1 PURPOSE

Business Continuity Strategy

Business Continuity Strategy

  1. To identify the business continuity strategy for each individual Business Unit.
  2. To identify BCM arrangement that will enable BCM Institute to recover its critical activities within the recovery time objectives.

2 SCOPE

  1. This area of BCM examines the possible strategies for maintaining the operation of critical business functions. It covers pre-incident preparedness, response and recovery.
  2. This procedure is applied to the conduct of the Business Continuity Strategy phase.
  3. This procedure is applied to the Organization BCM Coordinator and Business Unit (BU) BCM Coordinator.

3 RESPONSIBILITY

  1. It is the Business Unit BCM Coordinator responsibility to know what the strategy to be adopted for each critical business functions within the business unit.
  2. It is the BCM Steering Committee’s responsibility to review and approve findings and recommendations of the proposed BCM strategies. The BCM Steering Committee is also involved in the formulation of the organisational business continuity strategy based on probable disasters and CBFs.
  3. The BCM Steering Committee should deliberate on the recovery strategies for various CBFs and formulate an organisational business continuity strategy for its BCM based on the selected disaster scenarios(s), MBCO and CBFs.
  4. The committee should also consolidate recovery requirements based on the organizational business continuity strategy into contract specifications.

4 PROCEDURE

  1. Team Members: Identify who are the team members .
  2. Functions: Identify the functions that need to be carried out.
  3. Pre-Crisis: Before a crisis, identify the action steps that need to be carried out.
  4. Recovery: Within T+X hours (recovery), identify the action steps that need to be carried out.
  5. Resumption: After T+X hours (resumption), identify the action steps that need to be carried out.
  6. Restoration: During restoration, identify the functions that need to be carried out and explain procedures.
  7. Grab List: Come up with a Grab List
    • This is for easy identification of important documents or software that the company requires in order to continue its business operations.

5 PROCESS (KEY STEPS)

5.1 Identify Probable Strategies

For risks faced by the critical business functions, probable strategies can be formulated from one or a combination of the following generic strategies:
Revert to an alternate processing capability
Arrange reciprocal arrangements
Establish alternate site or business facility
Arrange for alternate source of supply
Outsource to external vendor(s)
Transfer of operation(s) to subsidiary business units
Rebuild from scratch after disaster
Do not take any action
A set of guidelines should be established to guide the decision making process for the above strategy formulation. For example, outsourcing vendors should have a pre-determined number of years of experience and must possess valid certification of its services.
5.2 Evaluate Strategies:
The potential strategies available for each CBF should be evaluated. THe evaluation criteria for each potential strategy should include:
Costs to implement the strategy
Availability of alternate strategies
Costs of alternate strategies
Ease of implementing strategies
Comparison of the time needed to re-establish the CBF by the strategy and alternate strategies
Potential security breaches or control lapses due to the atypical measures associated with the strategy
Long term costs to maintain the strategy
5.3 Select Strategy:
The selection of the recovery strategy to support the Minimum Business Continuity Objectives (MBCO) and Critical Business Functions (CBFs) includes the following considerations:
Skills set required by supporting staff
Technology and equipment
Facilities
Offsite storage and alternate site(s)
Alternate processing capabilities
5.3.1 Alternate Processing Facilities
The selected strategy may require alternate processing capability to be established. Deliberation on the facilities used to support alternate processing shall include the following considerations:
Acquisitions
Mutual Agreement
Outsource to external vendors
Manual workarounds
5.3.2 Outsourcing to External Vendors
An organization may choose to outsource alternate processing facilities for its operations to external vendors. The criteria to guide the selection process of such vendors shall be established. Examples of selection criteria include location and capacity of vendor facilities.

5.4 Resources used to carry out critical function during a crisis:
5.4.1 Using the same numbers and names as on the previous sheets, put the quantity or “Y” for “Yes” /“N” for “No” in the relative boxes for resources required to carry out critical functions during daily routine. Do not leave any blanks. Please use “-” if not applicable.
5.4.2 For telephones (Tel) and PCs, state the minimum number required and any unique software to perform the critical functions.
6 DEFINITIONS[edit]

5.1 Business Unit BCM Coordinator
5.2 Grab List
5.3 Business Continuity Strategy
7 RELATED DOCUMENT[edit]

6.1 Selection Criteria for Alternate Site
6.2 Selection criteria for Workarea
6.3 Selection Criteria: Cost Versus Recovery Time Objectives (RTO)
8 RECORDS[edit]

8.1 BCM Institute’s Business Continuity Management (BCM) applies to the business and support units, mainly:
BIT: Business and IT
CE: Certification and Examination
FIN: Finance (out of scope for Certification Audit)
HRA: HR/Admin
PA: Programme Administration
SA: Sales
9 APPENDICES[edit]

8.1 Please refer to BCS Template in BCS Report.