Business Continuity and Disaster Recovery Planning References

Websites

http://www.globalcontinuity.com

http://www.business-continuity-world.com/

http://www.contingencyplanning.com : Contingency Planning and Management Online

http://www.thebci.org : UK organization

http://www.dr.org/ : DRI International’s website

http://www.mrps.doi.gov/coo1.htm : DOI’s Continuity of Operations site

http://www.dis.anl.gov/ep/ep_home.html : Argonne National Lab's Division of Decision and Information Sciences

http://www.niap.nist.gov/ : information for IT; collaboration between NIST and NSA

http://www.fema.gov/fima/antiterrorism : "Hazard Mitigation: It's not just for natural disasters any more"

http://www.fema.gov/fima/planning_toc6.shtm : How-To Guide "Integrating Human-Caused Hazards Into Mitigation Planning"

http://www.fema.gov/pdf/library/bizindst.pdf : FEMA guide for business and industry

http://www.fema.gov/ofm/bc.shtm : FEMA document: creating a “business recovery” manual

http://www.fema.gov/library/libfpc_a.shtm : list of Federal Preparedness Circulars (FPC)

http://www.ofcm.gov/copc/presentations/nesdisupd-homesec.ppt : NOAA presentation on COOP

http://www.dr.org/pppdf.htm : Professional Practices for Business Continuity Planners

http://www.disaster-resource.com/content_page/indust_pub.shtml : bibliography of BC information

http://www.disaster-resource.com/content_page/govmnt.shtml : list of FEMA and State contacts

http://www.fmglobal.com/library/rmStrategies/disaster.html : creating a disaster plan.

http://www.fmglobal.com/library/rmStrategies/emergOrg.html : reasons for an emergency organization

http://www.financialsectorcontinuity.gov.uk/home/default.asp?expand=3&open=issues/cont_arrangements/default.htm : continuity guidance for UK financial sector

http://www.flaggshow.com/a_presentation.htm : presentation from a conference (Feb. 2002)

http://www.anykeynow.com/services/white_papers/bcp1.htm : article on creating a plan

http://www.securityauditor.net/iso17799/ : description of ISO 17799 Security Standard

http://cio.ost.dot.gov/policy/dirmm/DOT_H1350.254.html : DOT guide to continuity of operations (COOP)

http://csrc.nist.gov/fasp/FASPDocs/contingency-plan/TreasCOOPBSP.htm : Treasury COOP

http://www.fas.org/irp/offdocs/pdd/fpc-65.htm : FPC 65 (Executive Branch COOP)

http://www.ciao.gov/resource/paper598.html: Critical Infrastructure Assurance Office white paper

http://www.drj.com/new2dr/articles.htm : articles for people new to BC

http://www.drj.com/new2dr/model/bcmodel.htm : BC steps

http://www.drj.com/new2dr/samples.htm : sample plans

http://www.onlinenvironments.com/news/ADev_6quest.htm : 6 questions for preparedness

http://www.onlinenvironments.com/news/fdm1.htm : evaluate your risk exposure

http://dcema.dc.gov/info/drp.shtm : District of Columbia’s District Response Plan (DRP)

http://www.epa.gov/ceppo/ct-epro.htm : EPA’s Chemical Emergency Preparedness and Prevention Office (CEPPO)

http://www.drj.com/special/strohl/win01/1401-12.html : article on “BC Best Practices”

http://www.emergency.com/corporate_crisis.htm : list of resources

http://www.dti.gov.uk/mbp/bpgt/m9ba91001/m9ba910011.html: resource from the UK

http://www.ccep.ca/cceppubl.html: Canadian Centre for Emergency Preparedness

http://www.strohlsystems.com/BCP/EssaysArticles/default.asp : articles from Strohl Systems on BCP

http://www.strohlsystems.com/BCP/CaseStudy/CaseStudy.asp : links to Case Studies from Strohl

http://www.strohlsystems.com/Community/IndustryInfo/News.asp : links to BCP articles (from Strohl)

http://www.drexperts.com/KnowledgeNet/whitepapers.asp : list of papers from SunGard

http://www-1.ibm.com/services/continuity/recover1.nsf/files/Downloads/$file/buscont.pdf : paper from IBM on BC

http://www.sungard.com/images/Whitepaper_v3.pdf : paper from SunGard on BC for financial institutions

Books

Contingency Planning and Disaster Recovery : Protecting Your Organization's Resources
by Janet G. Butler, Poul Badura

Disaster Recovery Plan
by Richard Arnold

Standards to Establish an Effective Contingency Planning & Disaster Recovery Function
by Contingency Planning & Recovery Institute Consulting Staff

The Definitive Handbook of Business Continuity Management
by Andrew Hiles (Editor), Peter Barnes (Editor)

Manager's Guide to Contingency Planning for Disasters : Protecting Vital Facilities and Critical Operations
by Kenneth N. Myers

A Guide to Business Continuity Planning
by James C. Barnes, Philip Jan Rothstein

Articles

"Disaster management and business continuity planning"
Facilities Management, 1 April 2000, vol. 7, no. 6, pp. 14-15(2).
Organisations which have trained and exercised their people in implementing business continuity plans have the best chance of surviving a disaster. Writer Maureen Moody reminds us of the risks faced by businesses post-disaster and examines the formulation of an effective disaster and continuity plan.

"Disaster business continuity: promoting staff capability"
Paton D.
Disaster Prevention and Management: An International Journal, 1 February 1999, vol. 8, no. 2, pp. 127-133(7).
The object of business continuity planning is minimising loss after a disaster. Achieving this goal requires that management and information systems are available to facilitate the recovery of core business operations as soon as possible. While safeguarding systems and/or arranging for substitutes is vital, it is equally important to ensure the availability of staff capable of operating these system under adverse disaster conditions. Adopting a human resource perspective, this paper discusses the implications of staff vulnerability, hazard and risk assessment, organisational systems, training and recovery management for disaster business continuity.

"Critical issue for business area impact analysis in business crisis management: analytical capability"
Lee Y-J.; Harrald J.R.
Disaster Prevention and Management: An International Journal, 1 March 1999, vol. 8, no. 3, pp. 184-189(6).
Crisis management and organizational continuity have become increasingly critical areas of competence for managers in organizations. The approach of typical business organizations to the problems of business area impact analysis (BAIA) has been fragmented. In particular, the potential problem is the lack of an analytical capability to identify business functions/processes. The research objective is to describe how business functions/processes can be identified to analyze business area impact for corporate crisis management. In order to conduct the BAIA efficiently, it is first necessary to identify business functions/processes according to a scientific approach such as that described in the Information Engineering methodology for systems development. Next, to investigate the financial impacts on business functions/processes, which level of function/process hierarchy decomposition is used as a basis must be determined.

"Critical elements of a disaster recovery and business/service continuity plan"

"Effective Responses for Proactive Enterprises: Business Continuity Planning"

Frost C.
Disaster Prevention and Management, 1 February 1994, vol. 3, no. 1, pp. 7-15(9).
Discusses the development of Price Waterhouses business continuity plan. Points out the theory that businesses which are prepared for the worst (cites the Bishopsgate and Baltic Exchange in London, explosions)can survive the heaviest blow whereas those which are not, do not. The period of recovery will therefore be shorter and only minimal impact on business will occur.

"Disaster recovery planning in an automated manufacturing..."
Iyer, Raja K.; Sarkis, Joseph
IEEE Transactions on Engineering Management, May98, Vol. 45 Issue 2, p163.
Proposes a general framework for disaster recovery planning for manufacturing firms. Need for disaster recovery and business continuity planning; Impact of unmitigated and intangible losses on competitive and strategic positions of a firm; Crisis management issues addressed by the Manufacturing Operations Recovery and Resumption Model (MORR).

"Strategies to reduce the impacts of disasters on business processes: the case of business continuity"
Laye, J.E. Torre-Enciso, M.I.M
International Journal of Risk Assessment & Management. 2001. vol. 2, no. 3-4, pp. 319-329.
Events that are described as 'disasters' are those that cause severe impacts on human activities. Severe impacts can be reduced, and some can be eliminated for practical purposes, through suitable strategies. The aim of this paper is to discuss different ways to facilitate a comprehensive approach from policy level through middle and down to operational management. We will further discuss how the comprehensive approach can identify which business processes should not be, or can be, interrupted, integrating business continuity into overall strategy, and describe techniques to insure continuity of critical business processes. Part of this paper's report is our research, which includes interviews with executives knowledgeable about their corporations' crisis management planning. Recent literature and curricula for emergency management professionals now emphasize mitigation and recovery. In conjunction, directives from senior management and regulatory agencies are impelling a comprehensive management approach. One logical result is that business continuity has become one of several strategies used to reduce the impacts of disasters. The authors advocate using senior management's perspective to select criteria that can identify which business processes require the business continuity strategy. They believe managers at the policy level should facilitate using the comprehensive approach by setting the criteria for the next two levels' managers to apply. The authors expand the discussion, noting 'strategy' is applied differently at each of the three management levels. The authors propose seven impact categories that can determine when to apply business continuity or another strategy. They conclude by outlining management techniques to incorporate business continuity into overall strategy.

"Business Continuity Planning"
Corbitt SM
NTIS u9913.
All organizations are dependent on People, Information, and Communications to conduct business. Interruptions that affect any of these resources will have a detrimental impact on business. Disasters that affect these resources will likely have a far reaching impact on business and may result in the failure of the business or organization. Business must plan for continuing business after a disaster via a Business Continuity Plan. The BCP is a critical function of the business and will impact every function of the business. Planners must have resources and commitment from senior executives to be successful. Planners must develop plans that recover time sensitive functions first, while bringing less time sensitive functions on line in an economically balanced manner. Planners must consider the toll of a disaster, not only on their facilities and equipment, but on the human resources which are their most precious asset Planners must ensure plans are maintained and exercised on a regular basis and critique the exercise participants to improve their chances for successful resumption of business. Organizations that are led by strong leaders with genuine concern for their customers and employees will develop strong continuity plans. Overall the private sector is more advanced than government when it comes to BCP, however some large corporations still lack integrated continuity plans.

"Protecting your business: from emergency planning to crisis management"
Ramsey, Cameron
Journal of Hazardous Materials, 1999, vol. 65, 131-149.
The forthcoming UK Control of Major Accident Hazards COMAH regulations under the European Community’s Seveso II Directive will impose a new formal requirement to test emergency plans. This might be approached as an added burden on industry to demonstrate safe operation, or can be viewed alternatively as an opportunity to improve crisis management systems and thereby decrease the risks to the business. Crisis is by nature an ambiguous and complex environment, demanding endless initiative, inventiveness, communication, co-ordination and learning. Because large-scale crises threatening the entire business are not frequent, learning from experience must be replaced by competence-assurance based on systems thinking, on risk assessment, on wide scenario simulations and on rigorous training. This paper discusses the benefits from various types of testing of emergency plans and from a business approach to continuous improvement in crisis management capability. q1999 Elsevier Science B.V. All rights reserved.