Example Business Continuity Plan

Example Business Continuity Plan

Based upon DS4.2 from COBIT (Control Objectives for Information Technology)

Prepared by: Micheal Axelsen FCPA[1]

Director, Applied Insight Pty Ltd

Provided as is, without warranty, for businesses to consider as a very early starting point in the preparation of a business continuity plan. This work is based upon material delivered to University business students.

Question One: Research Issue – Personal Data Protection

Assume a fire has destroyed your bedroom. Identify the items in your room that would be irreplaceable if this scenario eventuated. Draw up a business continuity plan for your bedroom and yourself.

Identify what you would need to do to ensure that irreplaceable items are better protected in the future. Identify the steps you would need to take immediately after the fire to recover from this disaster.

Worked Solution

Note that in COBIT 4.1, regarding the IT aspects we would need to identify an IT continuity plan. Firstly, we need to understand our business requirements – what our key business functions and processes are (DS4.2).

So, the business continuity plan draws upon our risk management framework (for argument’s sake, AS/NZS 4360:2004):

• Identify key business functions and processes.
• Identify ‘major’ disruption by reference to risk appetite
  
  Consider what the definitions of economic loss might be that are insignificant, minor, moderate, major, or catastrophic (e.g. catastrophic might be $1,000,000 whilst insignificant might be $500).
• Identify potential business impacts
• What actions can be taken to address requirements for:
• Resilience (reduce likelihood or consequence of the risk)
• Alternative processing (work-arounds in the event access is denied)
• Recovery capability of critical IT services (recovery of critical IT services)
• Identify usage guidelines, roles and responsibilities, procedures, communication processes, and the testing approach

1

A rough approach might look like this:

Business Continuity Plan

Risk Appetite: The business has determined that it can withstand a $3,000 level of disruption.

Assumptions: Catastrophic events (e.g. fire, flood) would result in similar business impacts. Actions to reduce impact will work equally as well for low-impact events (e.g. localised flooding, loss of internet connection).

Note: Some things are deliberately missing – who can spot something?

• Marketing website material (two websites, and and supporting collateral

• Current marketing plan

• Methodologies and client outputs

1. Use SyncBack for each laptop daily – files are stored in three places (PMD, Dell, HP).
2. Daily backup from Dell to external USB using MS Backup & Sync (monthly resets to keep disk space low).
3. Monthly backup of entire system to a third 500gb pocket media drive kept at separate office 5 km away.

• Precedents and models

• Templates

• Research Notes

• MYOB Accounting System

• Access to email

• Task list

• Mobile telephone

• VOIP phone

• Accounting records (Paper)

• Bookmarks

• Critical passwords

• Suncorp Token Key

• Dell Laptop (15”) (approximately $3K)

• HP Laptop Mini-Note 2133 (approximately $1K)

• HP Scanjet bubblejet printer

• Pocketmedia Drive

• External USB HDD (WD)

• Broadband connection

• CD Media (to reinstall software)

1

[1]Micheal may be contacted on 0412 526 375 or .