Disaster Recovery Planning is Key to Business Continuity
ISO 27000, SOX, PCI-DSS & HIPAA Compliant
The Standard for Business Continuity and Disaster Planning
Janco's Disaster Recovery Planning (DRP) Template can be used for any size of enterprise. The Disaster Recovery template and supporting material have been updated to be Sarbanes-Oxley and HIPAA compliant. The Disaster Planning Template comes as both a Word document and a static fully indexed PDF document and includes:
- Disaster Recovery Planning and Business Continuity Planning Template,
- Business and IT Impact Analysis Questionnaire,
- Work Plan,
- Disaster Recovery / Business Continuity Audit Program, and
- Pandemic Planning Checklist.
Preparation for Disaster Recovery / Business Continuity in light of SOX has two primary parts. The first is putting systems in place to completely protect all financial and other data required to meet the reporting regulations and to archive the data to meet future requests for clarification of those reports. The second is to clearly and expressly document all these procedures so that in the event of a SOX audit, the auditors clearly see that the DRP exists and will appropriately protect the data.
New are (Version History):- Backup & Backup Retention Policy,
- Disaster Recovery Audit Program,
- Compliance with the ISO 27000 Series Standards (formerly ISO 17799 now ISO 27001 & ISO 27002), Sarbanes-Oxley, PCI-DSS, and HIPAA,
- Web Site Disaster Recovery Planning Form,
- Project Status Report Form,
- Personnel Location Report,
- Department Disaster Recovery Activation Workbook,
- Quick Reference Guide,
- Team Alert List (Form),
- DRP Team Responsibilities,
- DRP Team Checklist,
- Critical Function(s) Definition,
- Normal Business Hour Response Procedures,
- After Hours Response Procedures,
- DRP Location(s) Definition,
- DRP Recovery Procedures,
- Notification Procedures,
- Notification Call List (Form),
- Updated Business and IT Impact Analysis Questionnaire,
- Vendor Disaster Recovery Questionnaire,
- Vendor Phone List Form Updated,
- Key Customer Notification Form,
- Critical Resources to be Retrieved Form,
- Business Continuity Off-Site Materials Form, and
- Business Continuity Audit Program,
- Chief Information Officer,
- Chief Security Officer,
- Chief Compliance Officer,
- VP Strategy and Architecture,
- Director Disaster Recovery and Business Continuity,
- Director e-Commerce,
- Manager Disaster Recovery,
- Manager Disaster Recovery and Business Continuity,
- Disaster Recovery Coordinator,
- Disaster Recovery - Special Projects Supervisor,
- Manager Database,
- Capacity Planning Supervisor,
- Manager Media Library Support,
- Manager Site Management, and
- Pandemic Coordinator.
DRP / BCP News
ISO 17799 - disaster recovery - business continuity defined
SO 17799 is often used as a generic term to describe what are actually two different documents: ISO17799 (also ISO 27002), which is a set of security controls (a code of practice), and ISO 27001 (formerly BS7799-2), which is a standard 'specification' for an Information Security Management System (an ISMS).
ISO 17799 establishes guidelines and general principles for initiating, implementing, maintaining, and improving information security management in an organization. The objectives outlined provide general guidance on the commonly accepted goals of information security management. ISO/IEC 17799:2005 contains best practices of control objectives and controls in the following areas of information security management:
- security policy;
- organization of information security;
- asset management;
- human resources security;
- physical and environmental security;
- communications and operations management;
- access control;
- information systems acquisition, development and maintenance;
- information security incident management;
- business continuity management;
- compliance.
The control objectives and controls in ISO/IEC 17799 are intended to be implemented to meet the requirements identified by a risk assessment. ISO/IEC 17799 is intended as a common basis and practical guideline for developing organizational security standards and effective security management practices, and to help build confidence in inter-organizational activities
- more info
Disaster Planning is Complex
An increasing number of professionals know that small-scale emergencies can be contained if staff members are prepared to react quickly. Damage can be limited even in the face of a large-scale disaster. For example, cultural institutions in Charleston, South Carolina, formed a consortium that focused on disaster preparedness several years before they were hit by a hurricane. Many of those institutions sustained only minor damage because they were able to put their early warning procedures into operation.
Disaster planning is complex; the written plan is the result of a wide range of preliminary activities. The entire process is most efficient if it is formally assigned to one person who acts as the disaster planner for the institution and is perhaps assisted by a planning team or committee. The enterprise's director may play this primary role or may delegate the responsibility, but it is important to remember that the process must be supported at the highest level of the organization if it is to be effective. The planner should establish a timetable for the project and should define the scope and goals of the plan, which will depend largely on the risks faced by the enterprise.
- more info
Disaster recovery business continuity team leader tasks
The tasks that the leader of a disaster recovery business continuity project needs to complete are:
- more info
- Establish BC program lifecycle processes within your organization
- Assess business and technology requirements for a BC plan
- Evaluate business continuity risks to your organization
- Identify and select cost-effective BC recovery strategies
- Organize an effective BC team
- Develop a BC plan document
- Coordinate BC plan with external entities
- Develop an effective test plan for testing the BC plan
- Organize and conduct successful BC plan tests
- Establish a process for maintaining the BC plan
- Implement a BC plan change management process
- Understand the main differences between a disaster recovery plan, emergency response plan, crisis management plan, and business continuity plan
Business continuity after a terroist attack or a pandemic
Most aspects of business continuity and disaster recovery planning apply to terrorist attacks and pandemics just as much as to fires, hurricanes, floods, earthquakes, and other natural and manmade disasters.
- more info
Business continutiy defined
In the simplest of terms, it is good business for a company to secure its assets. CIO under the direction of CEOs and enterprise shareholders must be prepared to budget for and secure the necessary resources to support business continuity.It is necessary that an appropriate administrative structure be created to effectively deal with crisis management. This will ensure that all concerned understand who makes decisions, how the decisions are implemented, and what the roles and responsibilities of participants are. Personnel used for crisis management should be assigned to perform these roles as part of their normal duties and not be expected to perform them on a voluntary basis. Regardless of the organization - for profit, not for profit, faith-based, non-governmental - its leadership has a duty to stakeholders to plan for its survival.
With the explosion of technology into every facet of the day-to-day business environment there is a need to define an effective infrastructure to support operating environment; have a strategy for the deployment and technology; and clearly define responsibilities and accountabilities for the use and application of technology.
The template comes as both a WORD document utilizing a CSS style sheet that is easily modifiable.
- more info
