Business continuity planning
[7] Any event that could negatively impact operations should be included in the plan, such as supply chain interruption, loss of or damage to critical infrastructure (major machinery or computing/network resource).
Usually created with the input of key staff as well as stakeholders, a BCP is a set of contingencies to minimize potential harm to businesses during adverse scenarios.
[11] A 2005 analysis of how disruptions can adversely affect the operations of corporations and how investments in resilience can give a competitive advantage over entities not prepared for various contingencies[12] extended then-common business continuity planning practices.
[13] Adapting to change in an apparently slower, more evolutionary manner - sometimes over many years or decades - has been described as being more resilient,[14] and the term "strategic resilience" is now used to go beyond resisting a one-time crisis, but rather continuously anticipating and adjusting, "before the case for change becomes desperately obvious".
Resilience is a communicative process that is constructed by citizens, families, media system, organizations and governments through everyday talk and mediated conversation.
[17] The theory is based on the work of Patrice M. Buzzanell, a professor at the Brian Lamb School of Communication at Purdue University.
Buzzanell notes that there are five different processes that individuals use when trying to maintain resilience- crafting normalcy, affirming identity anchors, maintaining and using communication networks, putting alternative logics to work and downplaying negative feelings while foregrounding positive emotions.
[19] Each of these processes can be applicable to businesses in crisis times, making resilience an important factor for companies to focus on while training.
For example, under ISO 22301:2019, organizations are required to define their business continuity objectives, the minimum levels of product and service operations which will be considered acceptable and the maximum tolerable period of disruption (MTPD) which can be allowed.
Planners must have information about: The analysis phase consists of: Quantifying of loss ratios must also include "dollars to defend a lawsuit.
"[25] A business impact analysis (BIA) differentiates critical (urgent) and non-critical (non-urgent) organization functions/activities.
Each function/activity typically relies on a combination of constituent components in order to operate: For each function, two values are assigned: Maximum time constraints for how long an enterprise's key products or services can be unavailable or undeliverable before stakeholders perceive unacceptable consequences have been named as: According to ISO 22301 the terms maximum acceptable outage and maximum tolerable period of disruption mean the same thing and are defined using exactly the same words.
[30] When more than one system crashes, recovery plans must balance the need for data consistency with other objectives, such as RTO and RPO.
During the 2002–2003 SARS outbreak, some organizations compartmentalized and rotated teams to match the incubation period of the disease.
The solution phase determines: There are many standards that are available to support business continuity planning and management.
These documents give a practical plan to deal with most eventualities—from extreme weather conditions to terrorism, IT system failure, and staff sickness.
While start and stop times are pre-agreed, the actual duration might be unknown if events are allowed to run their course.
