NIST Continuity Planning Guide

Personnel Safety is highest priority Understand the organization - Zachman Poster

Software escrow used to protect 1. Develop the continuity planning statement
investment in outsourced company Other
2. Conduct the business impact analysis - BIA
Salvage Team Business
Protect from looting Recovery Continuity 3. Identify preventative controls
Steps 4. Develop recovery strategies
5. Develop the contingency plan
6. Test the plan and conduct training and exercises
Full, Differential, Incremental
7. Maintain the plan
Disk duplexing
Electronic Vaulting
Backup
Tape Vaulting
Insurance 1. Select individuals to interview for data gathering

Service Bureaus 2. Create data-gathering techniques

3. Identify company's critical business functions
4. Identify resources these functions depend upon

BIA Steps 5. Calculate how long these functions can

At least once a year survive without these resources
- Maximum Tolerable Downtime - MTD
Checklist Test Business Continuity
and 6. Identify vulnerabilities and threats to these functions
Structured Walk-Through Test Testing and
Simulation Test Revising the Plan Disaster Recovery 7. Calculate the risk for each different business function
Mike Smith 8. Document findings and report to management
Parallel Test 26/04/10 - Rev.25

Full-Interruption Test

Fully configured
File and print services
Initiation Phase
Applications are installed
Activation Phase Hot site Workstations kept up to date
Recovery Phase Business Continuity Plan Available but expensive
Reconstruction Phase Security must be duplicated

Appendices Facility with power and HVAC

Facility File and print services may not have workstations

Recovery Warm site External communications should be installed
More time to get up and running but lower cost
Nonessential - 30 days
Facility with power and HVAC
Normal - 7 days Maximum No computer hardware on site
Tolerable Cold site
Important - 72 hours Communications not ready
Downtime
Urgent - 24 hours - MTD Least cost but false sense of security, most common

Critical - Minutes to Hours Multiple Sites / Rolling hot site

Reciprocal Agreements