Business Continuity Planning (BCP) - Best
Description: Business Continuity Planning (BCP) - Best Practices and Challenges June 24, 2020 About the Speaker Dhiraj Lal Over 32 years in the industry. Ex BCM Sponsor and Head of American Express. Mix of experience as Practitioner, Trainer, and
Related Topics
Download Presentation
"Business Continuity Planning (BCP) - Best" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Presentation Transcript
slide1. Business Continuity Planning (BCP) - Best Practices and Challenges
June 24, 2020<br>
slide2. About the Speaker – Dhiraj Lal Over 32 years in the industry. Ex BCM Sponsor and Head of American Express. Mix of experience as Practitioner, Trainer, and Consultant . BCI Approved Instructor. Over 15 years in BCM and related domains.
Contributing Author to : The Encyclopaedia of Business Continuity, 3rd Edition
Author of: Step by Step guide AE/SCNS/NCEMA 7000:2015. Implement BCM the UAE Way! Dhiraj Lal, EXECUTIVE DIRECTOR, CONTINUITY & RESILIENCE (CORE)
MBCI, CBCP, CBCI, ISO 22301 Technical Expert, CISA, ITIL, ISO 31000, ISO 27001 Lead Auditor
A Chemical Engineer from IIT Delhi and MBA from IIM Calcutta, , Dhiraj Lal has over 20 years BCM experience and 32 years overall. He has worked with Citibank, Standard Chartered, Agilent and American Express, where he was the Program Sponsor and BCM Head. He is Asia’s first BSI appointed Technical Expert for BS25999/ ISO 22301, and assessed 2 of the top 10 certified organizations globally. He teaches and consults in BCM (NCEMA 7000/ ISO 22301) and related domains. He has been invited to present at the BCI Annul conference in the UK, DRI US, BCMI Singapore, itSMF UK, DRI Asia in Malaysia, ISACA UAE, KSA and India, and also various Middle East Crisis, BCM and IT Resilience Summits in Abu Dhabi, Dubai, KSA and India<br>
slide3. About Continuity & Resilience
ISO 22301 Certified Management Consulting Firm
Business Continuity Management
Crisis Management
IT Disaster Recovery
Information Security
Cyber Security
Risk Management
We Consult / Train / Assess and Certify in these domains
We provide advisory services
Automation tools – BCM/ ITDR/ Mass Communication
Workplace recovery
E-Learning<br>
slide4. Agenda
Business Continuity Planning
Business Continuity Implementation Roadmap
BCP in times of COVID-19
Challenges and Best Practices<br>
slide5. Business Continuity Planning “Planning to to continue the Business”
Not a new concept. A fancy name for common sense. In reality, we have been performing Business Continuity Planning for centuries
But still, many organizations struggled to restart operations during COVID-19
So we need more than just common sense. We need a structured and formal implementation of common sense.<br>
slide6. What we do not fully do in BAU common sense Agree timelines, worst case and best case (MTPD and RTO)
Base it fully on facts and data (consequences of downtime)
Consultative process involving all interested parties
Comprehensive, documented and signed off
Communicate to all who need to know, including relevant third parties and service providers
Practice, Test & exercise. Review. Maintain & continually Improve
Amazingly, this works…!!<br>
slide7. Challenges for cyber professionals An uneven battle against an unknown enemy who has nothing better to do
You have other matters to focus on but they have a single point agenda – to damage
You constantly focus on getting better and better - but so do they
By the sheer law of averages, once in a while they will succeed
At those times, your best best is to be able to restart fast and within minimum loss. So you need the world’s best Business Continuity readiness
Have you formally put in place the 6 Rs (Reduce, Respond, Recover, Resume, Restore Return)?
When did you last practice them?<br>
slide8. Challenges for cyber professionals Economic Times, June 24 2020<br>
slide9. Some reasons for Outages (Global data) 9<br>
slide10. Business Continuity is a wise investment Minimize business disruptions and quickly recover
Retain business model and increase market share and profits
Protect the organization’s value and reputation
Corporate governance and shareholder commitment
National requirements
Contractual commitments, Legal and regulatory compliance
Moral and social responsibilities
Demonstrate “best practice”
Reduce insurance liabilities 10 Lack of BCP is self goal<br>
slide11. Typical steps Business Continuity Implementation Roadmap<br>
slide12. International BCM Standard – ISO 22301 12 Clause 1 : Scope
Clause 2 : Normative references
Clause 3 : Terms and definitions
Clause 4 : Context of the organisation
Clause 5 : Leadership
Clause 6 : Planning
Clause 7 : Support
Clause 8 : Operation
Clause 9 : Performance evaluation
Clause 10 : Improvement<br>
slide13. Please implement a BCMS – not just BCM “Part of the overall management system that establishes, implements, operates, monitors, reviews, maintains and improves business continuity”– ISO 22301
Ensure continual improvement via the PDCA cycle<br>
slide14. BCP in times of COVID-19 COVID-19 is different from a typical Business Continuity situation Much longer duration
No clarity on final resolution
Triggered not by damage to resources
Entire ecosystem is impacted
SOME POSITIVES
Realization by all
Even the PM asked entities to
implement Business Continuity
Tolerance – “It’s Ok”
Permanent mindset changes<br>
slide15. Suggestions for professionals Don’t stop now – complete the journey
Protect yourself against other new threats - implement the full BCM cycle
Use this opportunity to create permanent BCM readiness and awareness across all segments
Get your people ISO22301 trained and your organization ISO22301 compliant – or even ISO22301 certified<br>
slide16. Implement the full
BCM lifecycle Choose the right people Provide effective training in advance of the implementation Best Practices<br>
slide17. Customers Citizens Distributors Shareholders Investors Owners Insurers Government Regulators Recovery Services Suppliers Competitors Media Commentators Trade Groups Neighbours Pressure Groups Emergency Services Transport Services Other Response Agencies Dependents of staff THE ORGANIZATION Top Management Those who establish policies and objectives for the BCMS Those who set up & manage BC Those who maintain BC Procedures Owners of business continuity procedures Incident Response Personnel Those with authority to invoke Appropriate spokespeople Response Teams Other Staff Contractors Build culture across all Interested Parties ..<br>
slide18. Build Culture via Training and Awareness<br>
slide19. Graph not to scale Cost
Complexity
Risk
Assurance Frequency Build Culture via tests and exercises<br>
slide20. Ensure Review, Maintenance and Improvement Maintenance
Advanced Testing and Exercising
Ongoing Awareness and Training
Internal Audit and Self Assessment
Management review
Supplier Review
Corrections and Corrective actions
Benchmarking
Continual Improvement
Instilling a BCM mindset 20<br>
slide21. Way Forward=> Organizational Resilience Way Forward=> Organizational Resilience The ability of an organisation to absorb and adapt in a changing environment (BCI GPG 2018/ ISO 22316:2017)<br>
slide22. Questions?<br>
slide23. 23 LETS KEEP IN TOUCH!! Dhiraj Lal, Executive Director +91 99101 10240
dhiraj.l@continuityandresilience.com Thank You!<br>
June 24, 2020<br>
slide2. About the Speaker – Dhiraj Lal Over 32 years in the industry. Ex BCM Sponsor and Head of American Express. Mix of experience as Practitioner, Trainer, and Consultant . BCI Approved Instructor. Over 15 years in BCM and related domains.
Contributing Author to : The Encyclopaedia of Business Continuity, 3rd Edition
Author of: Step by Step guide AE/SCNS/NCEMA 7000:2015. Implement BCM the UAE Way! Dhiraj Lal, EXECUTIVE DIRECTOR, CONTINUITY & RESILIENCE (CORE)
MBCI, CBCP, CBCI, ISO 22301 Technical Expert, CISA, ITIL, ISO 31000, ISO 27001 Lead Auditor
A Chemical Engineer from IIT Delhi and MBA from IIM Calcutta, , Dhiraj Lal has over 20 years BCM experience and 32 years overall. He has worked with Citibank, Standard Chartered, Agilent and American Express, where he was the Program Sponsor and BCM Head. He is Asia’s first BSI appointed Technical Expert for BS25999/ ISO 22301, and assessed 2 of the top 10 certified organizations globally. He teaches and consults in BCM (NCEMA 7000/ ISO 22301) and related domains. He has been invited to present at the BCI Annul conference in the UK, DRI US, BCMI Singapore, itSMF UK, DRI Asia in Malaysia, ISACA UAE, KSA and India, and also various Middle East Crisis, BCM and IT Resilience Summits in Abu Dhabi, Dubai, KSA and India<br>
slide3. About Continuity & Resilience
ISO 22301 Certified Management Consulting Firm
Business Continuity Management
Crisis Management
IT Disaster Recovery
Information Security
Cyber Security
Risk Management
We Consult / Train / Assess and Certify in these domains
We provide advisory services
Automation tools – BCM/ ITDR/ Mass Communication
Workplace recovery
E-Learning<br>
slide4. Agenda
Business Continuity Planning
Business Continuity Implementation Roadmap
BCP in times of COVID-19
Challenges and Best Practices<br>
slide5. Business Continuity Planning “Planning to to continue the Business”
Not a new concept. A fancy name for common sense. In reality, we have been performing Business Continuity Planning for centuries
But still, many organizations struggled to restart operations during COVID-19
So we need more than just common sense. We need a structured and formal implementation of common sense.<br>
slide6. What we do not fully do in BAU common sense Agree timelines, worst case and best case (MTPD and RTO)
Base it fully on facts and data (consequences of downtime)
Consultative process involving all interested parties
Comprehensive, documented and signed off
Communicate to all who need to know, including relevant third parties and service providers
Practice, Test & exercise. Review. Maintain & continually Improve
Amazingly, this works…!!<br>
slide7. Challenges for cyber professionals An uneven battle against an unknown enemy who has nothing better to do
You have other matters to focus on but they have a single point agenda – to damage
You constantly focus on getting better and better - but so do they
By the sheer law of averages, once in a while they will succeed
At those times, your best best is to be able to restart fast and within minimum loss. So you need the world’s best Business Continuity readiness
Have you formally put in place the 6 Rs (Reduce, Respond, Recover, Resume, Restore Return)?
When did you last practice them?<br>
slide8. Challenges for cyber professionals Economic Times, June 24 2020<br>
slide9. Some reasons for Outages (Global data) 9<br>
slide10. Business Continuity is a wise investment Minimize business disruptions and quickly recover
Retain business model and increase market share and profits
Protect the organization’s value and reputation
Corporate governance and shareholder commitment
National requirements
Contractual commitments, Legal and regulatory compliance
Moral and social responsibilities
Demonstrate “best practice”
Reduce insurance liabilities 10 Lack of BCP is self goal<br>
slide11. Typical steps Business Continuity Implementation Roadmap<br>
slide12. International BCM Standard – ISO 22301 12 Clause 1 : Scope
Clause 2 : Normative references
Clause 3 : Terms and definitions
Clause 4 : Context of the organisation
Clause 5 : Leadership
Clause 6 : Planning
Clause 7 : Support
Clause 8 : Operation
Clause 9 : Performance evaluation
Clause 10 : Improvement<br>
slide13. Please implement a BCMS – not just BCM “Part of the overall management system that establishes, implements, operates, monitors, reviews, maintains and improves business continuity”– ISO 22301
Ensure continual improvement via the PDCA cycle<br>
slide14. BCP in times of COVID-19 COVID-19 is different from a typical Business Continuity situation Much longer duration
No clarity on final resolution
Triggered not by damage to resources
Entire ecosystem is impacted
SOME POSITIVES
Realization by all
Even the PM asked entities to
implement Business Continuity
Tolerance – “It’s Ok”
Permanent mindset changes<br>
slide15. Suggestions for professionals Don’t stop now – complete the journey
Protect yourself against other new threats - implement the full BCM cycle
Use this opportunity to create permanent BCM readiness and awareness across all segments
Get your people ISO22301 trained and your organization ISO22301 compliant – or even ISO22301 certified<br>
slide16. Implement the full
BCM lifecycle Choose the right people Provide effective training in advance of the implementation Best Practices<br>
slide17. Customers Citizens Distributors Shareholders Investors Owners Insurers Government Regulators Recovery Services Suppliers Competitors Media Commentators Trade Groups Neighbours Pressure Groups Emergency Services Transport Services Other Response Agencies Dependents of staff THE ORGANIZATION Top Management Those who establish policies and objectives for the BCMS Those who set up & manage BC Those who maintain BC Procedures Owners of business continuity procedures Incident Response Personnel Those with authority to invoke Appropriate spokespeople Response Teams Other Staff Contractors Build culture across all Interested Parties ..<br>
slide18. Build Culture via Training and Awareness<br>
slide19. Graph not to scale Cost
Complexity
Risk
Assurance Frequency Build Culture via tests and exercises<br>
slide20. Ensure Review, Maintenance and Improvement Maintenance
Advanced Testing and Exercising
Ongoing Awareness and Training
Internal Audit and Self Assessment
Management review
Supplier Review
Corrections and Corrective actions
Benchmarking
Continual Improvement
Instilling a BCM mindset 20<br>
slide21. Way Forward=> Organizational Resilience Way Forward=> Organizational Resilience The ability of an organisation to absorb and adapt in a changing environment (BCI GPG 2018/ ISO 22316:2017)<br>
slide22. Questions?<br>
slide23. 23 LETS KEEP IN TOUCH!! Dhiraj Lal, Executive Director +91 99101 10240
dhiraj.l@continuityandresilience.com Thank You!<br>