Business Continuity and Disaster Recovery for InfoSec Managers

190 6.3 Chapter Summary

6.2.12 Warehouse and Stock

If the organization’s warehouse facilities or stock have been damaged during

the emergency, it is necessary to assess the extent of the damage and prepare

a claim from the insurance company. It will also be necessary to inform cus-

tomers who may be relying on delivery of that stock in the near future. The

damaged items will need to be repaired or replaced. In some cases, it may be

necessary to use the services of outside specialists to carry out the activity.

Amend the predefined items within the plan template, as appropriate.

6.3 Chapter Summary

In this chapter, we talked about what measures are needed to accomplish a

business recovery effort. Although the term “Disaster Recovery” has

become a popular industry buzzword, the majority of discussion on this

topic concentrates on IT operations recovery. In reality, business recovery

must take precedence over IT systems recovery, since the business is respon-

sible for continuity of operations and, therefore, service to the customer.

Businesses can experience all kinds of interruptions, ranging from cata-

strophic natural disasters to acts of terrorism to technical glitches, so orga-

nizations need business continuity and recovery resources, plans, and above

all management. Business recovery planning provides for the recovery of

mission-critical business processes at an alternative site. Just as a disaster is

an event that makes the continuation of normal functions impossible, a

disaster recovery plan consists of the precautions taken so the effects of a

disaster will be minimized and the organization will be able to either main-

tain or quickly resume mission-critical functions.

The business recovery planning process was outlined in detail. From

mobilizing a business recovery team and assessing the extent of damage and

the business impact a disaster may have on your business, we discussed var-

ious methods of recovering your business functions. We also discussed the

importance of using a backup recovery site. This backup strategy starts with

the designation of a recovery site, the purchase of any necessary equipment

that would be used to build the site, the reassembly of that equipment at

the recovery site, and the operations needed to actually restore data from

backups. The process of restoring applications data, as well as proprietary

data, was explained. Once the emergency has passed and you are able to

move back to your restored permanent facility, it is important to have

someone monitor overall progress and keep everyone informed. Usually,

once the business functions have been restored, a process of handing busi-

6.3 Chapter Summary 191

Chapter 6

ness operations back to regular management takes place. The BRT should

be tasked with preparing a business recovery phase report to address what or

how things could have been improved in the event they are ever reconsti-

tuted for another emergency.

When planning business recovery activities, we stressed covering all

areas of the business, including your communication systems; human

resources; corporate proprietary information and documentation; IT sys-

tems; office supplies; operations and administration (support services);

power and other utilities; premises, fixtures, and furniture (facilities recov-

ery management); all of your production equipment and nonproduction

equipment; and whatever is needed to preserve your organization’s ability to

conduct trading, sales, and customer service activities. Finally, don’t forget

about warehouse and stock matters. There are dozens of details you must

account for that are unique to your organization. This chapter has

attempted to bring to the forefront the areas most important to getting nor-

mal operations restored. In the next chapter, we will discuss how to test,

audit, and train to ensure continuity of your business.

This Page Intentionally Left Blank