Chapter 12

Business Continuity Management

Section 17 of the ISO 27002:2013 is “Business Continuity Management.” The objective of the Business Continuity Management domain is to ensure the continued operation and secure provision of essential services during a disruption of normal operating conditions. To support this objective, threat scenarios are evaluated, essential services and processes are identified, and response, contingency, and recovery and resumption strategies, plans, and procedures are developed, tested, and maintained. Business continuity is a component of organization risk management.

We have learned valuable lessons from the events of September 11, 2001, Hurricane Katrina, the 2013 Boston bombing, and Hurricane Maria’s devastation in Puerto Rico. Preparation and business continuity plans do more than protect business assets; in the long run, they protect employees and their families, investors, business partners, and the community. Business continuity plans are, in essence, a civic duty.

Worldwide, a major disaster occurs almost daily. According to the Federal Emergency Management Agency (FEMA), a disaster has occurred, on average, every week in the United States for the past 10 years. The U.S. Department of Homeland Security (DHS) has identified the impact of 15 disaster scenarios that could take the country days (explosives) to weeks (food contamination) to months (pandemic, major hurricane) to years (nuclear detonation, major earthquake) to potentially recover from.

Preparing for a disaster can make the difference between life and death, success or failure, yet most businesses are not prepared. An Ad Council survey found that nearly two-thirds (62%) of respondents did not have an emergency plan in place for their business. When disaster inevitably strikes, without a plan, there is little chance of a successful response and recovery. The Insurance Information Institute reported that up to 40% of businesses affected by a natural or human-caused disaster never reopen.

The goal of emergency preparedness is to protect life and property. Disasters are unplanned; however, they should not be unanticipated. How much an organization should prepare depends on a number of factors, including risk tolerance, financial strength, regulatory requirements, and stakeholder impact. What we know for sure is that relying solely on insurance and post-disaster government assistance is shortsighted and, in some cases, negligent.

• Resilience begins with enterprise leadership setting the priorities, allocating the resources, and making the commitments to establish organizational resilience throughout the enterprise.

• A resilient culture is built on principles of organizational empowerment, purpose, trust, and accountability.

• People who are properly selected, motivated, equipped, and led will overcome almost any obstacle or disruption.

• Organizations achieve agility and flexibility by combining a highly distributed workplace model with a highly robust and collaborative IT infrastructure.

• Alternative workplace techniques such as office hoteling, telecommuting, and desk sharing provide the level of workplace flexibility and agility that is essential for mitigating the risk of catastrophic or disruptive incidents.

Congress recognized the issue as well and included emergency preparedness in critical sector regulatory legislation. The Health Insurance Portability and Accountability Act (HIPAA) Contingency Plan Standard 164.308(a)(7) requires covered entities to “Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information.” The standard includes implementation specifications for data backup, disaster recovery, and emergency mode operation plans. The Gramm-Leach-Bliley Safeguards Act requires financial institutions to “identify reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems” and to “take measures to protect against destruction, loss, or damage of customer information due to potential environmental hazards, such as fire and water damage or technological failures.” Similar legislation has been issued by the Federal Energy Regulatory Commission (FERC) for utility companies, by the Nuclear Energy Regulatory Commission (NERC) for nuclear power plants, by the Federal Communications Commission (FCC) for telecom carriers, and by the Food and Drug Administration (FDA) for pharmaceutical companies.

In October 2012, the Department of Homeland Security issued Federal Continuity Directive 1. The directive states that “Federal Executive Branch organizations, regardless of their size or location, shall have in place a viable continuity capability to ensure resiliency and continued performance of their organization’s essential functions under all conditions.” Included in the directive was a restatement of the government’s roles in creating public/private partnerships in order to create and sustain a “culture of continuity.”

In May 2012, NIST released Special Publication 800-34, R1: Contingency Planning Guide for Federal Information Systems, which provides guidance for federal agencies. The guidance is applicable to public and private sector business continuity planning.

• What type of disasters have occurred in the community or at this location?

• What can happen due to the geographic location?

• What could cause processes or information systems to fail?

• What threats are related to service provider dependency?

• What disasters could result from the design or construction of the facility or campus?

• What hazards are particular to the industry sector?

Identified threats are rated in terms of the likelihood of occurrence and potential impact sans controls. The higher the rating, the more significant the threat. The challenge to this approach is the unexpected event. Sadly, as we saw on 9/11, threats are not always predictable. Table 12-1 presents threat assessments that take into account past occurrences.

In a best-case scenario, the residual risk is within organizational tolerance. If the residual risk is not within tolerance, the organization must decide to take action to lower the risk level, approve the risk, or share the risk. Table 12-2 illustrates risk assessment considerations for the specific threat of a wildfire. The actual process and calculations used should mirror the organizational risk assessment methodology.

Lowering the risk level requires the organization to implement additional controls and safeguards and/or to modify existing ones. In general, preventative or mitigating controls that deter, detect, and/or reduce disruption and impact are preferable to contingency procedures or recovery activities. As new technologies become available, preventative controls should be reevaluated and recovery strategies modified. The widespread adoption of virtualization as a preventative control is a good example of how technological innovation can influence business continuity planning.

Approving the risk implies that the organization is willing to assume the level of risk even though it is not within an acceptable range. As we discussed in Chapter 4, approving elevated or severe risk level is an executive-level decision. The decision may be based on cost, market conditions, external pressures, or a willingness to play the odds.

Risk sharing is when the risk (and consequences) are distributed among two or more parties. Examples are outsourcing and insurance.

A business impact analysis is a multistep collaborative activity that should include business process owners, stakeholders, and corporate officers. This multistep collaborative activity is illustrated in Figure 12-2.

As noted in the previous steps, the BIA process incorporates three metrics:

• The maximum tolerable downtime (MTD) is the total length of time an essential business function can be unavailable without causing significant harm to the business.

• The recovery time objective (RTO) is the maximum amount of time a system resource can be unavailable before there is an unacceptable impact on other system resources or business processes.

• The recovery point objective (RPO) represents the point in time, prior to a disruption or system outage, that data can be recovered (in other words, the acceptable data loss).

In a perfect world, every essential system would be either redundant or available for immediate or near-time recovery. In reality, no organization has unlimited financial resources. The MTD, RTO, and RPO are useful in determining the optimum recovery investment and ancillary plans.

The outcome of a business impact analysis is a prioritized matrix of services, the required infrastructure, information systems, and dependencies for each service, recovery objectives, assessment of capabilities, and delta between the current and desired state. This information is then used by executive management to make investment decisions and to guide the development of disaster recovery and business contingency plans and procedures. Assuming an organization rated “Customer Communications” as an essential business process or service, Table 12-3 illustrates the components of a BIA.

Executive management is expected to provide leadership, demonstrate commitment, allocate budget, and devote resources to the development and continued upkeep of the BCP. In an emergency, they declare a disaster, activate the plan, and support the Business Continuity Team.

• The IT department is responsible for designing and supporting resilience systems and for the recovery of information and information systems in a disaster situation.

• Department managers are responsible for defining the operational needs of their department and for creating and maintaining functional departmental contingency procedures.

• The HR department is responsible for the communication with and welfare of personnel and provides emergency-related services and assistance.

• The marketing or communications department is responsible for crafting and releasing official statements, communicating with the media, and managing internal communication include updates.

• The purchasing department is responsible for expediently ordering necessary supplies and equipment.

• The training department is responsible for delivering business continuity–related training and ancillary materials.

• The internal audit department audits the BCP and procedures and reports its findings to executive management. The audit satisfies the best practice requirements of separation of duties and oversight.

1. Protecting the health and safety of employees, customers, first responders, and the public at large.

2. Minimizing damage to property and the environment.

3. Evaluating the situation and determining next steps.

The response plan should define the organizational structure, roles, and responsibilities, designated command and control, communications, and alternate work sites. Ancillary to the disaster response plan is the occupant emergency plan and procedures for immediate personnel safety. This plan is maintained separately because it may be used in nondisaster situations.

For decisions pertaining to the response, continuity, and recovery effort, the BCT is generally the authoritative body. Because this is a departure from normal operating conditions, it is critical that executive management publicly support the authority of the BCT and that employees know who is in charge.

The business continuity response plan must assign responsibility for both internal and external communications and include instructions for using a variety of communications channels. To prevent miscommunication, a designated communications liaison and spokespersons should be appointed. All public statements should be authorized by the BCT. Employees should be instructed that all media requests and questions be referred to the designated spokesperson without comment (on or off the record). The widespread use of social media is both a blessing and a curse. Social media can be used to quickly disseminate information and misinformation. Particularly in an evolving situation, employees may not have all the facts and/or may inadvertently disclose confidential information; they should be strongly discouraged from posting any information about the event on personal social media accounts.

• A hot site is a location that is fully operational and ready to move into; it has been configured with redundant hardware, software, and communications capability. Data has been replicated to the hot site on a real-time or near-time basis. Figure 12-3 shows an example of a hot site.

  

  FIGURE 12-3 A Hot Site Example

• A warm site is an environmentally conditioned workspace that is partially equipped with information systems and telecommunications equipment to support relocated operations. Computers and devices located at warm sites need to be configured and brought online. Data needs to be restored. Figure 12-4 shows an example of a warm site.

  

  FIGURE 12-4 A Warm Site Example

• A cold site is a backup facility that has power, HVAC, and secure access. There is no staged equipment.

• Mobile sites are self-contained units. The units are provided by a third party and generally arrive equipped with the required hardware, software, and peripherals. Data needs to be restored.

• A mirrored site is fully redundant with real-time replication from the production site. Mirrored sites can assume processing with virtually no interruption.

• A reciprocal site is based on an agreement to have access to/use of another organization’s facilities.

In addition to the previous options, it may be possible to offload operations to service bureaus or outsource operations to third parties.

• Physical access to facilities at a maximum-security prison is regulated by a biometric fingerprint access control system. The access control system is managed and monitored by an information system. The back-end information system becomes unavailable due to power loss. The business contingency procedure would address an alternate method to lock and unlock doors. This may be a physical key or perhaps an access code. In either case, knowing where the key is or what the code is would be essential to operations.

• A financial institution offers its customers the option of telephone banking services. Due to a fire, the telebanking phone system is not operational. Contingency procedures would address rerouting telebanking calls to customer service and ensuring that the customer service representatives (CSRs) could service the customers or at the very least provide information while the telebanking system is being recovered.

• A federal agency is forced to vacate its premises due to a biochemical threat. The agency receives and processes unemployment claims. Its most critical task is producing unemployment checks based on the claims. Unemployed individuals depend on receiving these payments in a timely manner. Business contingency procedures address alternate methods to accept and process claims as well as to print and distribute checks. Procedures may include notifying recipients by phone that payments are delayed, estimating payments based on the previous week’s claims, and/or coordinating with another agency for processing and postal services.

Operational contingency plans and procedures are developed at the departmental level. They are the responsibility of the business process owner.

Developing recovery plans and procedures can be a daunting task. A proven successful approach is to break the plan down into categories and assign responsibilities at the operational level, such as mainframe, network, communications, infrastructure, and facilities.

• Mainframe recovery is specific to the restoration of a mainframe computer (or equivalent capability) and corresponding data processing.

• Network recovery is specific to information systems (servers, workstations, mobile devices, applications, data stores, and supporting utilities) and includes the restoration of functionality and data.

• Communications recovery encompasses internal and external transmission systems, including local-area network (LAN), wide-area network (WAN), data circuits (T1, T3, MPLS), and Internet connectivity. Included in this category are connectivity devices such as switches, routers, firewalls, and IDSs.

• Infrastructure recovery encompasses those systems providing a general operating environment, including environmental and physical controls.

• Facilities recovery addresses the need to rebuild, renovate, or relocate the physical plant.

The criticality and priority determined by the business impact analysis provides the framework for choosing the appropriate strategy and level of investment.

The key to disaster recovery is the ability to respond using validated, maintained, and tested procedures. All recovery procedures should be reviewed annually. Planning for recovery is a component of the systems development life cycle (SDLC) process.

Validation is the process of verifying that recovered systems are operating correctly and that data integrity has been confirmed. Validation should be the final step of every recovery procedure.

Deactivation is the official notification that the organization is no longer operating in emergency or disaster mode. At this point, the BCT relinquishes authority, and normal operating procedures are reinstated. After the dust settles, figuratively and literally, an after-action report with lessons learned should be documented by the BCT. The BCP should be reviewed and revised based on the findings and recommendations of the BCT.

In addition to procedures being tested, the BCP should be audited. At a minimum, testing exercises and audits should be conducted annually. The results of both should be provided to the Board of Directors.

• A structured review focuses on a specific procedure or set of procedures. Representatives from each functional area participate in a systematic walkthrough of the procedures with the goal of verifying accuracy and completeness. A structured review can also be used as a training exercise with the objective of familiarization.

• A tabletop simulation focuses on participant readiness. A facilitator presents a scenario and asks the exercise participants’ questions related to the scenario, including decisions to be made, procedures to use, roles, responsibilities, time frames, and expectations. A tabletop exercise is discussion-based only and does not involve deploying equipment or other resources.

Functional exercises allow personnel to validate plans, procedures, resource availability, and participant readiness. Functional exercises are scenario-driven and limited in scope, such as the failure of a critical business function or a specific hazard scenario. Functional exercises can be conducted in either a parallel or production environment.

Full-scale testing is conducted at the enterprise level. Based on a specific scenario, the business operates as if a disaster was declared. Normal operations are suspended. Recovery and contingency plans and procedures are implemented. Full-scale testing can be expensive and risky. It is, however, the most accurate test of plans and procedures.

• Is there a written business continuity policy and plan?

• Has the business continuity policy and plan been approved by the Board of Directors?

• How often is it reviewed and/or reauthorized?

• How often is a BIA conducted? By whom?

• Who is on the BCT?

• What training have they had?

• What training has the user community had?

• Is there a written test plan?

• How often is the plan tested?

• Are the results documented?

• If third parties are involved, what is the process for testing/verifying their procedures?

• Who is responsible for maintaining the plan?

As with all examinations and audits, independence must be maintained. Examiners and auditors must not be connected to the management or maintenance of related policies, plans, procedures, training, or testing.

A resilient organization is one that has the ability to quickly adapt and recover from known or unknown changes to the environment. The objective of business continuity planning is to ensure that organizations have the capability to respond to and recover from disaster situations. Response plans focus on the initial and near-term response and include such elements as authority, plan activation, notification, communication, evacuation, relocation, coordination with public authorities, and security. Contingency plans focus on immediate, near-term, and short-term alternate workforce and business processes. Recovery plans focus on the immediate, near-term, and short-term recovery of information systems, infrastructure, and facilities. Resumption plans guide the organization back to normalcy. Taken as a whole, this is referred to as the business continuity plan (BCP) or as the continuity of operations plan (COOP). The discipline is referred to as business continuity management.

The precursor to developing a BCP is assessing the threat environment and organizational risk as well as determining essential business services and processes. A business continuity threat assessment identifies viable threats and predicts the likelihood of occurrence. Threat modeling takes into account historical and predictive geographic, technological, physical, environmental, third-party, and industry factors.

A business continuity risk assessment evaluates the sufficiency of controls to prevent the threat from occurring or to minimize its impact. A business impact assessment (BIA) identifies essential services/processes and recovery time frames. In BCP, essential means that the absence of, or disruption of, a service/process would result in significant, irrecoverable, or irreparable harm to the organization, employees, business partners, constituents, community, or country. The BIA process uses three prioritization metrics: MTD, recovery time objectives (RTOs), and recovery point objectives (RPOs). The MTD is the total length of time an essential business function can be unavailable without causing significant harm to the business. The RTO is the maximum amount of time a system resource can be unavailable before there is an unacceptable impact on other system resources or business process. The RPO represents the point in time, prior to a disruption or system outage, that data can be recovered; in other words, the acceptable data loss.

Business continuity management is a distributed responsibility. The Board of Directors or organizational equivalent is ultimately accountable for ensuring that the organization is prepared. It is the responsibility of executive management to ensure that threats are evaluated, impact to business processes recognized, and resources allocated. They are also charged with declaring a disaster and activating the BCP. The BCT, appointed by executive management, is expected to manage preparation and be the authoritative body in a declared disaster.

A BCP should be maintained in a state of readiness, which includes having personnel trained to fulfill their roles and responsibilities within the plan, having plans exercised to validate their content, and having systems and system components tested and audited to ensure their operability. The plan in its entirety should be reviewed on a scheduled basis. It should be reauthorized annually by the Board of Directors or organizational equivalent.

Business Continuity Management policies include Emergency Preparedness, Business Impact Assessment, Business Continuity Management, Emergency Response Plan, Operational Contingency Plan, Disaster Recovery Plan, and Business Continuity Testing and Maintenance.

A. Assurance

B. Availability

C. Accounting

D. Authentication

2. Which of the following statements best describes a disaster?

A. A disaster is a planned activity.

B. A disaster is an isolated incident.

C. A disaster is a significant disruption of normal business functions.

D. A disaster is a change in management structure.

3. Flood, fire, and wind are examples of which type of threat?

A. Malicious act

B. Environmental

C. Logistical

D. Technical

4. Which of the following terms best describes the process of identifying viable threats and likelihood of occurrence?

A. Risk assessment

B. Threat assessment

C. Likelihood assessment

D. Impact assessment

5. Which of the following terms best describes the process of evaluating the sufficiency of controls?

A. Risk assessment

B. Threat assessment

C. Likelihood assessment

D. Impact assessment

6. Which of the following statements best describes the outcome of a BIA?

A. A BIA generates RTOs.

B. A BIA produces an organizational agreement on essential processes and services.

C. A BIA identifies the gap between current and desired recovery capabilities.

D. All of the above

7. An acceptable length of time a business function or process can be unavailable is known as _________________.

A. maximum unavailability (MU)

B. total acceptable time (TAT)

C. maximum tolerable downtime (MTD)

D. recovery time objective (RTO)

8. The recovery point objective (RPO) represents ____________.

A. acceptable data loss

B. acceptable processing time loss

C. acceptable downtime

D. None of the above

9. Recovery time objectives relate to which of the following?

A. The maximum amount of time a guest system can be unavailable

B. The maximum amount of time a system resource can be unavailable

C. The minimum amount of time a system resource can be unavailable

D. None of the above

10. Which of the following plans are included in a BCP?

A. Resumption plans

B. Response plans

C. Contingency plans

D. All of the above

11. Legal and regulatory accountability for an organization’s preparedness is assigned to _______________.

A. the BCT

B. regulators

C. the Board of Directors or organizational equivalent

D. service providers

12. The authority to declare an emergency and activate the plan is owned by ____________.

A. the BCT

B. executive management

C. the Board of Directors or organizational equivalent

D. service providers

13. Which of the following plans include evacuation and in-shelter procedures?

A. The fire drill plan

B. The occupant emergency plan

C. The business contingency plan

D. A FEMA directive

14. A __________ site is a backup facility that has power, HVAC, and secure access.

A. hot

B. cold

C. replica

D. mirror

15. ___________ are self-contained units. The units are provided by a third-party and generally arrive equipped with the required hardware, software, and peripherals. Data need to be restored.

A. Mobile sites

B. Hot sites

C. Cold sites

D. Mirrored sites

16. A _________ site is fully redundant with real-time replication from the production site.

A. mirrored

B. hot

C. cold

D. replica

17. A _______ site is based on a agreement to have access to/use of another organization’s facilities

A. mirrored

B. hot

C. cold

D. reciprocal

1. Listed here are various disruptions in banking service. Assign each event a rating of 1–5 (1 is the lowest, 5 is the highest) that best represents the impact on you (as the customer), and provide an explanation of your rating. Consider each event independently.

   1. ATM system unavailable, branches open.

   2. Closest local branch closed, others open.

   3. Internet banking unavailable, branches open.

   4. Core processing system unavailable, deposits accepted, withdrawals less than $100, other account information unavailable.

   5. Communications capabilities between branches disrupted, tellers work in offline mode.

2. Listed here are the same disruptions in banking service. Assign each event a rating of 1–5 (1 is the lowest, 5 is the highest) that best represents the impact on the bank from a financial, operational, legal, or regulatory perspective, and provide an explanation. Consider each event independently.

   1. ATM system unavailable, branches open.

   2. Closest local branch closed, others open.

   3. Internet banking unavailable, branches open.

   4. Core processing system unavailable, deposits accepted, withdrawals less than $100, other account information unavailable.

   5. Communications capabilities between branches disrupted, tellers work in offline mode.

3. Describe how business continuity planners should reconcile the differences in impact upon a business and its customers.

1. Identify the sections related to preparation, response, contingency, recovery, resumption, testing, and maintenance. Is anything missing?

2. Identify roles and responsibilities referenced in the plan.

3. Critique the plan in terms of clarity and ease of use.

1. How do IaaS and PaaS impact business continuity planning?

2. Have any of the cloud service providers (such as Google, Amazon, Rackspace, Savvis) experienced any major outages that would impact their customers?

3. Assuming an organization used the services of a cloud provider for business continuity services, explain the type of response, recovery, and continuity testing they could/should conduct.

“HIPAA Security Rule,” official website of the Department of Health and Human Services, accessed 06/2018, https://www.hhs.gov/hipaa/for-professionals/security/index.html.

“Presidential Decision Directive 63, Critical Infrastructure Protection,” official website of the Government Printing Office, accessed 06/2018, https://www.gpo.gov/fdsys/granule/FR-1998-08-05/98-20865.

“Presidential Directive HSPD-7, Critical Infrastructure Identification, Prioritization, and Protection,” official website of the Department of Homeland Security, accessed 06/2018, https://www.dhs.gov/homeland-security-presidential-directive-7.

“Hurricane Maria News, Graphics, and Social Media”, accessed 06/2018, https://www.fema.gov/disaster/updates/hurricane-maria-news-graphics-and-social-media.

“Puerto Ricans Organize on Social Media to Send Aid Back Home,” accessed 06/2018, www.nola.com/hurricane/index.ssf/2017/09/puerto_rico_help_new_orleans_m.html.

“Business Testimonials: Aeneas,” FEMA Ready, accessed 06/2018, https://www.ready.gov/business/business-testimonials.

“Emergency Preparedness,” official website of the SBA, accessed 06/2018, https://www.sba.gov/business-guide/manage/prepare-emergencies-disaster-assistance.