Generally Accepted Practices - Disaster Recovery Journal

141 Pages·2016·1.54 MB·English

by  Doug Macdonald

Professional Practice Narrative:

Establish the need for a Business Continuity Plan (BCP), including obtaining management support and organizing and managing the
BCP project to completion. (This includes defining the problem; communicating the need for a BCP; developing budget requirements;
identifying Planning Team(s) and Action Plans; and developing project management and documentation requirements.)
Expert / Distinguished Reviewer: Mike Cannon, CBCP, CPMP, CIA, CSP, CISA (Review Completed - 3/11/2015)

Subject Area 1 – Project Initiation and Management
Sub-Topic #1: # What How Points of Reference
INITIATE
Define the need for Business • Research and compile facts showing possible risks • Past audit comments
Continuity. to the enterprise.
• Regulatory obligations
• Legal obligations
• Past incidents
• Best practices publications
1 (white papers, banking
circulars, etc…)
• Relevant regulatory/ industry
trade bodies
• Consulting
recommendations
• Benchmarking data
Page 1 of 14 DRJ GAP – Subject Area 1 Project Initiation and Management March 2015

DRJ GAP – Subject Area 1 Project Initiation and
Subject Area 1 – Project Initiation and Management
Sub-Topic #1: # What How Points of Reference
INITIATE
Identify the purpose and goals • Review, finalize and submit for approval a • Subject Area 6
for the BC initiative. business case that identifies BC readiness
• Best practices publications
requirements.
(such as those used within
• Define high level roles and responsibilities across the Information Security and
the business units impacted by the BC initiative. or Project Management
best practices)
• Obtain a high level understanding of corporate
environment including products and services. • Cost Benefit Analysis Doc
(including actual cost of past
• If available, review existing BC materials to
outages as well as the
leverage previous work.
impact of brand damage and
• Draft a project proposal / charter. other concerns discovered
in defining the need).
2 • Draft a Business Continuity Management Policy
• Organization Charts

• Mission Statements
• Key documents such as:
evacuation procedures,
medical emergency, crisis
management and other
emergency management
plans
• Service Level Agreement
(SLA)
• Customer expectations /
requirement specs
Page 2 of 14 DRJ GAP – Subject Area 1 Project Initiation and Management March 2015

DRJ GAP – Subject Area 1 Project Initiation and
Subject Area 1 – Project Initiation and Management
Sub-Topic #1: # What How Points of Reference
INITIATE
Gain buy-in and commitment • Identify Sponsors. • Statements of work
for meeting goals.
• Guide leadership (sponsors) in defining objectives, • Cost benefit analysis
policies and critical success factors. documentation
• Communicate the purpose and goals with • Business Case
stakeholders (e.g.... Board of Directors, Regions,
3 • Critical Success Factors
Sr. Mgmt, etc…) and receive feedback and initial
(CSF)
approval.

• Identify high-level project targets and timeframes.
• Identify and communicate project risks.
• Gain approval of draft proposal / charter.
Establish a governance • Identify Steering committee roles and • Mission Statement
structure. responsibilities.
• Documentation of Critical
• Identify, review and approve supporting Success Factors
documentation required for the initiative.
• Conflicting priorities
• Receive funding and approval to move forward.
• Portfolio / program
4
• Establish / review BC policy. management standards
• Identify need for BC Standards and definition of
terminology.

• Set decision-making protocol and issue escalation
policies relative to continuity issues.
• Gain agreement on overall timescales.
Page 3 of 14 DRJ GAP – Subject Area 1 Project Initiation and Management March 2015

DRJ GAP – Subject Area 1 Project Initiation and
Subject Area 1 – Project Initiation and Management
Sub-Topic #1: # What How Points of Reference
INITIATE
Provide awareness of overall • Establish Project Communications plan. • BC website
project.
• Debriefings
• Brownbag lunches
• Employee input
5
• Intranet
• Town Hall meetings
• Administration
communication process
• Quarterly newsletters

Page 4 of 14 DRJ GAP – Subject Area 1 Project Initiation and Management March 2015

DRJ GAP – Subject Area 1 Project Initiation and
Subject Area 1 – Project Initiation and Management

Sub-Topic #2 What How Points of Reference
#
PLAN
Establish a steering • Identify and engage a team of affected managers • Project status report
committee. to oversee project progress and to resolve issues. template
1 • Establish project milestone review and approval • Project issues and risk logs
protocol.
• Project schedule
• Establish the framework required to measure
• Project plan
project success.
Develop the project plan. • Adjust project documentation to reflect final • Work breakdown structure
decisions and approvals. document
• Define project deliverables and related activities. • Project proposals

• List tasks and estimate effort and duration. • Statements of work
• Assign project team members to tasks. • Cost benefit analyzes
2 • Set milestones. • High-level project plan
• Document project scope control. • Work plans
• Document project risks. • Scope control processes
• Develop project risk mitigation. • Change control procedures
• Table Of Contents for
Project Management Body
of Knowledge (PMBOK)
Page 5 of 14 DRJ GAP – Subject Area 1 Project Initiation and Management March 2015

DRJ GAP – Subject Area 1 Project Initiation and
Subject Area 1 – Project Initiation and Management

Sub-Topic #2 What How Points of Reference
#
PLAN
Determine project cost • Establish methods to track project assets and • Budget reports, Inventory
tracking. expenses. and acquisition logs
3 • Establish resource tracking and reporting • Time sheets
procedures.
• Table Of Contents for
Project Management Body
of Knowledge (PMBOK)
4
Determine the project • Determine the need for additions or changes to • Change control procedures
environment. tools and supplies, such as acquiring or upgrading
• Security environment
planning software.
• Confidentiality policies
• Establish documentation storage and access
procedures. • Documentation
management standards
• Information handling
standards
• Table Of Contents for
Project Management Body
of Knowledge (PMBOK)
5
Determine training • Schedule training on the use of new software (as • Personnel skills inventory
requirements. required).
• Documentation
• Provide general BC training. management standards
• Provide BCP Tool training. • Project Plan
• Provide BCP Roles and Responsibility overview. • Subject Area 7: Awareness
and Training Programs
• Provide in-depth BC training as applicable.
Page 6 of 14 DRJ GAP – Subject Area 1 Project Initiation and Management March 2015

DRJ GAP – Subject Area 1 Project Initiation and
Subject Area 1 – Project Initiation and Management

Sub-Topic #2 What How Points of Reference
#
PLAN
6
Develop project success • Refine the critical success factors. • Critical Success Factors
metrics.
• Develop and implement measurements. • Project health
measurements

• Project documentation
checklist
• Project score card
• PM standards compliance
audit guide
• Table Of Contents for
Project Management Body
of Knowledge (PMBOK)
7
Develop the awareness • Establish and validate components and delivery • Subject Area 7: Awareness
program. methods. and Training Programs

Page 7 of 14 DRJ GAP – Subject Area 1 Project Initiation and Management March 2015

DRJ GAP – Subject Area 1 Project Initiation and
Subject Area 1 – Project Initiation and Management

Sub-Topic #3 Points of Reference
# What How
EXECUTE (
Conduct a Project Kick-off. • Facilitate a meeting with the team members to • Status reports
communicate the project mission and plan.
• Issues and risk logs
• Review assignments, work schedules and
• Project escalation
milestones.
procedures
• Set guidelines for rules of operations and
• Information handling
progress review.
standards
1
• Change control procedures
• Documentation
management standards
• Table Of Contents for
Project Management Body
of Knowledge (PMBOK)

Implement Interim Life Safety • Ensure the existence of an emergency only plan • Subject Area 5: Emergency
Plan. and develop one if needed. Response and Operations
2
• Ensure emergency management awareness • Subject Area 7: Awareness
across enterprise. and Training Programs
Manage Risk Assessment. • Assign representatives from in-scope • Subject Area 2: Risk
organizational areas. Evaluation and Control

3
• Use project controls to ensure success.

Conduct a Risk Awareness • Work with governance body to implement policy • Subject Area 7: Awareness
Campaign. changes. and Training Programs
4
• Educate personnel on purpose and importance of
updated preventive measures.
Page 8 of 14 DRJ GAP – Subject Area 1 Project Initiation and Management March 2015

DRJ GAP – Subject Area 1 Project Initiation and
Subject Area 1 – Project Initiation and Management

Sub-Topic #3 Points of Reference
# What How
EXECUTE (
Manage Business Impact • Assign representatives from in-scope • Subject Area 3: Business
5 Analysis. organizational areas. Impact Analysis
• Use project controls to ensure success.
Develop BC Strategy and • Assign representatives from in-scope • Subject Area 4: Developing
Standards. organizational areas. Business Continuity
6 Management Strategies
• Use project controls to ensure success.

Implement BC Solutions. • Assign representatives from in-scope • Subject Area 5: Emergency
organizational areas. Response and Operations
• Use project controls to ensure success. • Subject Area 6: Developing
and Implementing Business

Continuity and Crisis
Management Plans
7
• Subject Area 9: Crisis
Communications
• Subject Area 10:
Coordination with External
Agencies
Develop and execute a BC • Assign representatives from in-scope • Subject Area 7: Awareness
awareness program. organizational areas. and Training Programs
8
• Use project controls to ensure success.

Page 9 of 14 DRJ GAP – Subject Area 1 Project Initiation and Management March 2015

DRJ GAP – Subject Area 1 Project Initiation and
Subject Area 1 – Project Initiation and Management

Sub-Topic #3 Points of Reference
# What How
EXECUTE (
Develop and Exercise • Assign representatives from in-scope • Subject Area 7: Awareness
Planning Teams. organizational areas. and Training Programs
9
• Use project controls to ensure success. • Subject Area 8: Maintaining
and Exercising BC Plans

Page 10 of 14 DRJ GAP – Subject Area 1 Project Initiation and Management March 2015