Chapter 6 - Domain 6: Business Continuity and Disaster Recovery Planning

Abstract

This chapter provides a basic understanding of the overall approach to major phases of BCP/DRP prior to delving into the details of each phase. Business Continuity Planning and Disaster Recovery Planning (BCP/DRP) together have emerged as a critical domain in the common body of knowledge. BCP/DRP is an organization's last line of defense. When all other controls have failed, it is the final control that may prevent drastic events such as injury, loss of life, or failure of an organization. The BCP is an umbrella for multiple specific plans; the most important is the DRP. The DRP serves as a subset of the BCP, which would be doomed to fail if it did not contain a tactical method for immediately dealing with the disruption of information systems. To ensure that all planning is considered, the BCP/DRP has a specific set of requirements to review and implement. The Business Impact Analysis (BIA) is the formal method for determining how a disruption to the organization's IT system(s) will affect the organization's requirements, processes, and interdependencies with respect to the business mission. Testing, training, and awareness must be in place during the “disaster” portion of a BCP/DRP. Skipping them is one of the most common BCP/DRP mistakes. Once the initial BCP/DRP plan is completed, tested, trained, and implemented;it must be kept up to date. Business and IT systems change quickly, and IT professionals are accustomed to adapting. BCP/DRP plans must keep pace with all critical business and IT changes. Given the patchwork of overlapping terms and processes used by various BCP/DRP frameworks, this chapter also focuses on universal best practices. Mapping risk to key business processes can result in preventive risk measures taken in advance of any disaster, which may avoid future disasters entirely.