with hosted version To use - - BCM skills For Administrators To maintain - - N/A Automated tasking

Support method Comment e-mail / telephone / web portal

______________________________________________________________________ ENISA 270

Risk Management

Database Name Contents N/A

Database Name Comments MS SQL Server only On hosted service, doesn’t matter.

______________________________________________________________________ ENISA 271

Risk Management

HH..77 Paragon

H.7.1 Identity Card

Tool name Vendor name Country of origin Paragon Sungard Availability USA Services

World-wide (state World-wide (sector Regional (e.g. Local oriented) oriented) European Directive) Yes Has the development of the tool been No sponsored by a professional or trade association?

Paragon is a modular business continuity planning tool employing a central database of information which can be shared across all modules.

What business continuity planning activities does the tool support? Does it provide support for a specific aspect of Business Continuity Planning or is it designed as a “full lifecycle” tool covering the following activities Define BCM Framework Tools which support the definition of scope, Supported objectives and deliverables of the BCM project, identifying the key business areas and gathering key information of risks and tolerances to exposure. Conduct Business Provide support for activities related to Supported Impact Analysis Risk analysis, dependency-modeling techniques, establishing recovery requirements and targets for both critical business enablers (such as information technology systems and infrastructure) and business activities Design BCM Approach Tools that assist with identification, costing Supported and selection of recovery options. Deliver BCP Tools that assist with organizing, compiling Supported or generating documents that form part of the overall business continuity plan. This may include (but is not limited to): Incident Response Plans; Business Recovery Plans; IT Service Continuity and Recovery Plans; Communications matrices; Templates for incident management activities Test BCP Tools that assist with the preparation of Supported plan exercises, recording of results, logging and follow-up of remedial activities

______________________________________________________________________ ENISA 272

Risk Management

What business continuity planning activities does the tool support? Does it provide support for a specific aspect of Business Continuity Planning or is it designed as a “full lifecycle” tool covering the following activities Sustain the BCM Tools that support governance of the BCM Supported programme programme by providing support for assurance and oversight of plan relevance, staff competencies, assurance reviews and matrices related to preparedness and capability Automated Call Out and Tools that automatically send out phone Supported Notification calls, emails and faxes to call out key personnel and provide the means for recording information back from them.

If tool is designed to support ”Define BCM Framework”

BCM Framework Supported or not Comments activities Initiate BCM Yes Programme Identify the Yes organisation Assign BCM Yes Responsibilities Define BCM Policy Yes Assign Incident Yes Teams

If tool is designed to support “Conduct Business Impact Analysis”

Business Impact Supported or not Comments Analysis processes Assess Risks and Yes The users can input the relevant data about Impacts their business processes and the dependent resources e.g. applications, locations. IT can enter information about the underlying infrastructure. Analyse Results Yes The information provided by the business and IT can then be tied together to illustrate all the dependencies. A range of impact scenarios can be identified and together with the complex dependency modelling for technology, locations, processes, applications and so on a series of what if and scenarios can be run. All the dependencies can be graphically represented Prioritise Recovery Yes and define critical resource requirements

______________________________________________________________________ ENISA 273

Risk Management

If tool is designed to support “Design BCM Approach”

Design BCM Supported or not Comments Approach processes Determine the Yes Can create what if and as of scenarios to Recovery Options help with strategy determination Design Recovery Yes Strategy

Design BCP Yes

If tool is designed to support “Deliver BCP”

Deliver BCP Method Supported or not Comments processes Incident Response Yes Plan Incident Yes Action plans can be developed step by step Management Plan with checklists of activities, assigned roles, required resources. During a crisis the action plans can be called up and real time plan tracking can be implemented to monitor status and communicate activities. Business Recovery Yes A library of questions and numerous plan Plan templates guide the business unit through their BC planning Recovery Support Yes A library of questions and numerous plan Plans templates guide the business unit through their BC planning Communications and Yes Paragon has a notification module which Media Plan integrates with the Situations module to enable communication throughout the organisation during a crisis. Conference call bridging is also available Business Yes Resumption Plan IT Service Continuity Yes A library of questions and numerous plan Plan templates guide the business unit through their BC planning

If tool supports Test BCP

Test BCP Method Supported or not Comments processes Determine type of Yes test Write test plan Yes Conduct Test Yes Deliver Debrief and Yes Test Report

______________________________________________________________________ ENISA 274

Risk Management

If tool supports sustain BCM Programme activities

Sustain BCM Supported or not Comments Programme processes Train Staff No Maintain and Review Yes BCP Develop Awareness No

Other functionality:

Name Description Paragon Impacts Paragon allows organisations to conduct a business impact analysis of a potential disruption and provides the ability to create surveys, which now can feed results directly to any item in an availability plan. For instance, companies could assess and record how potential system disruptions may affect a business process such as Sarbanes-Oxley compliance procedures Paragon Profiles Ability to map many to may relationships, including (but not limited (Dependency to) applications to infrastructure, technology to locations, business Modelling) processes to locations and business processes to applications and infrastructure. The Profiles module provides a ‘living whiteboard’ to profile an organization’s infrastructure, environment and interdependencies. The whiteboard can be printed and stored – in addition to being viewed. This capability enables companies to take a snapshot of an infrastructure area and examine the impact should a disruption occur. For example, an organization could look at how people, business functions and facilities would be affected if a specific server was disrupted. Paragon Plans Paragon now includes a series of new report templates to help users produce graphical analysis and metrics on program progress and readiness. The reporting capability provides security safeguards to control information access down to the individual person and report levels Paragon Situations This aspect of the software tracks availability plans in real time and allows incident managers to swap individual team members in and out of an incident as shifts change or responsibilities are reassigned. In addition to the existing e-mail messaging, organizations can now use text-to-speech notifications to individuals and teams when assignments are due or completed. Paragon Notifications can be created at any time to communicate Notifications throughout the organisation before, during or after an incident. (Automatic Notifications. Enables organizations to launch communication Notification) directly from any plan or crisis management screen. This area now supports messages delivered via personal voice recordings in addition to automated text-to-speech. The notifications engine embedded in Paragon can be used independently of Paragon screens for communications not directly connected to availability planning and response. Playbook Step by step instructions to enable users to write and maintain their plans. Infrastructure Paragon is designed to work with the latest Microsoft products utilising .Net architecture.

______________________________________________________________________ ENISA 275

Risk Management

Controls implemented by using this method Control Reference Comment BCMFI03 Progress reports can be produced BCMFO01 Paragon Profiles helps an organisation understand the structure and to customise what is in scope BCMFRR01 These can be defined via the contact database. Paragon Notifications will communicate with the required teams BCMFP01 This can be attached at an appropriate place in the program BIA03 Paragon Impacts allows flexible surveys to be built to collect data on resources, dependencies and impacts. BIACRR01 The information gathered in the impact analysis is saved in a central database and can be analysed to determine resources and dependencies. The information is available for use in the plans. BIACRR02 The information gathered in the impact analysis is saved in a central database and can be analysed to determine prioritised activities. The information is available for use in the plans. BCMARS01 The results from the analysis can be used to develop the strategy which can be developed or a separate document can be attached at the appropriate place in the program. BCPDCP01 Action Plans can be developed and templates are also available which can be customised BCPDCP02 Action Plans can be developed and templates are also available which can be customised BCPDCP03 Action Plans can be developed and templates are also available which can be customised BCPDIM01 Action Plans can be developed and templates are also available which can be customised BCPDIM02 Action Plans can be developed and templates are also available which can be customised BCPDIM03 Templates are available which can be customised and Paragon Notifications allows those involved in the response to the incident to be contacted quickly and easily BCPDIM04 Gantt charts allow the user to plot incident reaction times BCPDIM05 Results of actions can be reported BCPTC01 The action plans can be used to conduct table top or simulated exercises BCPTC02 The action plans can be used to conduct table top or simulated exercises BCPTR01 Results of the actions can be reported BCPTR02 Results of the actions can be reported BCMSM01 A review schedule can be established

Date of first release Date and identification of the last version 2004 September 2007

Official web site www.availability.sungard.com User group web site (optional) Relevant web site: http://www.availability.sungard.com/Products+and+Servic es/Business+Continuity/Software+Tools/

______________________________________________________________________ ENISA 276

Risk Management

Languages available English

Free Not free Maintenance fees Variable subscription model Sectors with free availability or discounted price Pricing based on platform services, user accounts and sector.

CD or download available Identification required Trial period(days) Yes

Technical component Purpose Comment Database SQL Server Repository Web server IIS

Application Server .Net Development tools and framework Client Browser

H.7.2 Scope

Government, International SME Commercial Non commercial agencies organisations organisations organisations Yes Yes Yes Yes Yes Specific sector : All Sectors

General information World wide Used inside EU countries Used outside EU countries

Standard Compliance notice Comment BS 25999-1 Using Paragon won’t provide full compliance with BS 25999-1, but it will achieve a high percentage

Certification according to standard Comments BS 25999-2 Using Paragon will provide help towards certification to BS 25999-2, but not all requirements will be covered. When setting up the tool it would be important to check the requirements of BS 25999-2 first and configure the system to meet the requirements *relates to “BCM Lifecycle” tools only

______________________________________________________________________ ENISA 277

Risk Management

Course Duration Skills Expenses Provided as part of implementation services

H.7.3 Users Viewpoint

Skills Comments To install Basic IT user skills To use Basic IT user skills To maintain Basic IT user skills

Support method Comment e-mail / telephone

Database Name Contents No

Database Name Comments IBM Lotus Notes or any ODBC compliance database

______________________________________________________________________ ENISA 278

Risk Management

HH..88 Shadow-Planner

H.8.1 Identity Card

Tool name Vendor name Country of origin Shadow-Planner Office-Shadow UK

World-wide (state World-wide Regional (e.g. Local oriented) (sector oriented) European Directive) Yes Has the development of the tool been No sponsored by a professional or trade association?

Shadow-Planner comprises a suite of BCM tools covering Business Impact Analysis, Risk Management, Plan Development and Maintenance, Incident Management and Compliance Scorecard. Its prime focus is on creating total simplicity for those business users whose contributions may be sought on an occasional basis. The software provides clear dashboard tools for the monitoring of these users by the central BCM team. Shadow- Planner will also, where required, integrate all relevant aspects of the BCM lifecycle as defined by standards such as BS 25999.

What business continuity planning activities does the tool support? Does it provide support for a specific aspect of Business Continuity Planning or is it designed as a “full lifecycle” tool covering the following activities Define BCM Framework Tools which support the definition of scope, Covered objectives and deliverables of the BCM project, identifying the key business areas and gathering key information of risks and tolerances to exposure. Conduct Business Provide support for activities related to Covered Impact Analysis Risk analysis, dependency-modeling techniques, establishing recovery requirements and targets for both critical business enablers (such as information technology systems and infrastructure) and business activities Design BCM Approach Tools that assist with identification, costing Covered and selection of recovery options. Deliver BCP Tools that assist with organizing, compiling Covered or generating documents that form part of the overall business continuity plan. This may include (but is not limited to): Incident Response Plans; Business Recovery Plans; IT Service Continuity and Recovery Plans; Communications matrices; Templates for incident management activities

______________________________________________________________________ ENISA 279

Risk Management

What business continuity planning activities does the tool support? Does it provide support for a specific aspect of Business Continuity Planning or is it designed as a “full lifecycle” tool covering the following activities Test BCP Tools that assist with the preparation of Covered plan exercises, recording of results, logging and follow-up of remedial activities Sustain the BCM Tools that support governance of the BCM Covered programme programme by providing support for assurance and oversight of plan relevance, staff competencies, assurance reviews and matrics related to prepareness and capability Automated Call Out and Tools that automatically send out phone Covered through Notification calls, emails and faxes to call integration with out key personnel and provide the means third-party tools for recording information back from them.

If tool is designed to support ”Define BCM Framework”

BCM Framework Supported or not Comments activities Initiate BCM No Programme Identify the Yes organisation Assign BCM and Yes Incident Responsibilities Define BCM Policy No

If tool is designed to support “Conduct Business Impact Analysis”

Business Impact Supported or not Comments Analysis processes Assess Risks and Yes Impacts Analyse Results Yes

Prioritise Recovery Yes and define critical resource requirements (including dependency analysis)

If tool is designed to support “Design BCM Approach”

Design BCM Supported or not Comments Approach processes Agree Recovery Yes Strategy

Determine Recovery Yes Options

______________________________________________________________________ ENISA 280

Risk Management

Determine recovery Yes priorities and timeline

If tool is designed to support “Deliver BCP”

Deliver BCP Method Supported or not Comments processes Incident Response Yes Plan Incident Yes Management Plan Business Recovery Yes Plan Recovery Support Yes Plans

Communications and Yes Media Plan IT Service Continuity Yes Plan Business Yes Resumption Plan

If tools supports scheduling, performance and follow up of plan exercises

Test BCP Method Supported or not Comments processes Determine type of Yes test Write Test Plan No Conduct Test No Deliver Debrief and Yes Test Report

If tools supports sustain BCM Programme activities

Sustain BCM Supported or not Comments Programme processes Train Staff No Maintain and Review Yes BCP Develop Awareness Yes

Other functionality:

Name Description Compliance Scorecard The compliance scorecard allows an organisation to assess its BC compliance across all or parts of the organisation against whatever criteria it wishes. The information is collected via a questionnaire, the answers to which are analysed and a traffic light report produced.

______________________________________________________________________ ENISA 281

Risk Management

Controls implemented by using this method Control Reference Comments BCMFRR01 Under Roles any BC or incident teams can be created and their contact details stored. A description of each team can be added BIA01 The Risk Management module can be used as a standalone module or linked to the BIA module. A colour coded risk matrix is produced against which recommended responses can be associated BIA03 A tree view of the processes for a department can be developed and the necessary resources for those processes can be dropped onto a process. RTOs, RPOs and impacts can be assigned to each process BIACRR01 The recovery resources can be displayed against different time scales. The recovery plan (critical resource requirements matrix) can be linked to the relevant process. IT can call up the technology resources upon which each process depends and enter the Achievable Recovery Time and Achievable Recovery Point for each process. Any differences between the desired and achievable RTO and RPO is highlighted in red BCPDCP01 Different plan templates can be chosen for the Planning module library. These contain triggers, actions, responsible persons and associated procedures. Items can be added under each heading (i.e. new triggers and actions can be added). Introductions can be added into the template. Associated procedures can be edited and appendices added BCPDCP02 Different plan templates can be chosen for the Planning module library. These contain triggers, actions, responsible persons and associated procedures. Items can be added under each heading (i.e. new triggers and actions can be added). Introductions can be added into the template. Associated procedures can be edited and appendices added BCPDCP03 Different plan templates can be chosen for the Planning module library. These contain triggers, actions, responsible persons and associated procedures. Items can be added under each heading (i.e. new triggers and actions can be added). Introductions can be added into the template. Associated procedures can be edited and appendices added BCPDCP04 Different plan templates can be chosen for the Planning module library. These contain triggers, actions, responsible persons and associated procedures. Items can be added under each heading (i.e. new triggers and actions can be added). Introductions can be added into the template. Associated procedures can be edited and appendices added. BCPDIM01 Different plan templates can be chosen for the Planning module library. These contain triggers, actions, responsible persons and associated procedures. Items can be added under each heading (i.e. new triggers and actions can be added). Introductions can be added into the template. Associated procedures can be edited and appendices added.

______________________________________________________________________ ENISA 282

Risk Management

Control Reference Comments BCPDIM02 Different plan templates can be chosen for the Planning module library. These contain triggers, actions, responsible persons and associated procedures. Items can be added under each heading (i.e. new triggers and actions can be added). Introductions can be added into the template. Associated procedures can be edited and appendices added. BCPDIM03 The Shadow-Planner portal page can be used to keep staff informed of the status of an incident. A Media Response procedure can be attached to the relevant task(s) in the action plans BCMSM01 Maintenance schedules and owners can be assigned to the different plans within the system. BCMSM02 The status of the maintenance tasks can be viewed. There is also a compliance scorecard with traffic light indicators for easy analysis of status BCMSA01 The Shadow-Planner portal can be used as a bulletin board to keep employees aware of the latest Business Continuity news or the status of an incident

Date of first release Date and identification of the last version 2002 June 2008 – v3.7

Official web site www.office-shadow.com User group web site (optional) Organisation’s own version of Shadow-Planner incorporates a number of forums to improve and enhance communications between Shadow-Planner users and Office Shadow. Office Shadow’s website has a number of resources available to users: http://www.office-shadow.com/engb/resources.html

Relevant web site:

Languages available English French German Italian US English Spanish

Free Not free Maintenance fees Price on application Sectors with free availability or discounted price None

CD or download available Identification required Trial period(days) Yes Yes 7

______________________________________________________________________ ENISA 283

Risk Management

Technical component Purpose Comment Database Model and information Hosted By Office Shadow or storage can be implemented on user’s own IT infrastructure Web server Model and information Hosted By Office Shadow or Access can be implemented on user’s own IT infrastructure Application Server Model and information Hosted By Office Shadow or review can be implemented on user’s own IT infrastructure Client Model and information Browser based maintenance

H.8.2 Scope

Government, International SME Commercial Non commercial agencies organisations organisations organisations Yes Yes Yes Yes Yes Specific sector : Financial Services, Energy, Utilities, Health Care

General information World-wide in many different organisations Used inside EU Yes countries Used outside EU Yes countries

Standard Compliance notice Comment BS 25999-1 Partially Shadow Planner assists with compliance to BS 25999-1, but reference should be made to the standard for requirements over and above what Shadow-Planner provides (e.g. Project Initiation, Exercising) HB 292 Partially Shadow Planner assists with compliance to BS 25999-1, but reference should be made to the standard for requirements over and above what Shadow-Planner provides (e.g. Project Initiation, Exercising)

Certification according to standard Comments BS 25999-2 Shadow-Planner will assist with certification to BS 25999-2, however reference should be made to the actual standard to ensure all requirements are covered *relates to “BCM Lifecycle” tools only

______________________________________________________________________ ENISA 284

Risk Management

Course Duration Skills Expenses A series of over 20 Typically in units of Establishing BCM professional services one day Understanding the consulting and organisation training Determining the Strategy programmes are Developing the Response available on request Exercising, Maintaining and Reviewing Embedding BCM

H.8.3 Users Viewpoint

Skills Comments To install Minimal as Shadow-Planner is offered as hosted service To use General use of a computer To maintain Minimal as Shadow-Planner is offered as a hosted service

Support method Comment e-mail Telephone Online support 24x7 Through web-site

Database Name Contents Contains specific templates for health care organisations

______________________________________________________________________ ENISA 285

Risk Management

Database Name Comments MySQL Standard database Other Database independence is planned for 2009

______________________________________________________________________ ENISA 286

Risk Management

Appendix I: GLOSSARY

Foreword

This Glossary of Terms has been produced to accompany the ENISA Report on Business and IT Continuity. It comprises Business Continuity, IT Continuity, Information Security, Security Emergency and Risk terminology.

Terminology Explanation Source

ACCEPTABLE RISK The level of residual risk that has CIAO – Critical been determined to be a reasonable Infrastructure level of potential loss/disruption Assurance Office - USA ACCESS OVERLOAD The Access Overload Control scheme NASP – National CONTROL (ACCOLC) gives call preference to registered Association of essential users on the four main Security mobile networks in the UK if the Professionals scheme is invoked during an emergency. ACCOUNTABILITY The property that ensures that the ENISA actions of an entity may be traced uniquely to the entity ACTION LISTS A specific Business Continuity ENISA Management term referring to defined actions, allocated to recovery teams and individuals, within a phase of a plan. These are supported by reference data. ACTIVATION The implementation of Business The BCI Continuity procedures, activities and plans in response to a Business Continuity Emergency, Event, Incident and/or Crisis ACTIVITY Processes carried out by an Emergency Planning organisation, for example, Accounts. College See: Business Activity AGREED SERVICE TIME The time during which a particular ENISA Business Continuity is agreed to be fully available, ideally as defined in the Service Level Agreement. Different levels of service might apply within the agreed service time, for instance the Service Desk might not be available for all the hours that users can access their services. ALERT A formal notification that an incident ENISA has occurred which may develop into a Business Continuity Management or Crisis Management invocation ALERT PHASE The first phase of a Business ENISA Continuity Plan in which the initial emergency procedures and damage

______________________________________________________________________ ENISA 287

Risk Management

Terminology Explanation Source

assessments are activated ALTERNATE ROUTING The routing of information via another The BCI medium should the primary means become unavailable ALTERNATE SITE A site held in readiness for use during The BCI a Business Continuity incident to maintain the Business Continuity of an organisation's Mission Critical Activities. The term applies equally to office or technology requirements. Alternate sites may be 'cold', 'warm' or 'hot'. This type of site is also known as a Recovery Site. ALTERNATE WORK AREA Recovery environment complete with ENISA necessary infrastructure (desk, telephone, workstation, and associated hardware and equipment, communications, etc.) ALTERNATIVE The routing of information via an Emergency Planning alternative cable routing medium (i.e. College and The BCI using different networks should the normal network be rendered unavailable) ANNUAL LOSS A Risk Management method of Emergency Planning EXPOSURE/EXPECTANCY calculating loss based on a value and College (ALE) level of frequency APPLICATION RECOVERY The component of Disaster Recovery IT Recovery Site that deals specifically with the restoration of business system software and data after the processing platform has been restored or replaced ASSEMBLY AREA The designated area at which The BCI employees, visitors, and contractors assemble if evacuated from their building/site ASSET An item of property and/or The BCI component of a business activity/process owned by an organisation ASSURANCE The activity and method whereby an ENISA organisation can verify and validate its BCM capability AUDIT The method by which procedures The BCI and/or documentation are measured against pre-agreed standards AUTOMATIC FAILOVER The ability to automatically re-route ENISA end users and applications to a replica server, where they can continue to work with minimal interruption and productivity loss

______________________________________________________________________ ENISA 288

Risk Management

Terminology Explanation Source

AVAILABILITY An umbrella term that includes ENISA reliability (including resilience), maintainability, serviceability and security. A common definition of availability is 'the ability of a component or Business Continuity (under combined aspects of its reliability, maintainability and security) to perform its required function at a stated instant or over a stated period of time'. Service availability is sometimes expressed as an availability percentage, i.e. the proportion of time that the service is actually available for use by the customers within the agreed service time. BACKLOG The effect on the business of a build- The BCI up of work that occurs as the result of a system or method being unavailable for an unacceptable period. A situation whereby a backlog of work requires more time to action than is available through normal working patterns. In extreme circumstances, the backlog may become so marked that the backlog cannot be cleared. BACKLOG TRAP The effect on the business of a ENISA backlog of work that develops when a system or process is unavailable for a long period, and which may take a considerable length of time to reduce BACK-OUT PLAN A plan that documents all actions to Emergency Planning be taken to restore the service if the College and the UK associated Change or Release fails or Financial Sector partially fails. Back-out plans may Continuity provide for a full or partial reversal. In extreme circumstances they may simply call for the Business Continuity Plan to be invoked. BACKUP A method by which data, electronic or The BCI paper based, is copied in some form so as to be available and used if the original data from which it originated is lost, destroyed or corrupted BACKUP GENERATOR An independent source of power, ENISA usually fuelled by diesel or natural gas BATTLE BOX A container in which data, information The BCI and other essentials is stored so as to become readily available to those responding to an incident BENCHMARKING A form of comparison usually between UK Financial Sector the activities of one organisation and Continuity

______________________________________________________________________ ENISA 289

Risk Management

Terminology Explanation Source

those of one or more comparable external organisations. Also used to describe a form of simulation modelling where the entire operational environment is replicated or simulated BODY HOLDING AREA An area close to the scene of an NASP – National emergency where the dead can be Association of held temporarily before transfer to Security the emergency mortuary or mortuary Professionals BRAINSTORMING A Problem Management technique UK Financial Sector used to quickly generate, clarify and Continuity evaluate a sizeable list of ideas, Problems, issues , themes, etc. by documenting 'what we know' as a team, tapping the creative thinking of the team and getting everyone involved. The technique is particularly useful in identifying possible causes when constructing a Cause / Effect Diagram. BRONZE TEAM Bronze or Operational (Incident) ENISA Team is the level at which the management of hands-on work is undertaken at the incident site or impacted areas. BS 25999 The British Standards Institution ENISA 'Specification for Business Continuity Management' BS 7799 The British Standards Institution The BCI standard for information security management. Section 9 deals with Business Continuity Management. The corresponding international standard is known as ISO 17799. BS 7799-1:2000 The British Standards Institution ENISA 'Code of practice for information security management'. Also referred to as ISO/IEC 17799-2000 BS 15000 The British Standards Institution ENISA 'Specification for IS service management' BSA Bomb Shelter Area; internal area that The British Army offers protection from blast, flying glass and other fragments. BSI The British Standards Institution The BSI BUILDING DENIAL Any damage, failure or other ENISA condition which causes denial of access to the building or the working area within the building, e.g. fire, flood, contamination, loss of services, air conditioning failure, and forensics BUSINESS ACTIVITY A group of activities/processes The BCI undertaken by an organisation to

______________________________________________________________________ ENISA 290

Risk Management

Terminology Explanation Source

produce a product and/or service and/or in pursuit of a common goal BUSINESS ACTIVITY The predicted or historic levels of ENISA LEVELS business method activity that are to be or have been supported by the IS infrastructure. Measured in business terms (e.g. number of account holders). BUSINESS AS USUAL The normal state of operations The BCI (BAU) BUSINESS CONTINUITY A proactive process which identifies The BCI (BC) the key functions of an organisation and the likely threats to those functions BUSINESS CONTINUITY A holistic management process that The BCI, modified by MANAGEMENT (BCM) identifies potential impacts that ENISA threaten an organisation and provides a framework for building resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value creating activities. Also the management of the overall programme through training, rehearsals, and reviews, to ensure the plan stays current and up to date. BUSINESS CONTINUITY An action or series of actions that The BCI MANAGEMENT ACTIVITY forms part of the BCM process BUSINESS CONTINUITY A member of the Business Continuity The BCI modified by (MANAGEMENT) CO- Management team who is assigned ENISA ORDINATOR the overall responsibility for cocoordination of the recovery planning programme including team member training, testing and maintenance of recovery plans (associated terms: business recovery planner, disaster recovery planner, business recovery co-coordinator, disaster recovery administrator) BUSINESS CONTINUITY The activities and processes divided The BCI MANAGEMENT LIFECYCLE into various stages that are necessary to manage Business Continuity BUSINESS CONTINUITY The level and degree to which The BCI MANAGEMENT MATURITY Business Continuity activities have become standard and assured practices within the organisation BUSINESS CONTINUITY A collection of procedures and BS 25999-1 MANAGEMENT PLAN information which is developed, compiled and maintained in readiness for use in the event of an emergency or disaster BUSINESS CONTINUITY The advance planning and The BCI MANAGEMENT PLANNING preparations which are necessary to

______________________________________________________________________ ENISA 291

Risk Management

Terminology Explanation Source

identify the impact of potential losses; to formulate and implement viable recovery strategies; to develop recovery plan(s) which ensure continuity of organisational services in the event of an emergency or disaster; and to administer a comprehensive training, testing and maintenance programme BUSINESS CONTINUITY A BCM policy sets out an The BCI MANAGEMENT POLICY organisation's aims, principles and approach to BCM, what and how it will be delivered, key roles and responsibilities and how BCM will be governed and reported upon BUSINESS CONTINUITY A set of activities/processes with The BCI, modified by MANAGEMENT PROCESS defined outcomes, deliverables and ENISA evaluation criteria that form a distinct part of the BCM lifecycle BUSINESS CONTINUITY An ongoing management and The BCI MANAGEMENT governance method supported by PROGRAMME senior management and resourced to ensure that the necessary steps are taken to identify the impact of potential losses, maintain viable recovery strategies and plans, and ensure continuity of products/services through exercising, rehearsal, testing, training, maintenance and assurance BUSINESS CONTINUITY A group of individuals functionally ENISA MANAGEMENT TEAM responsible for directing the development and execution of the Business Continuity Plan, as well as responsible for declaring a disaster and providing direction during the recovery process, both pre-disaster and post-disaster BUSINESS CONTINUITY The desired time within which ENISA OBJECTIVE business method should be recovered, and the minimum staff, assets and services required within this time BUSINESS CONTINUITY Documents describing the roles, ENISA PLAN (BCP) responsibilities and actions necessary to resume business processes following a disruption. The Business Continuity Plan will provide a defining structure for and exert a major influence upon the development of IS continuity plans. Its scope both encompasses and exceeds Business Continuity Management and is normally a business responsibility. BUSINESS CONTINUITY One of a number of groups of people ENISA TEAM with defined, agreed and documented

______________________________________________________________________ ENISA 292

Risk Management

Terminology Explanation Source

roles within the business recovery process BUSINESS CRITICAL Critical operational or support The BCI FUNCTIONS activities BUSINESS CRITICAL The latest moment at which the The BCI POINT business can afford to be without a critical function or process BUSINESS FUNCTION A business unit within an organisation The BCI e.g. a department, division, branch BUSINESS IMPACT An assessment of the minimum level The BCI, UK ANALYSIS (BIA) of resources e.g. personnel, Financial Sector workstations, technology, telephony Continuity, modified required, overtime, after a Business by ENISA Continuity Incident to maintain the continuity of the organisation's Mission Critical Activities at a minimum level of service/production. The BIA measures the effect of resource loss and escalating losses over time in order to provide senior management with reliable data upon which to base decisions on risk mitigation and continuity planning. Generally considered to be part of a BIA it is an integral part of any subsequent resource Gap Analysis. BUSINESS Any event, whether anticipated (i.e., ENISA INTERRUPTION public service strike) or unanticipated (i.e., blackout) which disrupts the normal course of business operations at an organisation’s location BUSINESS The impact to the business caused by ENISA INTERRUPTION COSTS different types of outages, normally measured by revenue lost BUSINESS Insurance coverage for disaster ENISA INTERRUPTION related expenses that may be INSURANCE incurred until operations are fully recovered after a disaster BUSINESS OBJECTIVES The measurable targets designed to ENISA help an organisation achieve its overall business strategy BUSINESS OPERATIONS Activities and procedures carried out ENISA by the User community in performing the business role of an organisation. A Service Desk is concerned with supporting and dealing with the comments and requests arising from those business operations. BUSINESS PROCESS A series of related business activities ENISA aimed at achieving one or more business objectives in a measurable manner. Typical business processes include receiving orders, marketing services, selling products, delivering

______________________________________________________________________ ENISA 293

Risk Management

Terminology Explanation Source

services, distributing products, invoicing for services, accounting for money received. A business method will usually depend upon several business functions for support e.g. IT, personnel, accommodation. A business method will rarely operate in isolation, i.e. other business processes will depend on it and it will depend on other processes. See Process BUSINESS RECOVERY An individual or group designated to ENISA CO-ORDINATOR coordinate or control designated recovery processes or testing BUSINESS RECOVERY A group of individuals responsible for The BCI, modified by TEAM maintaining the business recovery ENISA procedures and coordinating the recovery of business functions and processes See Disaster Recovery Teams BUSINESS RECOVERY The chronological sequence of ENISA TIMELINE recovery activities, or critical path, that must be followed to resume an acceptable level of operations following a business interruption. This timeline may range from minutes to weeks, depending upon the recovery requirements and methodology. BUSINESS RISK The risk that external factors, such as ENISA a fall in demand for an organisations products or services, will result in unexpected loss. Business risk, if managed well, can also result in a competitive advantage being gained. BUSINESS UNIT A component of Business Continuity UK Financial Sector RECOVERY (PLAN) which deals specifically with the Continuity recovery of a key function or department in the event of a disaster CALL TREE A structured cascade method The BCI, modified by (system) that enables a list of ENISA persons, roles and/or organisations to be contacted as a part of a plan invocation procedure or in order to disseminate information. Graphically depicts the calling responsibilities and the calling order used to contact management, employees, customers, vendors, and other key contacts in the event of an emergency, disaster, or severe outage situation. CALL TREE CASCADE A test designed to validate the The BCI TEST currency of contact lists and the processes by which they are maintained

______________________________________________________________________ ENISA 294

Risk Management

Terminology Explanation Source

CAPABILITY Originally a military term which The British Army includes the aspects of personnel, equipment, training, planning and operational doctrine, now used to mean a demonstrable capacity or ability to respond to and recover from a particular threat or hazard CASCADE SYSTEM A system whereby one person or The BCI organisation calls out/contacts others who in turn initiate further callouts/contacts as necessary. Similar Terms: Contact List, Call Tree CASUALTY BUREAU The purpose of the Casualty Bureau is NASP – National to provide the initial point of contact Association of for the receiving and assessing of Security information relating to persons Professionals believed to be involved in the emergency. The primary objectives of a Casualty Bureau are to: inform the investigation process relating to the incident; trace and identify people involved in the incident; and reconcile missing persons and collate accurate information in relation to the above for dissemination to appropriate parties. CATEGORY 1 A person or body listed in Part 1 of UK Civil RESPONDER Schedule 1 to the UK Civil Contingencies Act, Contingencies Act. These bodies are modifed by ENISA likely to be at the core of the response to most emergencies. As such, they are subject to the full range of civil protection duties in the Act. Examples of Category 1 responders include the emergency services and local authorities. CATEGORY 2 A person or body listed in Part 3 of UK Civil RESPONDER Schedule 1 to the UK Civil Contingencies Act, Contingencies Act. These are co- modified by ENISA operating responders who are less likely to be involved in the heart of multi-agency planning work, but will be heavily involved in preparing for incidents affecting their sectors. The Act requires them to co-operate and share information with other Category 1 and 2 responders. Examples of Category 2 responders include utilities and transport companies.

______________________________________________________________________ ENISA 295

Risk Management

Terminology Explanation Source

CBRN Chemical, Biological, Radiological and NASP – National Nuclear. Chemical, biological and Association of radiological incidents involve both the Security release of the corresponding material Professionals and and threats, hoaxes and false alarms. The British Army, A nuclear incident would involve the modified by ENISA detonation of a nuclear weapon or an improvised nuclear device. CENTRAL COMPUTER The CCTA was the UK Government UK Government Site AND Centre for Information Systems TELECOMMUNICATIONS responsible for producing and AGENCY maintaining ITIL. Now subsumed within the OGC CERTIFICATION The formal evaluation of an ENISA organisation's processes by an independent and accredited body against a defined standard and the issuing of a certificate indicating conformance CHANGE Any deliberate action that alters the ENISA form, fit or function of key business activities - typically, an addition, modification, movement or deletion that impacts on the IS infrastructure CHANGE CONTROL The procedures to ensure that all ENISA changes are controlled, including the submission, recording, analysis, decision making, approval, implementation and postimplementation review of the change CHECKLIST A tool to remind and /or validate that ENISA tasks have been completed and resources are available, to report on the status of recovery CHECKLIST EXERCISE A method used to exercise a ENISA completed disaster recovery plan. This type of exercise is used to determine whether the information such as phone numbers, manuals, equipment, etc. in the plan is accurate and current. CIVIL CONTINGENCIES The Civil Contingencies Act 2004 UK Financial Sector ACT (CCA) establishes a single framework for Continuity, modified civil protection in the United Kingdom. by ENISA Part 1 of the Act establishes a clear set of roles and responsibilities for local responders. Part 2 modernises the emergency powers framework in the United Kingdom. CIVIL EMERGENCY Event or situation which threatens NASP – National serious damage to human welfare in a Association of place in the UK, the environment or Security security of the UK as defined in the Professionals and Civil Contingencies Act 2004 The British Army,

______________________________________________________________________ ENISA 296

Risk Management

Terminology Explanation Source

modified by ENISA CIVIL PROTECTION Preparedness to deal with a wide NASP – National range of emergencies from localised Association of flooding to terrorist attack Security Professionals and The British Army, modified by ENISA CLERICAL BACKUP In case of contingency, delivering ENISA some part of the required services without the IS infrastructure. Nowadays, as well as some manual processes, this is likely to be via standalone PCs and commercial office systems software. COLD SITE One or more data centres or office The BCI, modified by space facilities equipped with ENISA sufficient pre-qualified environmental conditioning, electrical connectivity, communications access, configurable space and access to accommodate the installation and operation of equipment by critical staff required to resume business operations COLD An empty computer room, either in Disaster Recovery STANDBY/START/SITE portable accommodation or on a fixed Journal, modified by (portable or fixed) site, with power, environmental ENISA control and telecommunications, but no IS equipment or software for use in an emergency. See Gradual Recovery COMAH UK Control of Major Accident Hazards NASP – National regulations. They apply mainly to the Association of chemical industry, but also to some Security storage, explosives and nuclear sites, Professionals and other facilities which use or keep dangerous substances. COMMAND AND Principles adopted by an agency The BCI, modified by CONTROL acting with full authority to direct its ENISA own resources (both personnel and equipment). During an incident operations will be directed at strategic, tactical or operational levels to achieve the recovery objectives of the organisation and to bring the incident to a successful conclusion. COMMAND CENTRE (CC) The facility used by a Crisis/Incident The BCI, modified by Management Team after the first ENISA phase of a Business Continuity incident (often referred to as the incident response or emergency response phase). An organisation must have a primary and secondary location for a command centre in the event of one being unavailable. It

______________________________________________________________________ ENISA 297

Risk Management

Terminology Explanation Source

may also serve as a reporting point for deliveries, services, press and all external contacts. See also Emergency Operations Centre COMMAND, CONTROL, A Crisis Management process. The BCI AND COORDINATION Command means the authority for an organisation or part of an organisation to direct the actions of its own resources (both personnel and equipment). Control means the authority to direct strategic, tactical and operational operations in order to complete an assigned function. This includes the ability to direct the activities of others engaged in the completion of that function, i.e. the crisis as a whole or a function within the crisis management process. The control of an assigned function also carries with it the responsibility for the health and safety of those involved. Coordination means the integration of the expertise of all the agencies/roles involved with the objective of effectively and efficiently bringing the crisis to a successful conclusion. COMMUNICATIONS The component of Disaster Recovery The Disaster RECOVERY which deals with the restoration or Recovery Journal rerouting of an organisations telecommunication network, or its components, in the event of loss COMPUTER RECOVERY A group of individuals responsible for ENISA TEAM assessing damage to the original system, processing data in the interim, and setting up the new system. CONSEQUENCE The end result following a Business The BCI Continuity incident that can be defined as loss, injury, disadvantage or gain CONSORTIUM An agreement made by a group of The Disaster AGREEMENT organisations to share processing Recovery Journal facilities and/or office facilities if one member of the group suffers a disaster CONTACT LIST A list of team members and/or key ENISA personnel to be contacted including their backups CONTINGENCY FUND An operating expense that exists as a ENISA result of an interruption or disaster which seriously affects the financial position of the organisation CONTINGENCY PLAN Actions to be followed in the event of ENISA

______________________________________________________________________ ENISA 298

Risk Management

Terminology Explanation Source

a disaster or emergency occurring which threatens to disrupt or destroy the continuity of normal business activities and which seeks to restore operational capabilities. Now largely incorporated within Business Continuity Plan. CONTINGENCY Process of developing advanced ENISA PLANNING arrangements and procedures that enable an organisation to respond to an undesired event that negatively impacts the organisation CONTINUITY OF The basis of PDD-NSC-67 PDD-NSC-67 GOVERNMENT (COG) (Presidential Decision Directives) - Enduring Constitutional Government and Continuity of Government Operations CONTINUITY OF A COOP provides guidance on the PDD-NSC-67 OPERATIONS PLAN system restoration for emergencies, (COOP) disasters, mobilization, and for maintaining a state of readiness to provide the necessary level of information processing support commensurate with the mission requirements/priorities identified by the respective functional proponent. The US Federal Government and its supporting agencies traditionally use this term to describe activities otherwise known as Disaster Recovery, Business Continuity, Business Resumption, or Contingency Planning. CONTINUOUS A characteristic of an Business The Disaster AVAILABILITY Continuity that masks from the users Recovery Journal, the effects of losses of service, modified by ENISA planned or unplanned. See Continuous Operation CONTINUOUS The ability of an organisation to The Disaster OPERATIONS perform its processes without Recovery Journal, interruption Modified by ENISA CONTROL Any action which reduces the The BCI probability of a risk occurring or reduces its impact if it does occur

______________________________________________________________________ ENISA 299

Risk Management

Terminology Explanation Source

CONTROL CULTURE Sets the tone for an organisation, The BCI influencing the control consciousness of its people. Control culture factors include the integrity, ethical values and competence of the entity's people: management's philosophy and operating style; the way management assigns authority and responsibility, and organises and develops its people; and the attention and direction provided by a Board. CONTROL ENVIRONMENT The entire system of controls, The BCI financial and otherwise, established by a Board and management in order to carry on an organisation's business in an effective and efficient manner, in line with the organisation's established objectives and goals. Also exists to ensure compliance with laws and regulations, to safeguard an organisation's assets and to ensure the reliability of management and financial information. Also referred to as Internal Control. CONTROL FRAMEWORK A model or recognised system of The BCI control categories that covers all internal controls expected within an organisation CONTROL REVIEW / Involves selecting a control and The BCI MONITORING establishing whether it has been working effectively and as described and expected during the period under review CONTROL SELF A class of techniques used in an audit The BCI ASSESSMENT (CSA) or in place of an audit to assess risk and control strength and weaknesses against a control framework. The 'self' assessment refers to the involvement of management and staff in the assessment process, often facilitated by internal auditors. CSA techniques can include workshop/seminars, focus groups, structured interviews and survey questionnaires. CONTROLLED AREA The area contained, if practicable, by ENISA the inner cordon CORDON The boundary line of a zone that is The BCI determines, reinforced by legislative power and exclusively controlled by the emergency services from which all unauthorised persons are excluded for a period of time CORPORATE The system/process by which the The BCI GOVERNANCE directors and officers of an

______________________________________________________________________ ENISA 300

Risk Management

Terminology Explanation Source

organisation are required to carry out and discharge their legal, moral and regulatory accountabilities and responsibilities CORPORATE RISK A category of Risk Management that The BCI looks at ensuring that an organisation meets its corporate governance responsibilities, takes appropriate actions and identifies and manages emerging risks COST BENEFIT ANALYSIS A process (after a BIA and Risk The BCI Assessment) that facilitates the financial assessment of different strategic BCM options and balances the cost of each option against the perceived savings COUNTERMEASURE An action taken to reduce risk. It ENISA may reduce the 'value' of the asset, the threats facing the asset or the vulnerability of that asset to those threats. CRISIS A critical event, which, if not handled The BCI and UK in an appropriate manner, may Financial Sector dramatically impact an organisation's Continuity profitability, reputation, or ability to operate. Or, an occurrence and/or perception that threatens the operations, staff, shareholder value, stakeholders, brand, reputation, trust and/or strategic/business goals of an organisation. See Event and Incident CRISIS MANAGEMENT The method concerned with managing ENISA the entire range of impacts following a disaster, including elements such as adverse media coverage and loss of customer confidence CRISIS MANAGEMENT A clearly defined and documented ENISA PLAN plan of action for use at the time of a crisis. Typically a plan will cover all the key personnel, resources, services and actions required to implement and manage the Crisis Management process. CRISIS MANAGEMENT A management team who direct the ENISA TEAM (CMT) recovery operations whilst taking responsibility for the survival and the image of the enterprise CRISIS MANAGEMENT A plan of action designed to support ENISA PLAN OR CRISIS PLAN the crisis management team when dealing with a specific emergency situation which might threaten the operations, staff, customers or reputation of an enterprise CRISIS MANAGER (CM) The leader of the Crisis Management ENISA

______________________________________________________________________ ENISA 301

Risk Management

Terminology Explanation Source

Team

CRISIS SIMULATION The process of testing an ENISA organisation's ability to respond to a crisis in a coordinated, timely, and effective manner, by simulating the occurrence of a specific crisis CRISIS ROOM See Command Centre The BCI

CRITICAL DATA POINT The point in time to which data must The BCI be restored in order to achieve recovery objectives CRITICAL Physical assets whose incapacity or The Disaster INFRASTRUCTURE (CI) destruction would have a debilitating Recovery Journal, impact on the economic or physical modified by ENISA security of an organisation, community, nation, etc. CRITICAL RECORDS Records or documents that, if ENISA damaged or destroyed, would cause considerable inconvenience and/or require replacement or recreation at considerable expense CRITICAL SERVICE Any service which is essential to ENISA support the survival of the enterprise CRITICAL SUCCESS The certain factors that will be critical ENISA FACTORS (CSFs) to the success of the organisation, in the sense that if the objectives associated with those factors are not achieved, the organisation will fail perhaps catastrophically so. Identification of CSFs should help determine the strategic objectives of the organisation. CUSTOMER All of the activities necessary to ENISA RELATIONSHIP ensure that Business Continuity MANAGEMENT CRM Managers have a true understanding of their customers' needs and that the customers also understand their responsibilities. Use of the term in an Business Continuity Management sense should not be confused with the specific CRM term which is generally focused on helping a business 'sell' more to its customers rather than deliver better services. DAMAGE ASSESSMENT The method of assessing the The BCI financial/non-financial damage following a Business Continuity incident. It usually refers to the assessment of damage to physical assets e.g. vital records, buildings, sites, technology to determine what can be salvaged or restored and what must be replaced.

______________________________________________________________________ ENISA 302

Risk Management

Terminology Explanation Source

DATA AVAILABILITY Data is accessible and services are ENISA operational. DATA BACKUP Data backup strategies will determine The Disaster STRATEGIES the technologies, media and offsite Recovery Journal, storage of the backups necessary to modified by ENISA meet an organisations data recovery and restoration objectives. DATA BACKUPS The copying of production files to The Disaster media that can be stored both on Recovery Journal, and/or off-site and can be used to modified by ENISA restore corrupted or lost data or to recover entire systems and databases in the event of a disaster DATA CENTRE RECOVERY The component of Disaster Recovery The Disaster which deals with the restoration of Recovery Journal, data centre services and computer modified by ENISA processing capabilities at an alternate location and the migration back to the production site DATA CONFIDENTIALITY The protection of communications or ENISA stored data against interception and reading by unauthorised persons DATA INTEGRITY The confirmation that data which has ENISA been sent, received or stored is complete and unchanged DATA MIRRORING A method whereby critical data is The BCI copied instantaneously to another location so that it is not lost in the event of a Business Continuity incident DATA PROTECTION Statutory requirements to manage The BCI personal data in a manner that does not threaten or disadvantage the person to whom it refers DATA RECOVERY The restoration of computer files from The Disaster backup media to restore programs Recovery Journal, and production data to the state that modified by ENISA existed at the time of the last safe backup DATABASE REPLICATION The partial or full duplication of data from a source database to one or more destination databases DECISION POINT The latest moment at which the The BCI decision to invoke emergency procedures has to be taken in order to ensure the continued viability of the enterprise DECLARATION (OF A formal statement that a state of The Emergency DISASTER) disaster exists Planning Society DECLARATION FEE A fee charged by a Commercial Hot ENISA Site Vendor for a customer invoked disaster declaration DELEGATION A formal agreement whereby one ENISA organisation's functions will be carried

______________________________________________________________________ ENISA 303

Risk Management

Terminology Explanation Source

out by another. DENIAL OF ACCESS The inability of a organisation to The BCI access and/or occupy its normal working environment. Usually imposed and controlled by the Emergency and/or Statutory Services. DEPENDENCY The reliance or interaction of one The BCI activity or process upon another DESKTOP EXERCISE See: Table Top Exercise ENISA DISASTER A sudden, unplanned catastrophic The Disaster event causing unacceptable damage Recovery Journal or loss DISASTER RECOVERY Disaster Recovery refers to an IT- NIST SP 800-34, (DR) focused plan designed to restore with some operability of the target system, modification by application, or computer facility at an ENISA alternate site after an emergency. The scope may overlap that of an IT Service Continuity Plan; however, the DR Plan is narrower in scope and does not address Business Impact Analysis. Also referred to as IT Disaster Recovery. DISASTER RECOVERY A role of the Disaster Recovery The Disaster COORDINATOR programme that coordinates planning Recovery Journal and implementation for overall technical recovery of a component DISASTER RECOVERY A plan to resume, or recover, a ENISA PLAN (DRP) OR specific essential technical operation RECOVERY PLAN DISASTER RECOVERY The process of writing a Disaster ENISA PLANNING Recovery Plan DISASTER RECOVERY An application program developed to ENISA SOFTWARE assist an organisation in writing a comprehensive disaster recovery plan DISASTER RECOVERY A structured group of teams ready to The Disaster TEAMS take control of the recovery Recovery Journal operations if a disaster should occur DISK MIRRORING Disk mirroring is the duplication of The Disaster data on separate disks in real time to Recovery Journal, ensure its continuous availability, modified by ENISA currency and accuracy. Disk mirroring can function as a disaster recovery solution by performing the mirroring remotely. True mirroring will enable a zero recovery point objective. Depending on the technologies used, mirroring can be performed synchronously, asynchronously, semisynchronously, or point-in-time. DISRUPTION An event which interrupts the ability ENISA of an organisation to deliver its outputs DIVERSE ROUTING The routing of information through The Disaster

______________________________________________________________________ ENISA 304

Risk Management

Terminology Explanation Source

split or duplicated cable facilities Recovery Journal, modified by ENISA DOWNTIME The total period that a service or The Disaster component is not operational within Recovery Journal, an agreed service time. Measured modified by ENISA from when a service or component fails to when normal operations recommence. DROP SHIP A strategy for providing replacement The Disaster hardware within a specified time Recovery Journal, period via prearranged contractual modified by ENISA arrangements with an equipment supplier at the time of a Business Continuity event ELECTRONIC VAULTING Electronic transmission of data to a ENISA server or storage facility. EMERGENCY An actual or impending situation that The BCI may cause injury, loss of life, destruction of property or cause the interference, loss or disruption of an organisation's normal business operations to such an extent that it poses a threat EMERGENCY CHANGE A change that is planned, scheduled ENISA and implemented at very short notice in order to protect a service from an unacceptable risk of failure or degradation, lack or loss of functionality EMERGENCY The location from which an incident is ENISA CONTROL/COMMAND directed and tracked. It may also CENTRE (ECC) serve as a reporting point for deliveries, services, press and all external contacts. See Command Centre EMERGENCY CO- The person designated to plan, ENISA ORDINATOR exercise, and implement the activities of sheltering in place or the evacuation of occupants of a site with the first responders and emergency services agencies EMERGENCY DATA Remote capture and storage of The BCI SERVICES electronic data, such as journalling, electronic vaulting and database shadowing EMERGENCY A plan which supports the emergency The Emergency MANAGEMENT PLAN management team by providing them Planning Society with information and guidelines modified by ENISA EMERGENCY The group of staff who command the The Emergency MANAGEMENT TEAM resources needed to recover the Planning Society, enterprises operations modified by ENISA EMERGENCY A site from which response The Emergency OPERATIONS CENTER teams/officials (municipal, county, Planning Society, (EOC) state and federal) provide direction modified by ENISA

______________________________________________________________________ ENISA 305

Risk Management

Terminology Explanation Source

and exercise control in an emergency or disaster. See Emergency Control Centre, Crisis Centre, Crisis Room, Incident Room EMERGENCY PLANNING Development and maintenance of The Emergency (EP) agreed procedures to prevent, Planning Society, reduce, control, mitigate and take modified by ENISA other actions in the event of an emergency EMERGENCY The capability that enables an The Emergency PREPAREDNESS organisation or community to respond Planning Society, to an emergency in a coordinated, modified by ENISA timely, and effective manner to prevent the loss of life and minimize injury and property damage EMERGENCY A documented list of activities to The Emergency PROCEDURES commence immediately to prevent Planning Society, the loss of life and minimize injury modified by ENISA and property damage EMERGENCY RESPONSE The immediate reaction and response The Emergency to an emergency situation commonly Planning Society, focusing on ensuring life safety and modified by ENISA reducing the severity of the incident EMERGENCY RESPONSE A documented plan usually addressing The Emergency PLAN the immediate reaction and response Planning Society, to an emergency situation modified by ENISA EMERGENCY RESPONSE The initial response to any The BCI PROCEDURES event,focused upon protecting human life and the organisation's assets EMERGENCY RESPONSE Qualified and authorized personnel The Emergency TEAM (ERT) who have been trained to provide Planning Society immediate assistance modified by ENISA EMERGENCY SERVICES Usually refers to the civil services of The BCI Police, Fire and Ambulance ENTERPRISE An organisation, a corporate entity; a The BCI firm, an establishment, a public or government body, department or agency; a business or a charity ENTERPRISE WIDE The overarching master plan covering ENISA PLANNING all aspects of Business Continuity within the entire organisation

______________________________________________________________________ ENISA 306

Risk Management

Terminology Explanation Source

ESCALATION Passing information and/or requesting The BCI modified by action on an Incident, Problem or ENISA Change to more senior staff (hierarchical escalation) or other specialists (functional escalation) The circumstances in which either vertical escalation for information/authority to apply further resources or horizontal escalation for greater functional involvement need to be precisely described, so that the purpose of the escalation and the nature of the required response is absolutely clear to all parties as the escalation occurs. Escalation rules will be geared to priority targets. Functional Escalation is sometimes called Referral. ESSENTIAL SERVICE A service without which a building The BCI would be 'disabled'. Often applied to the utilities (water, gas, electricity, etc.) it may also include standby power systems, environmental control systems or communication networks. EVACUATION The movement of employees, visitors The BCI and contractors from a site and/or building to a safe place (assembly area) in a controlled and monitored manner at time of an event EVENT Any occurrence that may lead to a ENISA Business Continuity incident EXCLUSION ZONE See Cordon ENISA EXCEPTION REPORTING Reducing the Management ENISA Information produced to that which most demands or deserves attention. The Top Ten style of list is an example. EXECUTIVE / A predetermined plan for ensuring the ENISA MANAGEMENT continuity of authority, decision- SUCCESSION PLAN making, and communication in the event that key members of executive management unexpectedly become incapacitated EXERCISE A people-focused activity designed to ENISA execute Business Continuity Plans and evaluate the individual and/or organisation performance against approved standards or objectives. Exercises can be announced or unannounced, and are performed for the purpose of training and conditioning team members, and validating the Business Continuity Plan. Exercise results identify plan gaps and limitations and are used to

______________________________________________________________________ ENISA 307

Risk Management

Terminology Explanation Source

improve and revise the Business Continuity Plans. EXERCISE AUDITOR An appointed role that is assigned to The UK Financial assess whether the exercise Sector Continuity aims/objectives are being met and to measure whether activities are occurring at the right time and involve the correct people to facilitate their achievement EXERCISE The person who runs the exercise on ENISA CONTROLLER/FACILITAT the day in accordance with the OR Exercise Script EXERCISE CO- They are responsible for the ENISA ORDINATOR mechanics of running the exercise. EXERCISE OBSERVER An exercise observer has no active The BCI role within the exercise but is present for awareness and training purposes. An exercise observer might make recommendations for procedural improvements. EXERCISE OWNER An appointed role that has total ENISA management oversight and control of the exercise and has the authority to alter the Exercise Plan. EXERCISE PLAN A plan designed to evaluate tasks, ENISA teams, and procedures that are documented in Business Continuity Plans to ensure the plan’s viability. This can include all or part of the BC plan, but should include mission critical components. See Test Plan EXERCISE SCRIPT A time-line for running the exercise. ENISA It states what activities should be happening, when they should happen and who is carrying out the activity. See Test Script EXERCISE REPORT A report which is written following an ENISA exercise to discuss the outcomes of the exercise and recommendations for amendments and further work. See Test Report EXPOSURE The potential susceptibility to loss; The BCI the vulnerability to a particular risk EXTRA EXPENSE The extra cost necessary to ENISA implement a recovery strategy and/or mitigate a loss. An example is the cost to transfer inventory to an alternate location to protect it from further damage, cost of reconfiguring lines, overtime costs, etc. Typically reviewed during BIA and is a consideration during insurance evaluation.

______________________________________________________________________ ENISA 308

Risk Management

Terminology Explanation Source

EXTREME OR A Business Continuity incident of The BCI CATASTROPHIC immense proportions that has severe EMERGENCY, EVENT, consequences, often damaging a INCIDENT AND/OR large proportion of the organisation's CRISIS assets that results in a loss greater than an expected loss. FACILITIES The function that manages all aspects The BCI MANAGEMENT (FM) of an organisation’s real estate assets and infrastructure. FAILURE A failure occurs when a functional unit The Disaster is no longer fit for purpose. Recovery Journal modified by ENISA FAILOVER Failover is the capability to switch The Disaster over automatically to a redundant or Recovery Journal standby computer server, system, or modified by ENISA network upon the failure or abnormal termination of the previously active server, system, or network. Failover happens without human intervention and generally without warning, unlike switchover.

FALLBACK Another term for alternative e.g. a The BCI fallback facility is another site/building that can be use when the original site/building is unusable or unavailable. FAMILY ASSISTANCE A one-stop-shop for survivors, ENISA CENTRES families, friends and all those affected by the emergency, through which they can access support, care and advice. FAULT A condition that causes a functional The Disaster unit to fail to perform the required Recovery Journal function. modified by ENISA FAULT TOLERANCE The ability of a service to continue The Disaster when a failure occurs. See Resilience Recovery Journal modified by ENISA FILE SHADOWING The asynchronous duplication of the The Disaster production database on separate Recovery Journal media to ensure data availability, modified by ENISA currency and accuracy FINANCIAL IMPACT An operating expense that continues The UK Financial following an interruption or disaster, Sector Continuity which as a result of the event cannot be offset by income and directly affects the financial position of the organisation FIRE MARSHALL A person responsible for ensuring that The BCI all employees, visitors and contractors evacuate a site/building FIRST LEVEL SUPPORT The technical and managerial ENISA resources within the Service Desk available at the initial point of contact

______________________________________________________________________ ENISA 309

Risk Management

Terminology Explanation Source

with the Customer/User FLOOR WARDEN Person responsible for ensuring that ENISA all employees, visitors and contractors evacuate a floor within a specific site FORTRESS APPROACH An approach to Business Continuity ENISA where the entire site is made as disaster-proof as possible FORWARD RECOVERY The process of recovering a database The Disaster to the point of failure by applying Recovery Journal active journal or log data to the modified by ENISA current backup files of the database FULL REHEARSAL An exercise that simulates a Business The BCI Continuity event where the organisation or some of its component parts are suspended until the exercise is completed FULL RELEASE A release that tests, distributes and The Disaster implements all components of a Recovery Journal release unit, regardless of whether or modified by ENISA not they have changed since the last release of the software FUNCTION The actions or intended purpose of a ENISA person, team or thing in a specific role. Service Management functions may be considered as key business activities, often with a broad scope and associated with a particular job, consisting of a collection of lower level activities. The characteristics of a function are that it is continuous and represents a defining aspect of the business enterprise. It is usually associated with more than one method and contributes to the execution of those processes. Rarely do (or should) functions mirror the organisational structure. GAP ANALYSIS A survey whose aim is to identify the The BCI differences between BCM/Crisis Management requirements (what the business says it needs at time of an incident) and what is in place and/or available GOLD TEAM Strategic decision makers and groups ENISA at the local level. They establish the framework within which operational and tactical managers work in responding to and recovering from emergencies. HAND-CARRIED BOMB Any type of portable bomb, usually NASP; National contained in a form that would blend Association Of easily with the target surroundings, Security for example, suitcases, handbags, Professionals briefcases, video cassette boxes

______________________________________________________________________ ENISA 310

Risk Management

Terminology Explanation Source

HARDENING The process of making something NASP; National more secure, resistant to attack, or Association Of less vulnerable Security Professionals HAZARD An accidental or naturally-occurring ENISA event or situation with the potential to cause physical (or psychological) harm to members of the community (including loss of life), damage or losses to property, and/or disruption to the environment or to structures (economic, social, political) upon which a community’s way of life depends HAZARD OR THREAT The process of identifying situations ENISA IDENTIFICATION or conditions that have the potential to cause injury to people, damage to property, or damage to the environment HEALTH AND SAFETY The process by which the well-being The BCI, modified by of all employees, contractors, visitors ENISA and the public is safeguarded. All Business Continuity Plans and planning must be cognisant of Health and Safety statutory and regulatory requirements and legislation. Health and Safety considerations should be reviewed during the Risk assessment. HIGH AVAILABILITY Systems or applications requiring a The Disaster very high level of reliability and Recovery Journal availability. High availability systems modified by ENISA typically operate 24x7 and usually require built-in redundancy to minimize the risk of downtime due to hardware and/or telecommunication failures. HIGH-RISK AREAS Areas identified during the Risk ENISA Assessment that are highly susceptible to a disaster situation or might be the cause of a significant disaster. HOT SITE An alternate facility that already has The BCI modified by in place the computer, ENISA telecommunications, and environmental infrastructure required to recover critical business functions or information systems HOT STANDBY A term that is normally reserved for The BCI Technology Recovery. An alternate means of processing that minimises downtime so that no loss of processing occurs. Usually involves the use of a standby system or site that is permanently connected to

______________________________________________________________________ ENISA 311

Risk Management

Terminology Explanation Source

business users and is often used to record transactions in tandem with the primary system. HOT An IT Service Continuity option - The BCI, modified by STANDBY/START/SITE either provided from within the ENISA (internal, external or organisation or by a 3rd party, mobile) possibly in a fixed place or mobile, consisting of a computer room with full environmental and telecommunications facilities plus the necessary hardware and software to enable the site to take over processing from the normal infrastructure with minimal disruption to services. See Immediate Recovery and Intermediate Recovery HOUSEKEEPING The method of maintaining The BCI procedures, systems, people and plans in a state of readiness HUMAN RESOURCES The department of an organisation ENISA responsible for the recruitment, employment and welfare of staff. Can also be known as Personnel HUMAN THREATS Possible disruptions in operations ENISA resulting from human actions (i.e. disgruntled employee, terrorism, blackmail, job actions, riots, etc.). ICT The department responsible for ENISA managing IT components within an organisation IED Improvised Explosive Device NASP; National Association of Security Professionals IMMEDIATE RECOVERY Broadly speaking, this Business ENISA Continuity option provides for the immediate recovery of services in a contingency situation. The instant availability of services distinguishes this option from what may be referred to as 'Hot Stand-by/Start', which typically will permit services to be recovered within 2 to 24 hours depending on the criticality of the business method they support. Depending on that business criticality, 'immediate' recovery may then vary from zero to 24 hours. See: Gradual Recovery and Intermediate Recovery IMMEDIATE RECOVERY The team with responsibility for ENISA TEAM implementing the Business Continuity Plan and formulating the organisations initial recovery strategy IMPACT A measure of the effect that an The Disaster

______________________________________________________________________ ENISA 312

Risk Management

Terminology Explanation Source

Incident, Problem or Change is having Recovery Journal or might have on the business being modified by ENISA provided with Business Continuity. Often equal to the extent to which agreed or expected levels of service may be distorted. Together with urgency, and perhaps technical security, it is the major means of assigning priority for dealing with Incidents, Problems or Changes. IMPACT ANALYSIS The identification of critical business ENISA processes and the potential damage or loss that may be caused to the organisation resulting from a disruption to those processes, or perhaps from a proposed change. Business impact analysis identifies the form the loss or damage will take; how that degree of damage or loss is likely to escalate with time following an Incident; the minimum staffing, facilities and services needed to enable business processes to continue to operate at a minimum acceptable level; and the time within which they should be recovered. The time within which full recovery of the business processes is to be achieved is also identified. INCIDENT Any event that is not part of the ITIL standard operation of a service and that causes, or may cause, an interruption to, or a reduction in, the quality of that service INCIDENT A sub-division of Classification, which ENISA CATEGORISATION provides a means of identifying -using a series of structured codes: firstly, what appears to have gone wrong with the IS Service (the symptoms); secondly why the failure occurred (cause); and thirdly the component likely to be at fault. The category codes are elements within the classification data string and are essential for fault analysis purposes. INCIDENT COMMAND Combination of facilities, equipment, ENISA SYSTEM (ICS) personnel, procedures, and communications operating within a common organisational structure with responsibility for the command, control, and coordination of assigned resources to effectively direct and control the response and recovery to an incident

______________________________________________________________________ ENISA 313

Risk Management

Terminology Explanation Source

INCIDENT MANAGEMENT The process by which an organisation The BCI responds to and controls an incident using emergency response procedures or plans INCIDENT MANAGEMENT A clearly defined and documented ENISA PLAN plan of action for use during an incident INCIDENT MANAGER Commands the local emergency ENISA operations centre (EOC) reporting up to senior management on the recovery progress. Has the authority to invoke the recovery plan. See Crisis Manager INCIDENT RESPONSE The response of an organisation to an ENISA incident that may significantly impact the organisation, its people, or its ability to function productively. Concentrates on the safety of personnel INCIDENT ROOM See: Command Centre ENISA

INFORMATION SECURITY Preservation of confidentiality, BS ISO/IEC 17799: integrity and availability of 2005 information. In addition, other properties, such as authenticity, accountability, non-repudiation, and reliability can be involved. INFORMATION Technology components (computer Pas 77 TECHNOLOGY (IT) systems, networks, applications, telecommunications, technical support and service desk) INFRASTRUCTURE The underlying foundation, basic ENISA framework, or interconnecting structural elements that support an organisation INHERENT RISK The possibility that some human The BCI modified by activity or natural event will have an ENISA adverse affect on the asset(s) of an organisation and which cannot be managed or transferred away INNER CORDON Surrounds and protects the ENISA immediate scene of an incident INTEGRATED EXERCISE An exercise conducted on multiple UK Financial Sector interrelated components of a Business Continuity Continuity Plan, typically under simulated operating conditions. Examples of interrelated components may include interdependent departments or interfaced systems.

______________________________________________________________________ ENISA 314

Risk Management

Terminology Explanation Source

INTERIM SITE A temporary location used to continue ENISA performing business functions after vacating a recovery site and before the original or new home site can be occupied. Moving to an interim site may be necessary if ongoing stay at the recovery site is not feasible for the period of time needed or if the recovery site is located far from the normal business site that was impacted by the disaster. An interim site move is planned and scheduled in advance to minimize disruption of business processes; equal care must be given to transferring critical functions from the interim site back to the normal business site. INTERNAL HOTSITE A fully equipped alternate processing ENISA site owned and operated by the organisation ISO 9000 Guidelines and assurances of method ISO and procedure standards for quality assurance systems IT Service Continuity The discipline which takes ITDR and The Disaster Management (ITSCM) aligns it with BC requirements to Recovery Journal provide a resilient IT service which modified by ENISA inherently supports BC by maintaining the RTO and reducing downtime. BS 25777. ITDR See Disaster Recovery ENISA ITIL Information Technology Infrastructure ITIL Library INVOCATION The act of declaring that an BS 25999-1 organisation’s Business Continuity plan needs to be put into effect in order to continue delivery of key products or services JOURNALLING The process of logging changes or ENISA updates to a database since the last full backup

______________________________________________________________________ ENISA 315

Risk Management

Terminology Explanation Source

KEY PERFORMANCE A measure (quantitative or UK Financial Sector INDICATOR qualitative) that enables the overall Continuity modified delivery of a service to be assessed by ENISA by both business and IS representatives. KPIs should be few in number and focus on the service's potential contribution to business success. To be effective in improving business performance, they must be linked to a strategic plan which details how the business intends to accomplish its vision and mission. The metrics selected must address all aspects of performance results, describe the targeted performance in measurable terms and be deployed to the organisational level that has the authority, resources and knowledge to take the necessary action. KEY BUSINESS ACTIVITY The critical operational and/or ENISA business support functions that could not be interrupted or made unavailable for less than a mandated or predetermined time-frame without significantly jeopardizing the organisation. These tasks identified within a Business Continuity Plan as a priority action typically to be carried out within the first few minutes/hours of the plan invocation. KNOWLEDGE BASE Data repository holding information ENISA on Incidents, Problems and Known Errors, enabling an organisation to match new Incidents against previous ones and thus to reuse established solutions and approaches LEAD TIME The time it takes for a supplier - The BCI either equipment or service - to make that equipment or service available. Business continuity plans should try to minimise this by agreeing Service Levels (Service Level Agreement) with the supplier in advance of a Business Continuity incident rather than relying on the supplier's best efforts. LIKELIHOOD The chance of something happening, BS 25999-1 whether defined, measured or estimated objectively or subjectively, or in terms of general descriptors (such as rare, unlikely, likely, almost certain), frequencies or mathematical probabilities LINE RE-ROUTING A short-term change in the routing of The BCI telephone traffic, which can be

______________________________________________________________________ ENISA 316

Risk Management

Terminology Explanation Source

planned and recurring, or a reaction to an outage situation LOGISTICS/ A team comprised of various The BCI TRANSPORTATION TEAM members representing departments associated with supply acquisition and material transportation, responsible for ensuring the most effective acquisition and mobilization of hardware, supplies, and support materials. This team is also responsible for transporting and supporting staff. LOSS Negative consequence BS 25999-1 LOSS ADJUSTER Designated position activated at the The BCI, modified by time of a Business Continuity event to ENISA assist in managing the financial implications of the event and should be involved as part of the management team where possible. LOSS REDUCTION The technique of instituting ENISA mechanisms to lessen the exposure to a particular risk LOST TRANSACTION Recovery of data (paper within the ENISA RECOVERY work area and/or system entries) destroyed or lost at the time of the disaster or interruption. Paper documents may need to be requested or re-acquired from original sources. Data for system entries may need to be recreated or re-entered LVBIED Large Vehicle-Borne Improvised NASP; National Explosive Device Association of Security Professionals MAJOR INCIDENT A UK Emergency Services definition. The BCI, modified by Any emergency that requires the ENISA implementation of special arrangements by one or more of the Emergency Services, National Health Service or a Local Authority. Many organisations will use this terminology internally for an incident which causes widespread operational disruption and is likely to involve the Emergency Services. MANAGEMENT SYSTEM The framework of processes and ENISA procedures used to ensure that the organisation can fulfil all tasks required to achieve its objectives MANUAL PROCEDURES An alternative process of working The BCI following a loss of IS systems. As working practices rely more and more on computerised activities, the ability of an organisation to fall back to

______________________________________________________________________ ENISA 317

Risk Management

Terminology Explanation Source

manual alternatives lessens. However, temporary measures and methods of working can help mitigate the impact of a Business Continuity incident and give staff a feeling of doing something. MARSHALLING AREA Area to which resources and The BCI personnel not immediately required at the scene or being held for further use can be directed to stand by MAXIMUM ACCEPTABLE The maximum period of time that HB 292-2006 OUTAGE (MAO) critical business processes can operated before the loss of critical resources affects their operations. See MTPD, MBCO MAXIMUM TOLERABLE The time after which disruption will The BCI PERIOD OF DISRUPTION become critical to the organisation or (MTPD) cause irrevocable damage. See MAO, MTPD METRIC Measurable element of a service, ENISA method or function. The real value of metrics is seen in their change over time. Reliance on a single metric is not advised, especially if it has the potential to affect User behaviour in an undesirable way. MINIMUM BUSINESS Minimum level of services and/or TR19: 2005 CONTINUITY OBJECTIVE products which is acceptable to the (MBCO) organisation to achieve its business objectives during an incident, emergency or disaster. MBCO is set by the executive management of the organisation and can be influenced, dictated and/or changed by current regulatory requirements or industry practice. See MTPD, MAO MIRRORED STANDBY A fully redundant facility with full, The Disaster SITE real-time information mirroring. Recovery Journal Mirrored sites are identical to the modified by ENISA primary site in all technical aspects. MISSION-CRITICAL The critical operational and/or The BCI ACTIVITIES business support activities (either provided internally or outsourced) required by the organisation to achieve its objective(s) i.e. services and/or products MISSION-CRITICAL Applications that support business The Disaster APPLICATION activities or processes that could not Recovery Journal be interrupted or unavailable for 24 modified by ENISA hours or less without significantly jeopardizing the organisation MITIGATION Limitation of any negative ENISA consequence of a particular event MOBILE RECOVERY A mobilized resource purchased or ENISA

______________________________________________________________________ ENISA 318

Risk Management

Terminology Explanation Source

contracted for the purpose of business recovery. The mobile recovery centre might include: computers, workstations, telephone, electrical power, etc. MOBILE STANDBY A transportable operating The BCI environment, usually complete with accommodation and equipment, which can be transported and set up at a suitable site at short notice MOBILE STANDBY SITE Self contained, transportable units ENISA which are custom fitted with specific telecommunications and IT equipment necessary to meet system requirements MOBILE STANDBY A transportable operating ENISA TRAILER environment, often a large trailer, that can be configured to specific recovery needs such as office facilities, call centres, data centres, etc. This can be contracted to be delivered and set up at a suitable site at short notice. MOBILISATION The activation of the recovery The BCI, modified by organisation in response to an ENISA emergency or disaster declaration. MOCK DISASTER One method of exercising teams in ENISA which participants are challenged to determine the actions they would take in the event of a specific disaster scenario. Mock disasters usually involve all, or most, of the applicable teams. Under the guidance of exercise coordinators, the teams walk through the actions they would take per their plans, or simulate performance of these actions. Teams may be at a single exercise location, or at multiple locations, with communication between teams simulating actual disaster mode communications. A mock disaster will typically operate on a compressed time-frame representing many hours, or even days. N + 1 A fault tolerant strategy that includes ENISA multiple systems or components protected by one backup system or component NATURAL THREATS Events caused by nature that have ENISA the potential to impact an organisation NETWORK OUTAGE An interruption of voice, data, or IP ENISA network communications

______________________________________________________________________ ENISA 319

Risk Management

Terminology Explanation Source

OFF-SITE LOCATION A site at a safe distance from the The BCI primary site where critical data (computerised or paper) and/ or equipment is stored from where it can be recovered and used at the time of a Business Continuity incident if original data, material or equipment is lost or unavailable OFF-SITE STORAGE Any place physically located a The BCI, modified by significant distance away from the ENISA primary site, where duplicated and vital records (hard copy or electronic and/or equipment) may be stored for use during recovery OPERATIONAL EXERCISE See Exercise ENISA OPERATIONAL IMPACT An impact which is not quantifiable in UK Financial Sector financial terms but whose effects may Continuity be among the most severe in determining the survival of an organisation following a disaster OPERATIONAL IMPACT The risk that deficiencies in ENISA ANALYSIS information systems or internal controls will result in unexpected loss. The risk is associated with human error, system failures and inadequate procedures and controls. OPERATIONAL RISK The risk of loss resulting from ENISA inadequate or failed procedures and controls OPERATIONAL TEST A test conducted on one or more ENISA components of a plan under actual operating conditions ORDERLY SHUTDOWN The actions required to rapidly and The Disaster gracefully suspend a business function Recovery Journal, and/or system during a disruptio modified by ENISA ORGANISATION A company, firm, association, group, The BCI, with enterprise, a corporate entity; a firm, modifications from an establishment, a public or HB 292-2006 government body, department or agency; a business or a charity or other legal entity or part thereof, whether incorporated or not, which has its own functions and administration

______________________________________________________________________ ENISA 320

Risk Management

Terminology Explanation Source

OUTAGE Period of time that a service, system, The BCI method or business function is expected to be unusable or inaccessible which has a high impact on the organisation, compromising the achievement of the organisation's business objectives. An outage is different to 'downtime' where method or system failures happen as a part of normal operations, and where the impact merely reduces the short-term effectiveness of processes OUTSOURCING The transfer of business functions to The BCI an independent (internal and/or external) supplier PEER REVIEW A review of a specific component of a plan by personnel (other than the owner or author) with appropriate technical or business knowledge for accuracy and completeness PERIOD OF TOLERANCE The period of time in which a The BCI Business Continuity incident can escalate to a potential disaster without undue impact to the organisation PIPELINES SAFETY UK Legislation on the management of The Health and REGULATIONS 1996 pipeline safety, using an integrated, Safety Executive goal-setting, risk-based approach (HSE) encompassing both onshore and offshore pipelines; includes the major accident prevention document, the arrangements for emergency plans and the transitional arrangements PLAN ADMINISTRATOR The individual responsible for ENISA documenting recovery activities and tracking recovery progress PLAN CURRENCY Business Continuity Plans must be The BCI maintained (housekeeping) to an adequate state. Measures of how upto-date BC and CMT plans are recorded. A good (recent) plan currency is vital if plans are to be reliable. PLAN MAINTENANCE The management process of keeping The BCI, modified by an organisation’s Business Continuity ENISA Management plans up to date and effective. Maintenance procedures are a part of this process for the review and update of the BC plans on a defined schedule. Maintenance procedures are a part of this process. PLANNING Descriptions of the types and scales ENISA ASSUMPTIONS of consequences for which organisations should be prepared to

______________________________________________________________________ ENISA 321

Risk Management

Terminology Explanation Source

respond POST IMPLEMENTATION One or more reviews held after the ENISA REVIEW implementation of a change to determine initially, if the change has been implemented successfully and subsequently, if the expected benefits have been obtained PRE-POSITIONAL Material (i.e. equipment, forms and The BCI RESOURCE supplies) stored at an off-site location to be used in business resumption and recovery operations (associated terms: pre-positioned inventory) PREVENTATIVE Measures put in place to lessen the The BCI MEASURES likelihood of a Business Continuity Incident PROBABILITY Extent to which an event is likely to ENISA occur. See likelihood PRIORITY Sequence in which an incident or ENISA problem needs to be resolved PRIORITISATION The ordering of key business activities ENISA and their dependencies are established during the BIA and Strategic-planning phase. The Business Continuity Plans will be implemented in the order necessary at the time of the event. PROBABILITY The measure of chance of occurrence HB 292-2006 expressed as a number PROCESS An organised set of tasks which uses ENISA resources to transform inputs to outputs PROCESS An individual held accountable and ENISA OWNER/MANAGER responsible for the workings and improvement of one of the organisations defined processes PROGRAM An organised list of instructions that, ENISA when executed, causes a computer to behave in a predetermined manner. Programs contain variables representing numeric data, text or graphical images and statements that instruct the computer what to do with variables. PROGRAMME A portfolio of projects and other ENISA activities that are planned; initiated and managed in a co-ordinated way in order to achieve a set of defined business objectives PROJECT A temporary organisation created for ENISA the purpose of delivering one or more business products according to a specified business case PROJECT MANAGEMENT The techniques and tools used to The BCI describe, control and deliver a series

______________________________________________________________________ ENISA 322

Risk Management

Terminology Explanation Source

of activities with given deliverables, time-frames and budgets PROTECTIVE SECURITY The safeguarding of physical and NASP; National personnel welfare or information Association of Security Professionals QUALITATIVE The process for evaluating a business The BCI, modified by ASSESSMENT function based on observations and ENISA does not involve measures or numbers. Instead, it uses descriptive categories such as customer service, regulatory requirements, etc to allow for refinement of the quantitative assessment. This is normally done during the BIA phase of planning. QUALITY ASSURANCE Confirming the degree of excellence ENISA of a product or service, measured against its defined purpose. This might involve a number of techniques. For documentation it might involve inviting informed comment; for software, a method of formal testing, trialling or inviting public feedback on a beta version; for hardware, performance against specified test; for management process, comparison with a standard such as BSI5000. QUANTIFICATION The objective measure of the The BCI seriousness of risk or impact, often measured in financial or regulatory terms QUANTITATIVE A form of assessment that analyses The BCI ASSESSMENT the actual numbers and values involved. This type of methodology typically applies mathematical and statistical techniques and modelling. QUICK SHIP See Drop Ship ENISA THE RADIATION Implemented in the UK, the articles The Health and (EMERGENCY on intervention in cases of radiation Safety Executive PREPAREDNESS AND (radiological) emergency in Council (HSE) PUBLIC INFORMATION) Directive 96/29/Euratom, also known REGULATIONS 2001 as the BS596 Directive. The Directive (REPPIR) lays down the basic safety standards for the protection of the health of workers and the general public against the dangers arising from ionising radiation. The REPPIR also partly implement the Public Information Directive by subsuming the Public Information for Radiation Emergencies Regulations 1992 (PIRER) on informing the general public about health protection

______________________________________________________________________ ENISA 323

Risk Management

Terminology Explanation Source

measures to be applied and steps to be taken in the event of an emergency. RDD Radiological Dispersion Device. NASP; National Commonly known as a "dirty bomb", Association of designed to disperse radioactive Security material, with or without explosives. Professionals RECIPROCAL Agreement between two organisations The Disaster AGREEMENT (or two internal business groups) with Recovery Journal, similar equipment/environment that modified by ENISA allows each one to recover at the others location RECOVERABLE LOSS Financial losses due to an event that The BCI may be reclaimed in the future, e.g. through insurance or litigation. This is normally identified in the Risk Assessment or BIA. RECOVERY Implementing the prioritised actions ENISA required to return the key business activities and support functions to operational stability following an interruption or disaster RECOVERY CENTRE Location or area that a business unit ENISA relocates to in order to recover their key business activities RECOVERY EXERCISE An announced or unannounced ENISA execution of Business Continuity Plans intended to implement existing plans and / or highlight the need for additional plan development RECOVERY A team of people, assembled in an ENISA MANAGEMENT TEAM emergency, who are charged with recovering an aspect of the enterprise, or obtaining the resources required for the recovery RECOVERY PERIOD The time period between a disaster ENISA and a return to normal functions, during which the disaster recovery plan is employed RECOVERY PLAN A plan to resume a specific essential ENISA operation, function or process of an enterprise RECOVERY POINT The point in time to which systems HB 292-2006 OBJECTIVE (RPO) and data must be recovered after an outage (e.g. end of previous day’s processing). RPOs are often used as the basis for the development of backup strategies and as a determinant of amount of data that may need to be recreated after the systems of functions have been recovered.

______________________________________________________________________ ENISA 324

Risk Management

Terminology Explanation Source

RECOVERY SERVICES A contract with an external ENISA AGREEMENT/CONTRACT organisation guaranteeing the provision of specified equipment, facilities, or services, usually within a specified time period, in the event of a business interruption RECOVERY SITE A designated site for the recovery of ENISA business unit, technology, or other operations, which are critical to the enterprise RECOVERY STRATEGY A pre-defined, pre-tested, ENISA management-approved course of action to be deployed in response to a business disruption, interruption or disaster RECOVERY TEAM A group of individuals given ENISA responsibility for the co-ordination and response to an emergency or for recovering a process or function in the event of a disaster RECOVERY TIME The period of time within which The BCI, modified by OBJECTIVE (RTO) systems, applications, or functions ENISA must be recovered after an outage (e.g. one business day) RECOVERY TIMELINE The sequence of recovery activities, The BCI, modified by or critical path, which must be ENISA followed to resume an acceptable level of operation following a business interruption. The time-line may range from minutes to weeks, depending upon the recovery requirements and methodology. RECOVERY WINDOW The time-scale within which time ENISA sensitive function or business units must be restored, usually determined by means of a Business Impact Analysis. REDUNDANCY Where a system has been designed to ENISA eliminate single points of failure RENDEZVOUS POINT Point to which all vehicles and ENISA resources arriving at the outer cordon are directed RESIDUAL RISK The level of uncontrolled risk The BCI, modified by remaining after all cost-effective ENISA actions have been taken to lessen the impact and probability of a specific risk or group of risks, subject to the organisations risk appetite RESILIENCE The ability of an organisation to The BCI absorb the impact of a business interruption, and continue to provide a minimum acceptable level of service RESOLUTION An action that will resolve an ENISA Incident, i.e. allow the users to carry

______________________________________________________________________ ENISA 325

Risk Management

Terminology Explanation Source

out their business functions. This may be a temporary workaround. RESOURCE The minimum level of resources which ENISA REQUIREMENTS are required by the critical processes to support the recovery activities. These could include personnel, premises, technology, equipment and materials. Where there is a difference between desired requirements and what can be supplied, it is identified in a Gap Analysis. RESPONSE The reaction to an incident or The BCI emergency to assess the damage or impact and to ascertain the level of containment and control activity required RESTART The procedure or procedures that The BCI return applications and data to a known start point. Application restart is dependent upon having an operable system. RESTORATION Process of planning for and/or ENISA implementing procedures for the repair of hardware, relocation of the primary site and its contents, and returning to normal operations at the permanent operational location RESUMPTION The process of planning for and/or The BCI, modified by implementing the restarting of ENISA defined business processes and operations following a disaster. This process commonly addresses the most critical business functions within BIA specified time-frames. RESIDUAL RISK Risk remaining after Risk Treatment ENISA RESUMPTION The phase of an incident which follows ENISA Business Continuity and restores the organisation’s operations to normal functioning RISK The chance of something happening HB 292-2006, that will have an impact upon modified by ENISA objectives. It is measured in terms of impact and likelihood. RISK ACCEPTANCE An informed decision to accept the ENISA consequences of likely events based on risk criteria RISK ANALYSIS Determination of the likelihood and ENISA, modified by impact of each risk occurring. Risk ENISA Analysis provides the basis for risk evaluation, risk treatment and risk acceptance RISK APPETITE Willingness of an organisation to The BCI, modified by accept a defined level of risk ENISA RISK ASSESSMENT / Process of identifying the risks to an ENISA

______________________________________________________________________ ENISA 326

Risk Management

Terminology Explanation Source

ANALYSIS (RA) organisation, assessing the critical functions necessary for an organisation to continue business operations, defining the controls in place to reduce organisation exposure and evaluating the cost for such controls RISK AVOIDANCE An informed decision not to become The BCI involved in a risk situation RISK CATEGORIES Risks of similar types are grouped The BCI, modified by together under key headings, ENISA otherwise known as risk categories RISK CONTROLS All methods of reducing the frequency ENISA and/or severity of losses including exposure avoidance, loss prevention, loss reduction, segregation of exposure units and non-insurance transfer of risk RISK ESTIMATION Process used to assign values to the ENISA probability and impact of a risk occurring RISK EVALUATION The process of determining the ISO/IEC Guide 73, significance of risk modified by ENISA RISK MANAGEMENT Structured ongoing development and BS 25999-1, (RM) application of management culture, modified by ENISA policy, procedures and practices to the tasks of identifying, analysing, evaluating and controlling the response to risk RISK MITIGATION Implementation of measures to deter The BCI modified by specific threats to the continuity of ENISA business operations, and/or respond to any occurrence of such threats in a timely and appropriate manner RISK PROFILE The combined result of impact and The BCI, modified by probability ENISA RISK REDUCTION OR The implementation of the The BCI modified by MITIGATION preventative measures which Risk ENISA Assessment has identified RISK REGISTER Tool that captures and describes risks ENISA (ORGANISATIONAL) as they are identified and their profile, together with risk ownership, actions where required, date when the risk was raised, review dates, dates when actions were completed and the date the risk was closed RISK REGISTER (IT) A Risk Register owned by ICT used to ENISA capture and describe IT related risks. Often the most critical will be escalated to the organisational Risk Register. RISK REGISTER A Risk Register owned by the ENISA (PROCESS) business process used to capture and describe process related risks. Often

______________________________________________________________________ ENISA 327

Risk Management

Terminology Explanation Source

the most critical will be escalated to the organisational Risk Register. RISK TRANSFER A common technique used by Risk The BCI modified by Managers to address or mitigate ENISA potential exposures of the organisation. A series of techniques describing the various means of addressing risk through insurance and similar products RISK TREATMENT A systematic process of deciding ENISA which risks can be eliminated or reduced by remedial action and which must be tolerated ROLL CALL The process of verifying that all The BCI employees, visitors and contractors have been safely evacuated and accounted for following an evacuation of a building or site SALVAGE and The act of performing a coordinated ENISA RESTORATION assessment to determine the appropriate actions to be performed on impacted assets. The assessment can be coordinated with insurance adjusters, facilities personnel, or other involved parties. Appropriate actions may include: disposal; replacement; reclamation; refurbishment; recovery, or receiving compensation for unrecoverable organisational assets. SCENARIO A pre-defined set of Business The BCI Continuity events and conditions that describe, for planning purposes, an interruption, disruption, or loss related to some aspect(s) of an organisation's business operations to support conducting a BIA, developing a continuity strategy, and developing continuity and exercise plans. SCOPE Generally, the extent to which a ENISA method or procedure applies. The scope of Configuration Management may not, for example, extend to Customer information (other than on an as informed basis) and the scope of a Change Management procedure may not apply to urgent changes. Also a key concept in outsourcing as it defines which activities are covered by the base contract and which are separately chargeable. SECOND LEVEL/LINE Technical resources (sometimes ENISA SUPPORT based within the Service Desk) called upon by Incident and Problem

______________________________________________________________________ ENISA 328

Risk Management

Terminology Explanation Source

Management to assist in the resolution of an Incident, restoration of service, identification of a Problem or Known Error, the provision of a work-around or the generation of a Change SECURITY All aspects relating to defining, ISO/IEC WD 15443achieving and maintaining data 1 confidentiality, integrity, availability, accountability, authenticity and reliability SECURITY REVIEW A periodic review of policies, The BCI procedures, and operational practices maintained by an organisation to ensure that they are followed and effective SELF INSURANCE The pre-planned assumption of risk in The BCI, modified by which a decision is made to bear loses ENISA that could result from a Business Continuity event rather than purchasing insurance to cover those potential losses SERVICE CATALOGUE The creation of a Service Catalogue ITIL (according to the ITIL Framework) is used as a starting point for the implementation of the Service Level Management process. A Service Catalogue lists all of the services which IT provides to the business. This catalogue should list the services from a user's perspective. SERVICE LEVEL A formal agreement between a The BCI AGREEMENT (SLA) service provider (whether internal or external) and their client (whether internal or external), which covers the nature, quality, availability, scope and response of the service provider. The SLA should cover day-to-day situations and disaster situations, as the need for the service may vary in a disaster. SERVICE LEVEL The process of defining, agreeing, ENISA MANAGEMENT (SLM) documenting and managing the levels of any type of services provided by service providers whether internal or external that are required and cost justified

______________________________________________________________________ ENISA 329

Risk Management

Terminology Explanation Source

SERVICE MANAGER A senior manager, normally reporting ENISA to the IS director, who has overall responsibility for ensuring services are delivered in accordance with agreed business requirements. The Service Manager is also responsible for negotiating requirements with senior business representatives. The Service Manager is responsible for the Service Management Team and is usually a member of the high level CAB. The Service Manager should have a major say in the allocation of resources between services. SERVICE RESUMPTION Restoring services to their Business- ENISA As-Usual state. Invoking BC may result in a temporary location or reduced level of personnel. It may also result in some business activities which are suspended. SILVER TEAM Tactical level of management ENISA introduced to provide overall management of the response. SIMULATION EXERCISE One method of exercising teams in ENISA which participants perform some or all of the actions they would take in the event of plan activation. Simulation exercises, which may involve one or more teams, are performed under conditions that at least partially simulate disaster mode. They may or may not be performed at the designated alternate location and typically use only a partial recovery configuration. SINGLE POINT OF The only (single) source of a service, The BCI FAILURE (SPOF) activity and/or method, i.e. there is no alternative, whose failure would lead to the total failure of a key business activity and/or dependency SITE ACCESS DENIAL Any disturbance or activity within the ENISA area surrounding the site which renders the site unavailable, e.g. fire, flood, riot, strike, loss of services, forensics. The site itself may be undamaged. SOCIAL IMPACT Any incident or happening that affects UK Financial Sector the well-being of a population and Continuity which is often not financially quantifiable STAKEHOLDERS All those who have an interest in an BS 25999-1 organisation, it's activities and it's achievements STAND DOWN Formal notification that the response The BCI

______________________________________________________________________ ENISA 330

Risk Management

Terminology Explanation Source

to a Business Continuity event is no longer required or has been concluded STANDALONE TEST A test conducted on a specific ENISA component of a plan in isolation from other components to validate component functionality, typically under simulated operating conditions STANDBY SERVICE The provision of the relevant recovery The BCI facilities, such as cold-site, warm-site, hot-site and mobile standby STATUTORY SERVICES Those services whose responsibilities The BCI are laid down by law e.g. Fire and Rescue Service, Coast Guard Service STRUCTURED Types of exercise in which team The BCI WALKTHROUGH members physically implement the Business Continuity Plans and verbally review each step to assess its effectiveness, identify enhancements, constraints and deficiencies SUPPLY CHAIN All suppliers, manufacturing facilities, ENISA distribution centres, warehouses, customers, raw materials, work-inprocess inventory, finished goods, and all related information and resources involved in meeting customer and organisational requirements SWITCHOVER Switchover is the capability to ENISA manually switch over from one system to a redundant or standby computer server, system, or network upon the failure or abnormal termination of the previously active server, system, or network. Switchover happens with human intervention, unlike Failover. SYNDICATION RATIO The number of times that Work Area The BCI, modified by Recovery Facility seats are sold by the ENISA third party providers. Occupation at the time of an incident is on a firstcomefirst-served basis. SYSTEM Set of related technology components The Disaster that work together to support a Recovery Journal, business process or provide a service. modified by ENISA SYSTEM DENIAL A failure of the computer system for a The BCI protracted period, which may impact an organisation’s ability to sustain its normal business activities SYSTEM RECOVERY The procedures for rebuilding a The BCI, modified by computer system and network to the ENISA condition where it is ready to accept data and applications, and facilitate network communications SYSTEM RESTORE The procedures necessary to return a The BCI, modified by

______________________________________________________________________ ENISA 331

Risk Management

Terminology Explanation Source

system to an operable state using all ENISA available data including data captured by alternate means during the outage TABLE TOP EXERCISE One method of exercising plans in The BCI modified by which participants review and discuss ENISA the actions they would take without actually performing the actions. Representatives of a single team, or multiple teams, may participate in the exercise typically under the guidance of exercise facilitators. TASK Generically, an activity or set of ENISA activities that might be defined as part of a process. When used within a phrase such as 'Standard Operational Task' it defines a well documented, controlled, proceduralised and, usually, low-risk activity. The procedure controlling the manner in which the task is carried out would be subject to formal Change Control. TASK LIST Defined mandatory and discretionary The BCI tasks allocated to teams and/or individual roles within a Business Continuity Plan TERMS OF REFERENCE A document that usually describes the ENISA purpose and scope of an activity or requirement TEST A pass/fail evaluation of infrastructure The BCI modified by (example-computers, cabling, ENISA devices, hardware) and\or physical plant infrastructure (example-building systems, generators, utilities) to demonstrate the anticipated operation of the components and system. A test can also be used to demonstrate whether all or parts of the Business Continuity Plan are fit for purpose. See Exercise TEST AUDITOR An appointed role that is assigned to ENISA assess whether the exercise aims/objectives are being met and to measure whether activities are occurring at the right time and involve the correct people to facilitate their achievement. See Exercise Auditor TEST The person who runs the test on the ENISA CONTROLLER/FACILITAT day in accordance with the Test OR Script. See Exercise Controller TEST PLAN A document which states the scope ENISA and objectives of the test, and the roles, responsibilities and criteria for success. See Exercise Plan

______________________________________________________________________ ENISA 332

Risk Management

Terminology Explanation Source

TEST CO-ORDINATOR The Test Co-ordinator is responsible ENISA for the mechanics of running the exercise. See Exercise Co-ordinator TEST OBSERVER An exercise observer has no active ENISA role within the exercise but is present for awareness and training purposes. An exercise observer might make recommendations for procedural improvements. See Exercise Observer TEST OWNER An appointed role that has total ENISA management oversight and control of the exercise and has the authority to alter the Exercise Plan. See Exercise Owner TEST REPORT A report which is written following a ENISA test, to discuss the outcomes of the test and recommendations for amendments and further work. See Exercise Report TEST SCRIPT A time-line for running the test. It ENISA details what activities should be occurring, the exact details of the activities, when they should occur and who is carrying out the activity. It will also state the criteria for success for each step. See Exercise Script THREAT A combination of the risk, the ENISA consequence of that risk, and the likelihood that the negative event will take place. THREE-TIERED Strategic, Tactical and Operational ENISA APPROACH incident management tiers. Also referred to as Gold, Silver and Bronze TOLERANCE THRESHOLD The maximum period of time for The BCI which the business can afford to be without a critical function or process TOP MANAGEMENT Person/s who direct and control and BS 25999-1 organisation. TRAUMA COUNSELLING The provisioning of counselling The BCI, modified by assistance by trained individuals to ENISA employees, customers and others who have suffered mental or physical injury as the result of an event TRAUMA MANAGEMENT The process of helping employees The BCI modified by deal with trauma in a systematic way ENISA following an event by proving trained counsellors, support systems, and coping strategies with the objective of restoring employees psychological well-being UNEXPECTED LOSS The worst-case financial loss or The BCI, modified by impact that a business could incur ENISA due to a particular loss event or risk.

______________________________________________________________________ ENISA 333

Risk Management

Terminology Explanation Source

The unexpected loss is calculated as the expected loss plus the potential adverse volatility in this value. UNINTERRUPTIBLE A backup electrical power supply that The BCI, modified by POWER SUPPLY (UPS) provides continuous power to critical ENISA equipment in the event that commercial power is lost. The UPS (usually a bank of batteries) offers short-term protection against power surges and outages. The UPS usually only allows enough time for vital systems to be correctly powered down. VALIDATION SCRIPT A set of procedures within the ENISA Business Continuity Plan to validate the proper function of a system or process before returning it to production operation VBIED Vehicle-Borne Improvised Explosive NASP; National Device. A car or van filled with Association of explosive, driven to a target and Security detonated. Professionals VENDOR An individual or company providing a ENISA service to a department or the organisation as a whole VIRUS An unauthorised programme that The BCI, modified by inserts itself into a computer system ENISA and then propagates itself to other computers via networks or disks VITAL RECORDS Records essential to the continued ENISA functioning or reconstitution of an organisation during and after an emergency and also those records essential to protecting the legal and financial rights of that organisation and of the individuals directly affected by its activities VOIED Victim Operated Improvised Explosive NASP; National Device or booby-trap bomb. Association of Security Professionals VOLUNTARY SECTOR Organisational bodies, other than ENISA public authorities or local authorities, that carry out activities other than for profit VULNERABILITY The existence of a weakness, or ITSEC design or implementation error that can lead to an unexpected undesirable event, compromising the security of the computer system, network, application, or protocol involved.

______________________________________________________________________ ENISA 334

Risk Management

Terminology Explanation Source

WARM (STANDBY) SITE Partially equipped office space which ENISA contains some or all of the system hardware, software, telecommunications and power sources. The site may need to be prepared before receiving the system and recovery personnel. See Work Area Recovery Facility WORK AREA RECOVERY An alternate processing site which is The BCI modified by FACILITY (WARF) equipped with some hardware and ENISA communications interfaces, and electrical and environmental conditioning which is only capable of providing backup after additional provisioning of software or customisation is performed WMD Weapons of Mass Destruction. WMD NASP; National encompasses nuclear, biological and Association of chemical weapons. Security Professionals WORK AREA STANDBY A permanent or transportable office ENISA environment, complete with appropriate office infrastructure WORK AROUND A process of avoiding an incident or ENISA problem, either by employing a temporary fix or technique that means a Customer is not reliant on a CI that is known to cause failure WORKAROUND Alternative procedures that may be ENISA PROCEDURES used by a functional unit(s) to enable it to continue to perform its critical functions during temporary unavailability of specific application systems, electronic or hard copy data, voice or data communication systems, specialized equipment, office facilities, personnel, or external services. Z-CARDS A patented format for publishing ENISA information, up to an A3-sized page can be folded down to credit card size. This size means it is convenient to carry and can be stored in pockets, handbags, etc.

______________________________________________________________________ ENISA 335