Topics in this domain
- Event vs Incident vs Breach
- Developing the Incident Response Plan
- Incident Response Team Roles and Authority
- Incident Classification and Severity Levels
- Incident Response Playbooks and Decision Trees
- Escalation and Communication Plans
- Business Impact Analysis
- RTO, RPO, MTD and Recovery Prioritisation
- Business Continuity Planning and Strategies
- Crisis Management and Continuity Governance
- Disaster Recovery Planning
- Recovery Sites: Hot, Warm and Cold
- Backup Strategies and Cloud DR
- Incident Response Training
- Testing Plans: Tabletop, Functional and Full Interruption
- Evaluating Exercises and Improving Readiness
- Security Event Detection and Monitoring Methods
- SIEM, the SOC and Event Correlation
- Threat Intelligence and Indicators of Compromise
- Incident Triage and Initial Investigation
- Evidence Preservation, Forensics and Chain of Custody
- Containment Strategies: Short-Term and Long-Term
- Making Containment Decisions
- Breach Notification and Regulatory Reporting
- External Communications: Customers, Media and Law Enforcement
- Eradication, Recovery and Return to Normal Operations
- Post-Incident Review and Root Cause Analysis
- Lessons Learned and Incident Trend Analysis
Business Continuity Planning and Strategies
Keeping the business running
Business continuity planning (BCP) keeps critical business processes running, or resumes them quickly, after a disruption: a fire, a pandemic, a ransomware attack, a supplier collapse. Disaster recovery (DR) is the part that restores IT systems and data. The BCP is a named topic in CISM’s incident management readiness, and it must align with the incident response plan and DRP.
The BCP life cycle
- Policy and scope, with management commitment.
- Business impact analysis: critical processes and recovery objectives. This comes first after commitment.
- Risk assessment: what could disrupt them.
- Strategy: options that meet the objectives at acceptable cost.
- Plan development.
- Training and awareness.
- Testing.
- Maintenance, after changes, tests and incidents.
ISO 22301 is the international standard for business continuity management systems.
Continuity strategies
| Loss of… | Strategies |
|---|---|
| Site | Work from home, alternate office, shared or reciprocal space |
| IT | Manual workarounds, DR to an alternate site or cloud, reduced service levels |
| People | Cross-training, documented procedures, deputies and succession |
| Supplier | Alternate suppliers, stockpiles, continuity clauses in contracts |
What the plan contains
- activation criteria and who can declare a disruption
- roles, teams and deputies
- procedures for critical processes, including manual workarounds
- contact lists: staff, suppliers, customers, authorities
- the resources needed and where to find them
- how to return to normal operations
Copies are kept where they can be reached when systems are down.
Example. A logistics firm loses its main warehouse system for two days. Its BCP switches dispatch to printed pick lists and phone orders (a manual workaround), moves customer service staff to work from home (site), and routes urgent deliveries through a partner’s depot (supplier). Revenue dips, but no customer order is lost.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| First step after management commitment | The business impact analysis |
| Who is accountable for continuity? | Senior management |
| BCP vs DRP | BCP: business processes. DRP: IT systems and data |
| Standard for business continuity management | ISO 22301 |
| Most important ongoing activity | Testing and maintenance |
In short
- Business continuity planning (BCP) keeps critical business processes running, or resumes them, after a disruption; DR focuses on restoring IT.
- The BCP life cycle: policy and scope, BIA, risk assessment, strategy, plan development, training, testing and maintenance.
- Strategies cover loss of site, IT, people and suppliers, chosen to meet the BIA's objectives at acceptable cost.
- Senior management is accountable for continuity; process owners own their recovery requirements.
- The BCP aligns with the incident response plan and DRP, with shared triggers and contacts.
- ISO 22301 is the international standard for business continuity management systems.
Exam traps
- BCP isn't just IT recovery; people, sites, processes and suppliers count too.
- The first step after management commitment is the BIA, not choosing a recovery site.
- A plan that's never tested gives little assurance.
- Plans stored only on systems that may be down are useless; keep copies accessible offline.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Keeping the business running
The BCP life cycle
Continuity strategies