Business Continuity Answer Part 3

  60. Within a business continuity team, there may be many subteams. What are the responsibilities of the business continuity management team and the operations team? ANSWER: Business continuity management team: This is the command and control group responsible for all planning and coordination activities. The management team consists of organization representatives working together to facilitate the transfer to the alternate site. During relocation, this group coordinates all efforts, receives reports from the other teams, and assigns work to them. The team handles the functions performed by the communications, business interface, and vendor contact teams under the DR model. Operations team: This group works to establish the core business functions needed to sustain critical business operations. The specific responsibilities of this team vary dramatically between organizations because their operations differ.  61. What is the seven-step process defined by NIST that is used to develop and maintain a viable contingency planning program? ANSWER: 1. Develop the BC planning policy statement: A formal organizational policy provides the authority and guidance necessary to develop an effective continuity plan. 2. Review the business impact analysis: The BIA helps to identify and prioritize critical IT systems and components. 3. Identify preventive controls: Measures taken to reduce the effects of system disruptions can increase system availability and reduce continuity life-cycle costs.  4. Create BC contingency (relocation) strategies: Thorough relocation strategies ensure that critical system functions may be recovered quickly and effectively following a disruption. 5. Develop the BC plan: The BC plan should contain detailed guidance and procedures for restoring a damaged system. 6. Ensure BC plan testing, training, and exercises: Testing the plan identifies planning gaps, whereas training prepares recovery personnel for plan activation; both activities improve plan effectiveness and overall preparedness. 7. Ensure BC plan maintenance: The plan should be a living document that is updated regularly to remain current with system enhancements.  62. Describe information that would be contained in the resource requirements section of a business continuity policy statement and discuss the significance of placing this information in a separate section. ANSWER: Should the organization desire, it can allocate specific resources to the development of BC plans in this section. Although this section may include directives to individuals, it can be separated from the roles and responsibilities section for emphasis and clarity.  63. Briefly describe the information required for the “scheduling of employee move” operation that should be specified in a business continuity plan to support returning to the primary site. ANSWER: Scheduling of employee move: Note that not all business functions may return at the same time, just as not all will relocate to the BC site in the same order or time. The organization may have the most critical functions continue to work out of the BC site until all support personnel are relocated and  support services are functional at the primary site. The organization may also want to wait for a natural break in the business week, like the weekend. In any case, the BC plan should contain information about who will begin directing the move back to the primary site and the order in which the business functions and associated personnel will move.  64. Many times, the process used to create an initial continuity planning process results in shortfalls from the intended outcomes. Give an example of a situation that might stem from lack of attention to prioritization. ANSWER: A formal process that prioritizes key business processes is a critical step that often does not get sufficient attention from senior management. As part of the BIA, identification and prioritization of critical business functions ensures that they will be supported in the event of a disaster that requires implementation of the BC plan. The failure to properly prioritize may result in situations that appear absurd in retrospect, such as a data center with working computers but no functioning network circuits, or an e-commerce site that works but cannot ship products from the warehouse.  65. What advice does Kathleen Lucey, a Fellow at the Business Continuity Institute, give for someone who is new to business continuity but is nonetheless charged with developing a business continuity plan? ANSWER: Kathleen Lucey states: “My advice to someone who is new to business continuity but is nonetheless charged with doing a business continuity plan for regulatory or other purposes: Hire someone to advise you and take their  advice. There is no reasonable justification for any enterprise to expect you to do something well that you have never done before and where you have no training or knowledge. Knowing the business and knowing IT does not equal knowing business continuity. This is a complex professional skill that takes time and pain to acquire, and guess what, it is continually evolving. Sorry, there are no silver bullets here. If your organization is too small to pay someone to advise you, at least get some training. Just remember that you need a whole lot more than a recipe! And, that you will truly get nowhere if you are expecting to do this in your spare time.”  66. What purposes does a periodic business continuity review serve? ANSWER: The BC review, conducted by the planning team with input from all necessary stakeholders, serves the following purposes: A refresher on the content of the plan An assessment of the suitability of the plan An opportunity to reconcile BC activities with other regulatory activities An opportunity to make needed minor changes that have been documented but not implemented since the last formal review Modified True / False 67. The process of completing a set of specialized team plans that document backups, continuity strategies, and associated actions needed to restore or relocate a business is called disaster recovery planning.  ANSWER: False - business continuity planning False - BCP 68. The efforts of an organization to ensure its long-term viability when a disaster precludes normal operations at the primary site is called business continuity. ANSWER: True 69. The data recovery team works to establish short-term and long-term networks, including the network hardware (hubs, switches, and routers), wiring, and Internet and intranet connectivity. ANSWER: False - network 70. The operations team works with the hardware and OS teams to get internal and external services up and running to begin supporting business functions. ANSWER: False - applications  71. All members of the business continuity teams should have copies of the business continuity plan readily available. ANSWER: True 72. The equipment that team members need will differ according to their rank and responsibilities. ANSWER: False - roles 73. The business continuity (BC) team begins with the development of the BC operations statement, which provides an overview of the organization’s philosophy on the conduct of BC operations and serves as the guiding document for the development of BC planning. ANSWER: False - policy  74. For each scenario of the BIA applicable to BC, the organization first begins to determine the probability that it will have to relocate to an alternate site and thus associate the business continuity plan with the DR plan. ANSWER: True 75. The term closing is used in the military and government sectors to represent the process of moving out of temporary facilities and returning them to their owners or managers. ANSWER: False - clearing 76. When searching for a sample business continuity template, it helps to specify the target organization’s industry. ANSWER: True  : 77. The business continuity team can expect that its functions will always be generally the same. ANSWER: True 78. The role of the initiation party is to prepare the site for the arrival of the rest of the organization’s business continuity teams, and eventually the rest of the organization designated to be working from the business continuity site. ANSWER: False - advance 79. The identification and redesign of critical business functions ensures that they will be supported in the event of a disaster that requires implementation of the business continuity plan. ANSWER: False - prioritization  80. As with the IR and DR plans, the business continuity plan requires a formal certification and update strategy. ANSWER: False - maintenance 81. Reputable business continuity certifications rely on a “Consistent Body of Knowledge.” ANSWER: False - Common 82. The business continuity plan must be managed as if it is a classified document. ANSWER: True