CBCP业务连续性管理专家培训材料_Area4.ppt

1,Subject Area,Business Continuity Management Course for Advanced Professionals Introduction,2,Subject Area 4： Developing Business Continuity Strategies,3,Lesson Overview,Understand available strategies Identify viable strategies for organizational support services and for each functional area Consolidate strategies across the organization Understand RFPs and contractual agreements,4,Professional Practices for Business Continuity Professionals,Project Initiation and Management Risk Evaluation and Control Business Impact Analysis Developing Business Continuity Strategies Emergency Response and Operations Developing and Implementing Business Continuity Plans Awareness and Training Programs Maintaining and Exercising Business Continuity Plans Crisis Communications Coordination with External Agencies,5,Objectives,Determine and guide the selection of alternative business recovery operating strategies for recovery of business and information technologies within the recovery time objective, while maintaining the organizations critical functions.,6,The Professionals Role (1/2),Understand Available Alternatives and Their Advantages, Disadvantages, and Cost Ranges, including mitigation as a recovery strategy Identify Viable Recovery Strategies within Business Functional Areas Consolidate Strategies Identify Off-Site Requirements and Alternative Facilities,7,The Professionals Role (2/2),Develop Business Unit Strategies Obtain Commitment from Management for Developed Strategies,8,Terms & Definitions - Business Continuity Strategy,Continuity Strategy An approach by an organization that will ensure its recovery and continuity in the face of a disaster or other major outage. Plans and methodologies are determined by the organizations strategy. There may be more than one solution to fulfill an organizations strategy. Examples: Internal or external hot-site, or cold-site, Alternate Work Area reciprocal agreement, Mobile Recovery, Quick Ship / Drop Ship, Consortium-based solutions, etc.,9,Objective of Strategies,The importance of developing strategies Protects viability of organization Helps to plan for the continuity, recovery, and resumption of operations Reduces or mitigates exposures, confusion, and chaos Positions organization to respond to an emergency Ensures employees understand their role (safety),10,Objective of strategies,Validates business recovery issues Timeframes for recovery and continuity Location (s) for continuity/ recovery and resumption Communications needs during & after disaster Acquire the resources and supplies necessary to enact the strategies Ensuring the organization can meet its RTO,11,Terms,Continuity Strategy Strategies that improve the organizations capability to respond to events in order to continue operations Off-site server that can be switched to immediately if on-site server is not available, Recovery Strategy Strategies that improve the organizations capability to return to stable operations following an event Off-site facility available to bring back up files to for restarting business operations,12,Strategy Development,Determine business requirements and priorities Business Impact Analysis Requirements gathering Identify potential alternative strategies Compile cost, advantages and disadvantages Objective assessment of the strategies Conduce cost/ benefit analysis Leverage strategies across organization,13,Strategy Development,Identify shared service and functional area strategy requirements Develop preliminary strategy Identify and evaluate internal alternatives within the organization With other business units Identify and evaluate external alternatives Existing capabilities and sources Develop new capabilities and sources,14,Strategy Development,Document and track the implementation of procedural and /or operational changes to accomplish the strategy Conduct cost/benefit analysis Track open risk issues,15,Strategy Development,Strategy considerations Resources and time to implement strategy Identify alternate locations Time constraints ate alternate location Validate with the owner Build consensus across business units Present to management,16,Shared Service Strategies,Strategies for recovering the organization Organizational resource providers,Facilities Finance Corporate Safety Audit Legal Public Relations,Human Resources Purchasing Administrative Services Mailroom IT Corporate Communications,17,Shared Service Strategies,Physical plant infrastructure Shared organizational services Technical infrastructure Should allow for the responsive recovery of critical functions and services Should meet organization-wide support requirements for recovery of mission critical services,18,Shared Service Strategies,Organizational-level strategies Should be consolidated and standardized across the organization Policies and procedures understood by all Crisis communications procedures Emergency response procedures,19,Share Service Strategies,Coordination of technology recovery and business continuity Continuation of mission critical business functions Recovery of technologies to support critical and important business functions Resumption of critical and important business functions after systems recovery,20,Functional Area Strategies,Build consensus Manage gaps,Functional Area Need,4-8 hours,72 hours,Shared Service Strategy,GAP!,21,Identify Functional Area Strategic Requirements,Identify business unit / functional area continuity/ recovery tasks Identify business unit recovery time objectives Prioritize objectives Determine business unit interdependencies Identify business unit subject matter experts Select team leaders by recovery function,22,Identify Functional Area Strategic Requirements,Review continuity/ recovery issues for each support area Personnel Customers Vendors Regulatory agencies Vital records Facilities reconstruction Risk management and insurance,23,Identify Functional Area Strategic Requirements,Review technology issues for each support area Main- frame Mid-range Local area networks Distributed databases Network accessibility Processing capabilities Review non-technology issues for each support area Compare internal and external solutions,Operating systems Databases Processing capability,24,Strategy Options,Do nothing Defer action to time of disaster Commence recovery and resumption plans after disaster strikes Manual procedures Business functions completed without automation,25,Strategy Options,Internal strategies Service degradation Reciprocal/ Cooperative agreements Commercial recovery services Business recovery centers Outsourcing Service bureau Quick ship/ Hardware vendors Facility recovery,26,Consolidate Strategies,Critical business functions Priorities Interdependencies (from BIA) Preparations and prior plans Designate, staff, and provide access to essential equipment resources for work area recovery sites May choose to restore to a portion of original capacity,27,Assess Strategy Requirements,Category 1 High Criticality Extremely Time Sensitive Vital Records IT Voice & Data Immediate Strategy Development!,Category 2 Important Some Time Flexibility Manufacturing Safety Product Stocks Secondary Strategy Development Category 3 May be deferrable Human Resources Corporate Training,28,Assess Strategies,Conduct cost/benefit analysis Track open risk issues Build consensus across business units Steering Committee reviews alternatives,29,Assess Strategies,Analyze business needs criteria Continuity of mission critical functions Continuity of functions driven by external factors Maintain strategic and competitive advantages Maintain profitability and viability to survive Maintain customer loyalty and industry image Any other issues and concerns that have been identified,30,Assess Strategies,Define continuity / recovery planning objectives Critical business functions, priorities, and interdependencies Time to restore continuity of mission critical business functions Time to recover information and communications systems Time to restore functional capability to resume business,31,Assess Strategies,Develop consistent methods for evaluation Assess reliability of strategies Cost effectiveness of strategies Compare internal and external solutions Assess risk for each recovery strategy,32,Assess Strategies,33,Assess Commercial Recovery Strategies,Summary of the 5 different sites,34,Cost/Benefit Analysis, ,0 2 4 6 8 24 48 72,Speed of Recovery in Hours,35,Cost/ Benefit Analysis,36,Cost/Benefit Analysis,Minutes,6 to 8 Hours,24 Hours,48 Hours,Weeks,Months,Efforts & Cost,Zero Date Loss Requirement,Remote CPU&/DB Mirroring,Shadow Data Base,Remote DASD Mirroring,Hot Site/Remote Tape/Channel Extension,Hot Site/Electronic Remote Journaling,Hot Site/Operating System Store/Edit,Hot Site/Electronic Vaulting,Hot Site,Cold Site,Repair Site,37,Cost/Benefit Analysis,Time,Time to recover,Outage Duration,Recovery Cost Balancing,Costs,Max Tolerable Loss,Recovery Budget,Backup/ Restore,Cost to Recover,Cost of Disruption,High Availability,Cost/Time Window,38,Request for Proposal You will get what you ask for! The RFP is the gauge for establishing a relationship with a recovery vendor. The contract of this relationship is specified by the vendors ability to assess and service corporate requirements,39,Request for Proposal,Clarify assumptions and review existing documentation Develop questionnaire/interview guide Select vendors Who are the industry forerunners? Do they support the systems you need to recover?,40,Request for Proposal,Document distribution Site tours RFP