Re: framework/checklist for considering drp/bcp

Posted by Timothy Cousins (24.151.17.54) on July 11, 2001 at 20:58:24:

In Reply to: Re: framework/checklist for considering drp/bcp posted by Philip Jan Rothstein, FBCI on July 11, 2001 at 16:43:04:

: : Posted by hs tan on April 24, 2000 at 05:01:29:

: : Disaster Recovery Planning is becoming increasingly complex and costly. From a traditional mainframe focus it has now branched to include heterogeneous systems such as Unix, AS/400, HP and PC/LAN systems. Management sees DRP or the more widely used term BCP as only for insurance in case of disaster where even the occurrence is likely to be remote.

: : Question :

: : 1. How to draw the line where BCP is necessary ?
: : 2. What are the main considerations in deciding
: : whether any application/system merits DRP/BCP ?
: : 3. Is there any framework or guideline out there
: : where reference can be made or advice obtained ?

: : The main issue here is - how to contain cost and at the
: : same time ensure the organisation can survive with a
: : BCP ?

: : Would appreciate very much any comments on the matter.

: : Thank you.

:
: - - - - - -

: 1. In my opinion BCP is ALWAYS necessary - the only question is the degree of investment which is relevant and appropriate.

: 2. The main considerations in deciding whether any application/system merits DRP/BCP is the Business Impact Assessment process - a structured, objective analysis of business priorities and exposure to loss from disruption.

: Often, elaborate business continuity programs are not necessary for specific business functions or areas, where the exposure to loss is minimal.

: 3. Even where the probability of a disruptive event is negligible, it should never be assumed the probiability is zero.

: You're not alone in wanting "...to contain cost and at the
: same time ensure the organisation can survive with a
: BCP." My advice would be:

: 1. Look for mitigation as well as recovery strategies which apply to a broad variety of potential threats and vulnerabilities

: 2. Invest in prevention at least as much as in recovery

: 3. Exercise rigorously. View exercises as a means to validate the recovery capabilities, i.e., to prove your investments are going to pay off.

: - Philip Jan Rothstein, FBCI

- - - - - - -

Posted by Timothy Cousins on February 18, 2001 at 06:04:08:

Anything is sometime better than nothing.
My 10 years experience operating on the post loss side of things reveals a number of truths that appear to pop up over and over again.

1: That companies that plan do better in a disaster recovery situation than those that do not.
2: The plan very rarely responds adequately.
3: The intelligence is not with the plan but with the people who understand the plan.
4: If the people in the recovery effort have been working towards a goal, such as a recovery/continuity plan, then they have progressed past the forming, storming and norming part of the group process and are ready for work when the chips are down - a good head start on resolving the problems.
5: No plan can cover/guess or plan for the time taken to investigate the nature and extent of damage. Many of the recovery situations I have been involved with include borderline areas. i.e. Contamination of computer systems but smoke, water and gas fire suppression systems. If you elect to declare a disaster, your Insurers may not support you and will certainly question every dollar spent.
TimC.

Follow Ups:

searching for the friends john 15:54:43 11/03/04 (0)

Post a Followup

Name:
E-Mail:

Subject:

Comments:
: : : Posted by hs tan on April 24, 2000 at 05:01:29: : : : Disaster Recovery Planning is becoming increasingly complex and costly. From a traditional mainframe focus it has now branched to include heterogeneous systems such as Unix, AS/400, HP and PC/LAN systems. Management sees DRP or the more widely used term BCP as only for insurance in case of disaster where even the occurrence is likely to be remote. : : : Question : : : : 1. How to draw the line where BCP is necessary ? : : : 2. What are the main considerations in deciding : : : whether any application/system merits DRP/BCP ? : : : 3. Is there any framework or guideline out there : : : where reference can be made or advice obtained ? : : : The main issue here is - how to contain cost and at the : : : same time ensure the organisation can survive with a : : : BCP ? : : : Would appreciate very much any comments on the matter. : : : Thank you. : : : : - - - - - - : : 1. In my opinion BCP is ALWAYS necessary - the only question is the degree of investment which is relevant and appropriate. : : 2. The main considerations in deciding whether any application/system merits DRP/BCP is the Business Impact Assessment process - a structured, objective analysis of business priorities and exposure to loss from disruption. : : Often, elaborate business continuity programs are not necessary for specific business functions or areas, where the exposure to loss is minimal. : : 3. Even where the probability of a disruptive event is negligible, it should never be assumed the probiability is zero. : : You're not alone in wanting "...to contain cost and at the : : same time ensure the organisation can survive with a : : BCP." My advice would be: : : 1. Look for mitigation as well as recovery strategies which apply to a broad variety of potential threats and vulnerabilities : : 2. Invest in prevention at least as much as in recovery : : 3. Exercise rigorously. View exercises as a means to validate the recovery capabilities, i.e., to prove your investments are going to pay off. : : - Philip Jan Rothstein, FBCI : : - - - - - - - : Posted by Timothy Cousins on February 18, 2001 at 06:04:08: : Anything is sometime better than nothing. : My 10 years experience operating on the post loss side of things reveals a number of truths that appear to pop up over and over again. : 1: That companies that plan do better in a disaster recovery situation than those that do not. : 2: The plan very rarely responds adequately. : 3: The intelligence is not with the plan but with the people who understand the plan. : 4: If the people in the recovery effort have been working towards a goal, such as a recovery/continuity plan, then they have progressed past the forming, storming and norming part of the group process and are ready for work when the chips are down - a good head start on resolving the problems. : 5: No plan can cover/guess or plan for the time taken to investigate the nature and extent of damage. Many of the recovery situations I have been involved with include borderline areas. i.e. Contamination of computer systems but smoke, water and gas fire suppression systems. If you elect to declare a disaster, your Insurers may not support you and will certainly question every dollar spent. : TimC.

Enter these letters (required):

Optional Link URL:
Link Title:
Optional Image URL:

[ Follow Ups ] [ Post Followup ] [ Rothstein Associates Inc. Disaster Recovery Forum ] [ FAQ ]

"Keep Me Posted"

Business Survival Newsletter

Rothstein Associates, Inc. is a BBB Accredited Business. Click for the BBB Business Review of this Financial Planning Consultants in Brookfield CT

E-mail Rothstein Associates Inc.