BCR-04 Business Continuity Planning
Summary
Business continuity planning is essential for any organization to ensure it can continue to deliver products and services during and after a disruption. A robust business continuity plan outlines the priorities, procedures, roles and communication needed to maintain operational resilience. The plan should be comprehensive yet practical, regularly tested, and easily accessible when crises strike.
Where did this come from?
This control comes from the CSA Cloud Controls Matrix v4.0.10 - 2023-09-26. The CSA CCM provides a controls framework for cloud computing aligned to industry-accepted security standards, regulations, and control frameworks.
For more on business continuity planning, check out:
Who should care?
- Business continuity managers responsible for developing and maintaining BC plans
- IT managers and engineers who support critical systems and infrastructure
- Senior executives accountable for the organization's resilience and reputation
- Compliance officers ensuring alignment with contractual and regulatory requirements
- All personnel with a role to play during incident response and disaster recovery
What is the risk?
Without an effective business continuity plan, an organization may be unable to deliver products and services after a major disruption. This could lead to:
- Lost revenue and market share as customers take their business elsewhere
- Reputational damage as the organization is perceived as unreliable
- Compliance violations and legal liabilities from failure to meet obligations
- Staff attrition as employees lose confidence in the company's stability
The extent of the impact depends on factors like the nature of the disruption, how long systems are down, and the criticality of the affected products/services. But in general, the longer the disruption, the more severe and harder to recover from the consequences become.
What's the care factor?
Business continuity planning should be a top priority for any organization, but especially those providing essential services in regulated industries like finance, healthcare, energy etc. Even a few minutes of downtime for critical systems can have major flow-on effects.
However, all organizations should care about continuity to some degree. In the digital era, most companies are highly dependent on IT systems. Customers also have higher expectations of 24/7 availability. So while the required sophistication of BC plans may vary, the fundamental need for them is universal.
When is it relevant?
Business continuity planning is most relevant for:
- Mission-critical systems and data
- Public-facing products and services
- Functions required to meet legal/contractual obligations
- Supporting infrastructure like networks, power, cooling etc.
It's less relevant for:
- Isolated dev/test environments
- Non-essential internal applications
- Archived data not required for daily operations
However, even lower-priority systems should be included in BC plans if their loss could still cause significant disruption over time. Good business continuity takes a holistic view.
What are the trade offs?
Developing and maintaining business continuity plans requires time, specialized expertise, and ongoing commitment from stakeholders across the organization. Key trade-offs include:
- Staff time spent planning and testing vs focused on core business tasks
- Infrastructure costs for backup systems and redundancies vs investment in growth
- Potential reduced agility or efficiency from risk-averse processes
- Frustration for staff and customers from the plans temporarily disrupting normal operations during testing
Like insurance, BC planning involves near-term sacrifices for long-term protection against uncertain events. But most organizations conclude the risks outweigh the costs.
How to make it happen?
- Assign a business continuity manager to lead the planning process
- Conduct a business impact analysis to identify critical assets, recovery time objectives, and failure scenarios
- Determine strategies and solutions to mitigate risks and ensure timely recovery. Consider backup systems, remote failover, manual workarounds etc.
- Document the BC plan clearly outlining the purpose, scope, roles and responsibilities (including for plan maintenance), communication protocols, and step-by-step recovery procedures
- Test the plan regularly through tabletop exercises and live simulations. Record any issues and incorporate lessons into plan updates
- Securely store the plan and ensure it's accessible to all relevant personnel at all times (including during an outage)
- Provide training to staff on their roles and conduct awareness campaigns
- Review and update the plan at least annually or after any major changes
- Ensure senior executive sponsorship and involvement throughout the program
What are some gotchas?
- Ensure the BC plan aligns with the organization's operational resilience strategies and capabilities. Disconnects can render the plan ineffective
- The plan should be comprehensive but not so complex that it's impractical to execute under pressure. Focus on the 20% of actions that deliver 80% of the results
- Take care when distributing sensitive recovery details in the plan. Use the principle of least privilege
- Don't neglect the human factors. Include mental health support and two-way communication with staff during a crisis
- The BC plan is only as good as your last test. "Set and forget" will likely fail
What are the alternatives?
Some alternatives to a traditional business continuity plan include:
- Disaster Recovery as a Service (DRaaS) - Outsourcing failover to a cloud provider. Good for organizations lacking in-house expertise
- Distributed architectures - Designing applications to gracefully degrade and continue functioning during disruptions
- Postmortems - Rather than extensive BC planning, some organizations rely on strong incident postmortems to rapidly repair and improve after failures. Common in DevOps cultures
However, these are more complements than full replacements for a BC plan which remains an essential control for any organization.
Explore further
- NIST SP 800-34 - Contingency Planning Guide
- ISO 22301 - Business Continuity Management
- NIST CSF - Respond Function
- CIS Controls v8 - 10 & 11
This control also relates to:
- BCR-01 - Business Continuity Policy and Objectives
- BCR-02 - Risk Management Objectives
- BCR-05 - Testing and Continuous Improvement
