- Now in this lesson, 13.3,
we're gonna be talking about continuity of operations.
Now in its simplest form
continuity of operations is the capability
of a business to continue to operate in adverse
sometimes referred to as disaster conditions.
Now, in a business context, disasters are
gonna be disruptive events that can significantly
impact an organization's capability to operate.
Now the impact could be to people,
to technologies, to facilities, or any combination thereof.
So in our previous lessons when we talked
about resiliency and redundancy,
we were really looking at kind
of individual systems or component level
and we talked about backup and recovery.
It was system configurations and specific data sets.
Here we're really looking at a bigger situation.
We're saying that we may have an event so disruptive
that it significantly impacts the organization's
capability to operate, to conduct business.
Again, that impact could be people, technology, facilities
or any combination.
Now adverse conditions that cause the situation
could be external, internal, or even human.
We could have things like large scale geological
or meteorological events such as an earthquake, a storm,
a flood, a hurricane, a tornado, or a wildfire.
Environmental events such as pollution or sea rise,
or a public health event such
as a pandemic that we all recently went through.
It could be infrastructure.
We could have major loss of service such as electricity
or HVAC, or water, or significant technical issues
with equipment or communications failure
or they could be human base.
They could be based on workplace accidents
or walkouts or strikes or civil disturbance
or a cyber attack, or cyber warfare, or war and terrorism.
So there are lots of conditions
that could be problematic, right?
That we'd consider adverse conditions
and we need to make sure
that we can continue to operate, right?
Continue to operate as a business
in these adverse conditions.
So continuity of operations
is really a shared responsibility.
It doesn't belong to just any one person
or any one group.
The board of directors or the equivalent is responsible
for the approval of continuity of operations policies
as well as oversight of strategy, development and testing.
Management is responsible for the development
of strategic and tactical plans and procedures,
external relationships, training, testing, and audit.
And then individual business units are responsible
for developing unit specific procedures.
Now the objective of continuity of operations planning,
again is to prepare for continued operations.
And in most organizations that's gonna fall
into really two buckets.
Recovery and operations.
Disaster recovery plans, DRPs,
focus on the recovery and the restoration of technology,
physical plan and personnel.
Where business continuity or operations plans
focuses on the overall strategy
for sustaining the business activity during a disaster
or even during a smaller interruption
and during the subsequent recovery period.
So recovery is all about how
do we get everything fixed and back going?
Continuity is how do we continue to provide
essential services during this recovery
and resumption period.
So looking at the continuity
of operations planning workflow,
we really need to think about this as a project
and have a good project manager assigned.
Then we're gonna do what's known
as a BIA, a business impact analysis,
and we'll be talking about that a little bit later on.
After we've finished our BIA, right?
We've got the outcome of our BIA,
then we will start developing our plans.
We'll then develop our procedures.
We then wanna make sure that we're training everybody
on what they're supposed to do.
Then we want to test,
we wanna make sure that our plans and procedures
are working the way we expect them to work,
and that everybody understands their roles
and their responsibilities.
And on a regular basis
we wanna bring an audit to audit
our plans and our procedures,
to look at them and say, okay, are they complete?
Are they comprehensive?
Have we done our training?
Have we done our testing?
And are they aligned or strategically aligned
with the needs of the organization?
And then on a very regular basis
we're going to have to do maintenance, review, and update.
And for most organizations
that's at a minimum, an annual process.
But very often whenever something new has been added, right?
We have a new process, we have a new division,
we have a new factory floor, whatever it is,
we're gonna go and update those plans,
both our disaster recovery
and our business continuity plans.
Now, our plans, disaster recovery and business continuity,
should always be maintained in a state of readiness.
So we wanna keep them up to date,
as we just mentioned.
We also wanna make sure that people
know what they're supposed to do.
So personnel should be trained to fulfill their roles
and responsibilities within the plan.
Our plans and strategies are exercised
to validate their content.
Our system and our system components have been tested
on a scheduled basis to ensure
their recoverability and operability.
And we have plan examination and auditing again
to ensure compliance with business objectives.
Now the objective of testing
is to evaluate the continuity
of operations strategies, plans and procedures,
meaning our BCP and our DRP.
Not institutional knowledge.
So what we're not looking to do when we test is say,
okay you guys just innately know what to do
based on institutional knowledge,
just use your own judgment.
It's not what we wanna do.
Whenever we're doing testing, we're saying,
okay, let's pull out our strategies or plans,
our procedures and follow them.
Because really what we're trying to do,
is to evaluate the strategies, plans, and procedures.
Now the outcome of testing should be strategy
plan, and procedures, modification if necessary,
and an enhanced participant familiarity
with all facets of the plan.
So there are three primary testing approaches you
wanna be able to identify,
tabletop, failover, and simulation.
A tabletop testing is just a hypothetical group workshop.
So we bring a bunch of people into
departmental and altogether and it focuses
on the application of plans and procedures.
So we say, okay, here's the scenario.
Pull out your plan.
What would we use?
How would we do it?
We're just talking through it.
And part of talking through that
is identifying gaps in our preparedness.
In a failover,
we're doing testing to evaluate the ability
of a particular system or application
to recover from a failure,
and then to switch to a backup or secondary system
or component seamlessly.
So failover testing, we're really think
of this as much more technical testing, right?
That we're just saying,
what happens if we have a system
or an application that fails?
How well can it recover from that failure?
And can we switch to a backup
or secondary component seamlessly?
And ultimately can we switch back?
In simulation, DR and or BCP plans
are executed in a controlled environment.
So we're actually running through,
physically running through our plans
to simulate a real world disaster or outage.
Now, simulations can be done
at different levels of granularity.
It could be done at a business unit level,
it could be done at a campus level,
it could be done at an enterprise level.
Now, another approach,
and this requires a lot of investment
and a high degree of maturity
is to have business continuity parallel processing.
Parallel processing is a pretty complex
and costly strategy that can be employed to
ensure uninterrupted business operations
during unexpected events or disruption.
Now in parallel processing requires
that we have the implementation
of parallel processing systems,
that can handle critical business functions simultaneously
or in parallel, really minimizing the impact
of disruption on overall operations.
And we've already mentioned
that we need to do a plan audit.
So let's just reinforce that.
A plan audit provides management
with an independent assessment of the effectiveness
of plans and procedures and training and testing
as well as strategic alignment assurance.
Now the type and the extent of auditing
that's gonna be done really depends
on the risk involved,
management's assurance requirements
and the availability of audit resources.
But don't forget about audit, right?
It's really important that we bring audit in
because audit has this independent view
of what should be done.
That my friends brings us to a three second challenge.
You know what to do?
Five questions, three seconds each.
Let's do it.
Term used to describe disruptive events
that significantly impact
an organization's capability to operate.
One, two, three.
That would be a disaster.
Number two.
This type of plan describes plans
and procedures for recovering and restoring
technology, facilities, and personnel.
Keyword here is recovering and restoring.
One, two, three,
it's gonna be a disaster recovery plan.
Number three.
This type of plan describes the overall strategy
for sustaining business activities.
One, two, three.
It's gonna be a business continuity plan.
Number four.
A hypothetical group workshop that focuses
on the application of plans and procedures.
One, two, three.
That's gonna be a tabletop.
And lastly, number five.
Independent assessment of the effectiveness
of plans, procedures, training, and testing.
I know everybody's gonna get this one.
One, two, three.
And that's gonna be audit.
So let's do a security-in-action
of continuity of operations.
And if you're thinking,
I'd really love more detail
about how all this works,
don't fear, because in a later lesson,
we're gonna dive right back into
disaster recovery and business continuity planning,
and in particular how to do a BIA.
But for right now let's talk about continuity of operations.
After months of work your organization
has completed an overhaul of its disaster recovery plan
and its business continuity plan.
And your boss is eager to see if it works
and wants to schedule a simulation test.
That's the first thing he wants to do.
Get that simulation test.
Let's see if it works.
And my question to you is,
is this a reasonable approach?
So just a recap, right?
We've been doing this for months of work.
We've just recently completed this complete overhaul
of our disaster recovery
and our business continuity plan.
And our boss is really excited about it,
says let's "See if it works".
Let's do a simulation test.
Do you agree?
Do you think that's the right thing to do?
Is it a reasonable approach?
Do you have any alternate suggestions?
Go ahead and put me on pause,
put some notes down,
and then come back and
we'll talk about training and testing,
which should give you a couple of hints.
All right well a simulation test requires a maturity
level that's achieved over time.
It's definitely not gonna be a good starting point.
The new plan should be first introduced organization-wide,
and applicable training provided
so everybody knows what's in the plan
and most importantly knows what their responsibilities are.
And then the usual order of testing
is going to be to do tabletop,
maybe some failover, and then simulation.
So we really want to do a lot of pre-work
and not just jump right into our simulation.
It's cool that your boss is excited
and wants to see how it works,
but we need to introduce, publish, train,
and then take our testing in the appropriate steps.
Doing that security-in-action.
There's your word cloud.
Not particularly big but important.
Make sure you can really define
all of these terms and understand them.
And again, we are gonna revisit them all in a later lesson.
When you're ready, we've got a quiz coming up.
I'll see you there.