Dr Gerry Firmansyah CID 610 Business Continuity and

Dr. Gerry Firmansyah CID 610 - Business Continuity and Disaster Recovery Planning for IT (W-XI)

BC/DR Plan Maintenance • BC/DR change management • Strategies for managing change • BC/DR plan audit • Plan maintenance activities • Project close out

BC/DR change management Change Management Process

Strategies for managing change Two key strategies for managing change are having a process for monitoring and a process for evaluating change requests. ❖ Monitor Change ❖ Evaluate and Incorporate Change

BC/DR plan audit The plan audit is a process in which you review the BC/DR plan against specific requirements. Audit plan should be created at minimum: ■ Audit scope, timeline, requirements, and constraints ■ Review of corporate risks and risk management strategies including BC/DR ■ Review of business impact ■ Review of BC/DR plan development activities ■ Review of BC/DR plan test plans and activities ■ Review of BC/DR plan training plans and activities ■ Review of BC/DR change management and plan maintenance processes

Plan maintenance activities 1. If the plan is revised, the BC/DR team members (or those who should have the latest copy of the plan) should be notified in a timely manner. 2. The plan should use a revision numbering system so team members know whether they have the latest version of the plan. 3. Review, update, and revise key contact information regularly. This includes staff, vendors, contractors, key customers, alternate sites and facilities, among others. 4. Create a BC/DR plan distribution list that is limited to authorized personnel but that includes all relevant parties. This distribution list should include off-site and remote facilities that may be used in the event of BC/DR plan activation. 5. Be sure there are up-to-date copies of the BC/DR plan off-site in the event the building is inaccessible.

Plan maintenance activities (cont) 6. Be sure there are up-to-date paper copies of the BC/DR plan on-site in the event IT systems go down. 7. Implement a process whereby all old versions of the plan are destroyed or archived and new versions replace them. This helps avoid a scenario where team members are working from different versions of the plan. 8. Always check soft copy and remote storage copies of your plan when changes are made to the plan. If you store copies off-site or at your alternate work site, these versions should be updated any time the plan is modified. 9. Whenever significant changes are requested or implemented, test the plan. This will ensure there are no new areas of concern and will help train staff on the changes. 10. Integrate BC/DR considerations into operational processes to reduce plan maintenance efforts in the future. 11. Assign responsibility for managing BC/DR change notification and requests to someone on the BC/DR team. The project management adage that a task without an owner won’t get done is especially true here. 12. Document plan maintenance procedures and follow these procedures to avoid introducing additional risk into the project. 13. Incorporate training into the change process so changes to people, process, technology that are incorporated into the BC/DR plan also trigger changes to training plans. 14. Be sure to include BC/DR plan testing, training, auditing, and maintenance activities in your IT or corporate budget for future activities related to BC/DR.

Project close out Several project close out activities. 1. Be sure all documentation is complete and finalized. 2. Be sure the BC/DR plan is distributed to appropriate personnel. 3. Announce plan completion to project sponsor and other project stakeholders. 4. Announce plan completion to company to increase awareness and celebrate success. 5. Announce training or testing plans, if appropriate. 6. Hold a project review session to discuss lessons learned and incorporate into process. This should not be held at the same time as a project close out or celebration. This should be a working meeting to capture best practices and lessons learned. 7. Hold project close out meeting to celebrate completion and recognize individual efforts, as appropriate. 8. Complete any staff reviews related to project work. 9. Submit summary or close out report to project sponsor, executive team, or other stakeholders, as appropriate. 10. Update legal or compliance documentation to reflect BC/DR readiness, as appropriate. 11. Set date for next BC/DR audit, review, testing, or training.