תקן אבטחת מידע
ISO 27001
Business Continuity Plan
A business continuity plan or BCP (Business Continuity Plan) is a management doctrine that refers to the activity that an organization is required to perform in order to ensure that critical business functions will be available to customers, suppliers, regulators and other entities with an interest in the organization. These activities include daily tasks such as project management, system backups, change control, and future planning. Business continuity does not refer to the initial rescue operations but rather to preparation and organization to achieve rapid recovery capacity after the disaster.
The doctrine refers to two areas: Business continuity: the ability of an organization to provide service and support to customers and maintain its viability before, during, and after a business continuity event. Business Continuity Management: The holistic management process that identifies possible impacts that threaten an organization and provides a framework for building organizational resilience and the ability to respond effectively to protect the interests of key stakeholders, reputation and brand.
The plan includes reference to the emergency scenarios:
-
Fires.
-
Flooding.
-
War events and hostilities.
-
Cyber attacks and information security incidents.
-
Damage to supply and communication infrastructures.
-
Economic and occupational crises.
-
Disruption in the availability and functioning of suppliers and service providers.
The steps of the process
1. Getting to know the organization - this is the stage that forms the basis of the entire system. At the end of this stage, the organization will have the knowledge and analysis of the effects, threats and prospects to which the organization is exposed (BIA-Business Impact Analysis), the definition of the critical activities, tolerable downtimes (MTDP), maximum recovery times (RTO), minimum information recovery points (RPO) and will know the threats, The risks and points of failure in the organization.
2. Formulation of strategies - second stage in which strategies are formulated to deal with the threats and find possible solutions for each activity. The strategies are formulated for each of the resources required to carry out the activity - structure, human resources, suppliers, inventory, infrastructure, information and more.
3. Preparation of a plan for business continuity - at this stage, an individual action plan is prepared to implement the decisions made in the previous stage.
A consolidated plan for each officer in activities defined as critical to the organization. Select people from within or outside the organization to operate the programs as part of one of the teams:
A. The crisis management team - a limited team consisting mostly of the senior management of the organization, consultants from crisis management and the media.
.B. The program management team - usually mid-level managers who are responsible for the implementation and operation of the program in a defined activity area
.third. The executive team - workers from within the organization with the support of subcontractors (if necessary) to carry out the activities themselves
4. Reviewing the plans and adjusting them - this is the peak of the process, when all stakeholders are aware of the seriousness the organization attaches to business continuity and commitment to the process. There are different types of tests. The types of tests that will be used at this stage were discussed and agreed upon even before the process of preparing the plans themselves began.
5. Implementing business continuity in the organization - this is the mature stage in the process. After the organization has completed all the steps in the outer circle, this is the step in which the plans are maintained, the activities, threats, and required resources are monitored, additional strategies are formulated, cost-benefit tests are carried out, and the process is extended to additional activities.