Cissp: Business Continuity Planning

Front 1

Business continuity plan

Back 1

A BCP is designed to mitigate the impact of a disaster by ensuring that critical business operations continue. It outlines methods and procedures for keeping critical applications, data, and services available during a disaster. For example, it may include running systems in a different mode and in a different environment until normal conditions are restored

Front 2

Disaster recovery plan

Back 2

A DRP outlines how to restore the normal operational state of an enterprise within the minimum possible time, including the required process, personnel, and resources. It focuses on the recovery of IT systems, rather than on business operations or activities

Front 3

project initation

Back 3

Phase in the development of the BCP:
gaining support from senior management
defining the project scope
defining a timeline for the project, and
developing a company policy for implementing the plan

Front 4

Emergency notification list

Back 4

Created in the first month. This is called a _____________

Front 5

Backup vital records

Back 5

Done in first six months of BCP.

Front 6

Business Impact Analysis

Back 6

identifies the essential functions of the business and the capacity of departments or units in the organization to manage and recover from a disaster. The sequence and priorities of the essential functions are assessed and resources needed for recovery are identified.

Front 7

6 months

Back 7

A BIA should be created within ___

Front 8

develop strategy

Back 8

Done in 6-9 months of BCP

Front 9

select an appropriate alternative site

Back 9

Done in 9-12 months of BCP

Front 10

develop contingency plan

Back 10

Done at end of first 12 months of BCP

Front 11

tested, maintained, and audited

Back 11

You need to put in place a plan to ensure that the BCP is regularly ________ (3 things)

Front 12

NFPA 1600

Back 12

In the USA, Title IX of the Implementing the 9/11 Commission Recommendations Act of 2007 recommends that organizations assess their ability to recover from disasters by comparing their BCPs and DRPs to a standard. What standard did the act recommend?

Front 13

NFPA 1600

Back 13

defines several professional practice areas, each with guidelines that form a basis for business continuity and disaster recovery planning.

Front 14

Federal Financial Institutions Examination Council

Back 14

Gave booklet on business continuity planning specifies that a financial institution's BCP should focus on resuming and maintaining business operations, rather than just on recovering technology, and that the planning process should occur across the enterprise. It states that the foundation of a good BCP includes a thorough business impact analysis – or BIA – and risk assessment, and that the BCP should be tested and audited independently

Front 15

NASD Rule 3510

Back 15

requires members of the Securities and Exchange Commission – or SEC – to create and maintain BCPs that meet specific requirements. For example, a member's BCP must enable the continued operation of mission-critical systems and assure customers' prompt access to their funds
and securities. It must identify alternative methods for communication between customers, employees, and the organization that can be implemented in the event of a disaster.

Front 16

NYSE Rule 446

Back 16

requires that members of the Securities and Exchange Commission – or SEC – have written BCPs and conduct yearly reviews of these plans

Front 17

prioritize systems in terms of their criticality

Back 17

1st goal in BIA

Front 18

estimate maximum acceptable downtimes

Back 18

2nd goal in BIA

Front 19

determine resource requirements

Back 19

3rd goal in BIA

Front 20

recovery time objective

Back 20

The relative importance of recovering each application depends on whether it supports a business-critical function and on the maximum amount of time the business can operate without that application. This is also known as the _______ for an application.

Front 21

emergency response team

Back 21

The following are responsibilities of what/whom?
retrieval of backups
Team members are responsible for retrieving required records and information from the organization's off-site storage facility.
procedure execution
Team members execute the planned business continuity or recovery procedures that are assigned to them, based on the predetermined priority of each task.
Examples of tasks include traveling to alternative sites of operations, assigning team members to shifts, and re-establishing support functions that have been disrupted.
communication, and
Team members must establish communications with staff at an alternative site and keep command centers up to date with the recovery status. This includes informing the emergency management team of any major or urgent issues for which management support is required.
assisting in primary site restoration
Team members support the work being done to restore normal operations at the primary site. This includes making lists of the software, hardware, and other equipment that must be replaced at the primary site.

Front 22

company executives

Back 22

lead the organization through an emergency and hold the overall responsibility for its recovery. They're responsible for anticipating, rather than just reacting to, problems and for long-term – rather than just immediate – recovery. They have a broad focus and prioritize the organization's strategy and principles, rather than following established processes.

Front 23

emergency response team

Back 23

handles the tactical response to an event. It initially assesses the damage caused by an event, declares the event a disaster if necessary, and sets emergency plans in motion. It then administers and manages the day-to-day activities of the recovery.

Front 24

primary site restoration team

Back 24

responsible for preparing the original site to resume normal business operations. It's also responsible for helping the organization transition back into normal operations at this site.
Usually this team includes facilities and technology staff, potentially with support from legal staff and insurance agents

Front 25

primary site restoration team

Back 25

The following are responsibilities of what/whom?
contacting the organization's lawyer or legal team
contacting the organization's insurance agent, if relevant
taking pictures of any damaged areas as soon as possible, before items are removed, repaired, or replaced
acquiring, building, or renovating the site to physically prepare it for resumption of normal operations
recovering lost or damaged information and records, and
replacing or repairing damaged technology components, such as computer hardware and network infrastructure