Risk Management

Strategic Choices are important. You have a Business Impact Analysis (BIA). You have a Risk Analysis (RA). Is now already the time to create a Business Continuity Plan (BCP)? The short answer is "no." Based on the BIA and the RA, one makes the strategic choices. These are decisions of principle by management to indicate the direction in which they want to see solutions worked on. This is not without consequences, and often comes at a cost.In this post, I offer my own opinion, not that of any organization.Author: Manu Steens Take your time and make basic considerations Taking time to review the options for different strategies ensures that You see the advantages and disadvantages of the usual measures. Choose well-founded, robust and well-considered measures. You can choose the best cost-benefit tools and measures tailored to your situation. Also consider the following when making choices: Personnel safety is top priority. Talk to the people on the crisis management team (CMT) and crisis communications team (CCT) and don't decide without considering their opinions. Have strategic choices ratified by the highest in rank. Also consider the impact, not the events. Group a number of events together to create more flexible plans. For example, fire, flood, bomb threats, anthrax letters may trigger a "lack of building access." Then you can use it in whole or in part in multiple situations, or even in combination with other scenarios. But what exactly are strategic choices? What can one choose? What are the strategic choices For each problem situation in your BIA and RA, you have to make a decision what to do about it. De facto, there are six possible strategies: Do nothing Get insurance Move the process via outsourcing Reduce risk Create a BCP A combination of some of the above options Each of the five basic options has advantages and disadvantages. I provide some of them here: Basic optionbenefitsconsdo nothing - accept the risk and the possibility of the process grinding to a haltcheapeasyprocess can stopbreach of trust, damage to reputationtake insurancerelatively easythe money can offsetprocess has no immediate go-aroundcan be expensivebreach of trust, damage to reputationmove the process via outsourcingplaces the risk and liability on another personprocess is not protected if a risk occurs to that other personReduce risk - take measures that act on probability and impactcan be cost-effective and cost-efficientmay favor other responsibilitiescan be expensivemay require people and resourcescreate a BCP - take steps to perform the process elsewhere or in a different waycontinuity in a flexible mannermay require new / different measures. The final decision is a weighing of costs versus benefits, versus the cost of doing nothing. And this decision, fortunately, you don't have to make alone. Ultimately, you have to consult those people whose subject matter is in their daily area of expertise. The cost is not always financial. It can be money, but also lives, trust, reputation, loss of suppliers, loss of opportunities.... What do you need to make strategic choices for? The strategies resulting from the BIA and RA may involve: (non-exhaustive list) PeopleEveryone should know that personnel safety comes first. Everyone should know what to do and where to get their instructions Job rotation so you can take over from a colleague ... Land and buildingsRecovery locations internal to the organization or externalTeleworkUse of competitorDisaster recovery site available ... SuppliersProvide a reserve stockDemand continuity from your supplierCan he easily deliver at an alternate location?Get to know his peers ... InformationEnsure confidentiality, integrity and availability of data. Consider media other than digital. ... TechnologyHandle the fail-safe principleProvide fail-over at machinesAlign machine RTOs with maintenance SLAs.Make sure backups do not suffer from the same threat.Ensure remote access. ... ReputationProvide effective and efficient communication to all parties, and manage them. ... ... Some examples of strategic measures: Strategic optionDescription strategic optionBCPPlans to determine what to do during outages of these processes/businesses. This also includes emergency communications.Cold SiteThis is a site that is available and suitable to take over ICT, typically the server room, but she needs time to switch to among other things because of yet to start up.Data Backups LocationThis is where data backups are kept. It is segregated from the data storage location. Make sure that a threat to the primary data is not easily a threat to the backups.Hot SiteThis is a site that is ready and waiting for use by ICT at any time of day or night. Switching to this site can be done immediately and is basically seamless.Multiple SitesHaving more than one location/site is sometimes a geographically advantageous business. The key here is to organize the sites so that they can take over each other's overload or tasks as needed.Reciprocal arrangementsThese are agreements where two processes or activities/organizations agree to exchange resources according to needs and what is possible, if one of them is in a situation where it is needed. Both parties agree to reduce or shut down their activities. This when the other party's processes have been damaged or interrupted, with the aim of providing the necessary resources.Recovery locationThis is a location intended and designed as a place where a specific process is restarted. This can be in-house or within the perimeter of another organization.TelecommutingProviding the opportunity for employees to work at a location other than the office. Often this is home-based work.SLAsAgreements that determine how long a (contracted) party must perform a service, and to what specifications.Supply chain resilienceKnowing alternative vendors for all necessary hardware, software and services.Technology failoverHave systems that can take over each other's tasks if a threat takes out one of them.Warehoused stockStore products and components offsite to ensure their supply if the main location is affected by a threat.Warm siteA site that is ready for use but requires some minor routine actions to make it a hot site. This can mean setting up equipment and relocating resources to this site in a very short time.InventoryMap all processes and critical infrastructure and equipment and create manuals as needed.