Search

This paper focuses on business continuity management in organizations that use modern e-business technologies: the Internet, mobile computing, e-services, and virtual infrastructure. The aim is to make the shift from traditional Business Continuity Management (BCM) towards ?e-Business Continuity Management? (e-BCM) suitable for modern technological environments. We have defined a comprehensive framework for the implementation of an adaptive e-BCM adjustable to changes in the business environment. The framework consists of practical steps for defining elements of a business continuity management system: business impact analysis, risk assessment, and a business continuity plan. We have implemented and evaluated the framework within three financial organizations. The key finding is that Business Impact Analysis and the continual improvement of the Business Continuity Management System are the driving factors for the effective establishment of an adaptive e-BCM. The proposed framework is general, and can be applied to any organization that uses modern e-business technologies.

Dissertação de mestrado integrado em Engenharia e Gestão Industrial, Nos dias de hoje, para que haja um bom desempenho das organizações, é essencial o acesso constante aos sistemas de informação. Com o risco de interrupção de negócio a ganhar cada vez mais importância, é aconselhado às organizações a implementação de planos de continuidade de negócio, de forma a dar respostas a falhas como pandemias, incêndios, ruturas da cadeia de abastecimento, ou mesmo inundações. O presente projeto de dissertação foi realizado com o objetivo geral de apoiar o desenvolvimento da análise de impacto no negócio, de modo a dar início às duas primeiras atividades que representam os alicerces do processo de continuidade de negócio: a avaliação de risco e a análise de impacto. A metodologia de investigação utilizada para a elaboração do projeto foi a Investigação-Ação. Deste modo, a investigação iniciou-se com uma revisão bibliográfica, abrangendo os conceitos de gestão de risco, continuidade de negócio e, mais especificamente, análise de impacto. Após selecionar a logística da organização como âmbito do projeto, iniciou-se a realização da avaliação de risco. Nesta fase, foi selecionado o cenário mais importante a ter em conta para o âmbito em questão, sendo ele o worst-case scenario (pior cenário possível), de forma a ser considerado ao longo do desenvolvimento da análise de impacto. De seguida, através da aplicação da metodologia de análise de impacto, foi possível mapear os principais processos, identificando 76 processos críticos e 75 processos de criticidade elevada. Concluiu-se também que existem 22 sistemas de informação considerados de criticidade elevada ou crítica. Destes, identificou-se para a maioria dos sistemas um tempo de recuperação máximo de 1 dia (isto significa que no máximo só podem perder-se dados das 24 horas anteriores), assim como um tempo máximo de indisponibilidade de 1 dia (o sistema tem de estar disponível novamente no prazo máximo de 24 horas). Através da metodologia de análise de impacto, foi possível fazer um levantamento exaustivo da informação, para que posteriormente sejam identificadas estratégias de continuidade adequadas para cada sistema e processo identificados e, assim, espoletar na empresa a continuidade de negócio., Nowadays, constant access to information systems is essential for organizations to perform well. With the risk of business interruption becoming increasingly important, organizations are advised to implement business continuity plans, to respond to failures such as pandemics, fires, supply chain disruptions, or even floods. This dissertation project was carried out with the general objective of supporting the development of Business Impact Analysis in order to initiate the first two activities that represent the foundations of the business continuity process: risk assessment and business impact analysis. The research methodology used to develop the project was Action Research. Thus, the research began with a bibliographic review, covering the concepts of risk management, business continuity and, more specifically, business impact analysis. After selecting the organization's logistics as the scope of the project, the risk assessment began. In this phase, the most important scenario to consider for the business was selected, which was the worst-case scenario, to be taken into consideration throughout the development of the business impact analysis. By applying the impact analysis methodology, it was possible to map the main processes, identifying 76 critical processes and 75 highly critical processes. It was also concluded that there are 22 information systems considered of high or critical criticality. For most systems, there is a maximum recovery time of 1 day (which means that, only data from the previous 24 hours can be lost), as well as a maximum unavailability time of 1 day (the system must be available again within 24 hours). Through the business impact analysis methodology, it was possible to make an exhaustive survey of the information, so that appropriate continuity strategies can then be identified for each system and process mapped, and thus trigger business continuity in the company.

This paper focuses on introducing a kind of framework, technical tool, method, platform to risks, and business impact analysis and evaluation based on ISO 22301 –Societal Security Business Continuity Management Systems – requirements. This technical tool is created for three reasons. Firstly, it is created to handle those weak points that are restricting a deep, honest, and completely true to reality risk analysis. Secondly, to provide supports, identifying the possible business impacts, as factors that are able to affect the business continuity of a company. Thirdly, to create a common platform supplemented with visualizing the results of these two different analysis. This paper is aimed at highlighting the advantages of this technical tool and the eliminated weaknesses, while explaining the methodology and logical way of the platform. This technical tool has been introduced to some companies and is used to evaluate their real status. Arising from the aforementioned, this paper also show some usage results. According to the first test in a real environment, this technical tool proved to be more effective for decision makers than the well-known similar methods. The most useful part seems to be the visualization and the provided flexible framework of the tool. This fact encourages further tests and improvement.

Organizations are increasingly subject to hazardous events and threats, which can be critical for their business operations and performance. Any natural, accidental, or deliberate incidents that happen to the organization can cause major disruptions to it. The present paper aims to examine the prerequisites for a sound business impact analysis necessary to build the organization’s business continuity management capability and ensure business resilience. It is meant to discover those critical functions and resources which are vital to business operations in a sample of small and medium-sized enterprises from a certain geographic area in Romania, in order to maintain their core operations and ensure business continuation. The research results rely on the data collected through face-to-face interviews from 119 Romanian companies. The research findings of the multiple linear regression employed indicate that, in undertaking business impact analysis for business continuity, it is vital for enterprises to identify the skills and level of expertise required from staff to carry out organization’s critical activities. Also it is critical for companies to identify alternative premises and systems and means of voice and data communication, as well as the priority suppliers/partners whom they depend on, necessary to undertake their critical activities. The study contributes to the literature by providing empirical evidence on the prerequisites of the organization’s business impact analysis that are critical to build a strong business continuity management capability. It also offers new insights to companies meant to generate a better understanding of current practices of undertaking a business impact analysis for business continuation in their organizations.

Disaster Recovery oder Katastrophenwiederherstellung ist die Fähigkeit von Betrieben nach Eintreten einer Katastrophe einen raschen Wiederanlauf der Produktion zu gewährleisten. Um den wirtschaftlichen, finanziellen und personellen Schaden möglichst gering zu halten, ist die Erstellung eines Disaster-Recovery-Plans für kleine und mittlere Produktionsbetriebe unerlässlich. Ziel eines solchen ist es, durch diverse Analysetechniken die potentiellen Risiken des Betriebs zu identifizieren und Strategien zur Entwicklung von proaktiven und reaktiven Gegenmaßnahmen zu implementieren. Im Rahmen dieser Arbeit werden alle Methoden, Ausführungsformen und theoretische sowie praktische Hintergründe zu einer Standard Operating Procedure, einem Notfallhandbuch, einer Business Impact Analyse, einer Failure Mode and Effects Analyse und die Recovery Time Objective Zeiten anhand eines pharmazeutischen Produktionsbetriebs beschrieben. Disaster recovery is the ability of a business to ensure a rapid resumption of production after a disaster has occurred. In order to keep the economic, financial and personnel damage as low as possible, the creation of a disaster recovery plan is essential for small and medium-sized production companies. The aim is to identify the potential risks of the operation using various analysis techniques and to implement strategies for the development of proactive and reactive countermeasures. In this thesis, all methods, implementation forms and theoretical as well as practical backgrounds for a Standard Operating Procedure, an emergency manual, a Business Impact Analysis, a Failure Mode and Effects Analysis and the Recovery Time Objective Times are described on the basis of a pharmaceutical production company.

This paper offers an overall view of applying business impact analysis (BIA) to prepare business continuity plan (BCP) for port logistics based on the joint research project to create tsunami resilient society undertaken by the academia from Chile and Japan. Authors review Chilean socio-economic circumstances and currently developed disaster responding system in the national and regional context, and identify significance and social request of maintaining the continuity of port logistics functions in association with integrated risk management of tsunami disaster. The authors place particular emphasis on the possible engagement of BIA for improving efficiency and effectiveness of port logistics BCP. The authors propose an appropriate procedure, techniques and tools for BIA implementation in this regard, and demonstrate them as a practical example of BIA implementation in the port of Iquique, Chile. Finally, are provided some recommendations and suggestions both for the development of future work, as well as the necessary development of policies

Resumption of critical processes/functions after occurrence of any disruptive event is essential from the business continuity (BC) viewpoint. Business impact analysis (BIA) is a key part of a business continuity management system (BCMS) in which an organization’s key products/services along with the critical functions and their BC related indices, i.e., the maximum tolerable period of disruption (MTPD) and the minimum business continuity objective (MBCO) are determined. This study proposes a novel framework to conduct the BIA in organizations in a more systematic and comprehensive way mostly by relying on some effective multi attribute decision making (MADM) techniques. A case study in an auto part manufacturer is also provided to validate the proposed framework whose results demonstrate the applicability and usefulness of the proposed approach.

For each company, disasters may have diverse impacts either financially or non-financially. Therefore, a company requires a business continuity plan. One important factor in developing such plan is Business Impact Analysis (BIA). With BIA, a company can identify and analyze Critical Business Functions (CBFs) and potential impacts on the business whether operationally or financially, and further, business recovery priority, strategy and solution can be determined following a disaster.Methodologies used in developing this BIA are quantitativeand qualitative where for aspects related to financials, quantitive method is used. Meanwhile, for those aspects\ related to non-financial areas, qualitative method is used. The development of this BIA was done through the dissemination of questionnaires to 62 business units in PT Bank XYZ. To draw the BIA, eight parameters were used, where as for the final result, there were three criticality levels found in the business units of PT Bank XYZ, i.e. very critical level - 18 business units (29%), critical level - 23 business units (37%) and less critical level – 21 business units (34%). In addition, there were 71 applications used by CBFs. Based on the results of this study, PT Bank XYZ can determine the priority and key strategies for business units that require handling and recovery when a disaster occurs to maintain the bank's business operation's continuity and sustainability.Withthat, the company can minimize the potential loss resulted from a disaster.

Business enterprises are increasingly realizing the importance of business continuity management (BCM). Availability BS 25999 Standard has facilitated a consistent methodology that organizations can follow in designing their BCM System. This paper intends to provide a conceptual understanding of BCM right from BCM Policy to BCM maturity by describing the steps involved in the implementation of BCM Standard-BS 25999-to ensure business continuity in the event of an outage. The key BCM tasks have been categorized into three phases of business continuity-Pre-event Preparation, Event Management, and Post-event Continuity. This paper also highlights some of the challenges experienced by the author in carrying out Risk Assessment and Business Impact Analysis. The Business Continuity Maturity Model® of Virtual Corporation is provided (with their permission) as a tool to strengthen business continuity maturity or organizations.

V diplomskem delu je predstavljeno teoretično ozadje neprekinjenega poslovanja ter standardi in dobre prakse na tem področju. Predstavljena je družba BSH Hišni aparati, d. o. o., ter njeni ključni IT procesi, v katerih smo na praktičnem primeru upravljali neprekinjeno poslovanje informacijske tehnologije. Vpeljano rešitev smo nato ovrednotili s priporočili COBIT 5. Diploma thesis presents the theoretical background of business continuity as well as standards and best practices for this area. Company BSH Hišni aparati d.o.o. and its key IT processes is presented, in which governance of IT business continuity was done on practical example. Implemented solution was then evaluated using COBIT 5 recommendations.

This project aims to delineate recovery strategies for a Portuguese Bank, as a way to increase its preparedness towards unexpected disruptive events, thus avoiding an operational crisis escalation. For this purpose, Business Continuity material was studied, a risk assessment performed, a business impact analysis executed and new strategic framework for selecting strategies adopted. In the end, a set of recovery strategies were chosen that better represented the Bank’s appetite for risk, and recommendations given for future improvements. NSBE - UNL

Business continuity focuses on ensuring an organization can continue to provide services when faced with various crisis events. Part of the business continuity planning process involves: Business Impact Analysis; Risk Assessment; and Strategy Development. In practice, these activities often rely on ad hoc methods for collecting and analyzing data necessary for developing the business continuity plan. In this paper we discuss how various analytical methods that have been successfully used for addressing other problems, may be applied to the three phases of business continuity planning mentioned above.

Diplomsko delo obravnava vse vidike procesa zagotavljanja neprekinjenega poslovanja v podjetju, od načrtovanja, preko vzpostavitve do vzdrževanja sistema za zagotavljanje neprekinjenega poslovanja. Delo se v veliki meri sklicuje na mednarodni standard BS 25999, ki je v veljavi od leta 2007 in obravnava tematiko neprekinjenega poslovanja ter uvaja standardiziran pristop k uvedbi in presojanju programa neprekinjenega poslovanja v organizaciji. Delo vsebuje tudi pregled tehnik za identifikacijo in analizo tveganj, prav tako pa tudi kratek povzetek nekaterih drugih na tem področju relevantnih standardov. V praktičnem delu sta obravnavana dve programski orodji, ki podpirata procese neprekinjenega poslovanja, predstavljen je vprašalnik za ocenjevanje pripravljenosti na incidente ter seznam potrebnih korakov za izvedbo procesa načrtovanja neprekinjenega poslovanja. Izdelali smo tudi primere dokumentov sistema neprekinjenega poslovanja v manjšem podjetju, ki jih zahteva standard BS 25999. This document underlines the standard approach to planning, establishing, and maintaining a business continuity management system in the organization. It relies heavily on the current standard BS 25999 which covers the field of business continuity. The document also delivers a review of some risk assessment techniques based on a draft of ISO 31010 standard. It also includes the brief overview of some other business continuity standards and some business continuity related software products. In the section outlining the practical work there are overviews of two different program solutions supporting the processes of business continuity as well as a list of necessary steps for implementing the business continuity management and a questionnaire for evaluating a resilience of a small organization. Finally, some sample business continuity documents that are describing business continuity processes in a fictional organization are also included.

Publisher Summary This chapter focuses on the process of business impact analysis. Risk assessment looks at the various threats the company faces, and business impact analysis looks at the critical business functions and the impact of not having those functions available to the firm. These two assessments look at the company from two different angles. The risk assessment starts from the threat side, and the business impact analysis starts from the business process side. Planning for business continuity as an outgrowth of disaster recovery makes more sense to understand the full picture regarding risks and threats and then looks at business impact. Both outputs—from the risk assessment and the business impact analysis phases—are used as input to the mitigation strategy development. The fundamental task in business impact analysis (BIA) is to understand which processes in your business are vital to your ongoing operations and to understand the impact that disruption of these processes would have on your business. Data can be gathered using questionnaires, interview, workshops, documents, and research. There are pros and cons to each approach. Since each company is unique, there is no “one size fits all” template one can use to delineate all critical business processes for all companies. The output for each process and function includes criticality assessment, financial impact analysis, operational impact analysis, recovery objectives, dependencies, and work-around procedures. When this is documented for each business function and key business process, one will have a comprehensive look at the company and a solid business impact analysis.

Properties of a computer system providing for its ability to recover from disaster are determined by its architecture and implemented technical solutions. Existing procedures of risk assessment and business impact analysis allow to assess the probability and potential results of a disaster, but do not provide direct guidelines as to the technical decisions. The paper outlines practical guidelines that close the gap between business-oriented analyses and technical design of disaster recovery facilities.

In Luxembourg, a cooperation of banks founded a company to share the costs and benefits of a disaster recovery center. The business model based on the recovery requirements of financial institutions, and the organizational and technical architectures implemented are described. The necessary documentation of business continuity plans is described by means of an example.